Bunnings wins appeal over use of facial recognition tech to combat retail crime
Make us a preferred source
Make us a preferred source on Google
The news: An appeals tribunal has ruled that Bunnings had the right to use facial recognition technology (FRT) to combat retail crime in its stores, overturning a 2024 decision in which the Privacy Commissioner found Bunnings had breached privacy laws.
The context: Bunnings’ facial recognition system captured the faces of every person who entered Bunnings stores in Victoria and New South Wales between November 2018 and November 2021, according to the Office of the Australian Information Commissioner (OAIC). The system compared the faces against a database of banned customers, with any matches alerted to team members straight away. If there was no match, the information was deleted after 4.17 milliseconds.
Bunnings appealed the Privacy Commissioner’s ruling, with the Review Tribunal finding that both before and during the relevant period, Bunnings faced a “very real and serious problem of violence and theft in its stores… Bunnings took this problem very seriously and invested significant resources to deal with security issues.”
The Administrative Review Tribunal said: “Bunnings was entitled to use FRT for the limited purpose of combating very significant retail crime and protecting their staff and customers from violence, abuse and intimidation within its stores.”
However, the Tribunal also found that Bunnings failed to take the necessary measures to comply with privacy principles, particularly by failing to properly inform customers about the information it was collecting.
“We find that Bunnings failed to include in its privacy policies information about the kinds of personal information that it collected and held, and how it collected and held that personal information,” the decision read.
In a statement following the decision, an OAIC spokesperson said: “Today’s decision…underscored the importance of APP entities maintaining good privacy governance and complying with the Australian Privacy Principles in adopting new tech, and that limited exemptions are subject to robust criteria that must be assessed on a case-by-case basis.
“We particularly welcome that the decision reaffirmed a range of key interpretive positions taken by the OAIC, including that even momentary collection of personal information by advanced digital tools constitutes a collection under the Privacy Act.”
The OAIC said it is carefully considering the decision and its implications. An appeal period applies to the ART’s decision.
The sources: OAIC statement, The Australian, The West Australian
