Bunnings, the Australian household hardware chain, has been found guilty of breaching the Privacy Act by the Privacy Commissioner for its use of facial recognition technology in a trial across 63 stores nationally. The system, implemented via CCTV, captured the faces of every person who entered 63 Bunnings stores in Victoria and New South Wales between November 2018 and November 2021.

Privacy Commissioner Carly Kind stated that while facial recognition technology can help protect against serious issues, its benefits need to be weighed against the impact on privacy rights and societal values. In this case, Bunnings was found to have collected individuals’ sensitive information without consent, failed to notify individuals that their personal information was being collected, and did not include required information in its privacy policy.

“Facial recognition technology, and the surveillance it enables, has emerged as one of the most ethically challenging new technologies in recent years,” said Commissioner Kind. “In this instance, deploying facial recognition technology was the most intrusive option, disproportionately interfering with the privacy of everyone who entered its stores, not just high-risk individuals.”

Bunnings has been cooperative throughout the investigation and paused its use of facial recognition technology pending the outcome. The Commissioner has made various orders, including that Bunnings must not repeat or continue the acts and practices that led to the interference with individuals’ privacy. Bunnings has the right to seek review of the determination.

“This decision should serve as a reminder to all organisations to proactively consider how the use of technology might impact privacy and to make sure privacy obligations are met,” Commissioner Kind added. “Organisations should be aware that ensuring the use of emerging technologies aligns with community expectations and regulatory requirements is high among our priorities.”

In a media statement, Bunnings defended its use of the technology, stating that the trial was conducted with the “sole and clear intent of keeping our team and customers safe and preventing unlawful activity by repeat offenders.” The company added, “Everyone deserves to feel safe at work. No one should have to come to work and face verbal abuse, threats, physical violence or have weapons pulled on them.”

The case was brought to the Privacy Commissioner by consumer advocacy group Choice in 2022 following an investigation into the use of facial recognition technology across a number of Australian retailers including The Good Guys, Kmart and 7-Eleven. The Office of the Australian Information Commissioner has published a new privacy guide for businesses considering using facial recognition technology in a commercial or retail setting.