Facial recognition technology and privacy law in Australia: Lessons from the Bunnings decision

The use of facial recognition technology is becoming increasingly common for security and law enforcement purposes. But the technology brings with it a range of privacy concerns, and until recently the law was unclear about exactly what privacy protections are required to implement facial recognition technology in Australia. 

This seminar will look at the legalities of facial recognition technology in Australia, discussing the relevant Australian Privacy Principles, and focusing on the recent decision of the Administrative Review Tribunal (the "Tribunal") in Bunnings Group Limited and Privacy Commissioner [2026] ARTA 130, which is the first time an Australian tribunal has ruled on the legality of facial recognition technology and the collection and use of biometric information under the Australian Privacy Act 1988 (Cth) (the "Act").

Between 2018 and 2021, Bunnings deployed facial recognition technology across 62 retail stores in Victoria and New South Wales. The system captured images of customers entering stores and compared them against a database of individuals known to Bunnings as having committed theft, violence and fraud. When a match was found, security staff would be deployed to address the situation. If a match was not found, the captured images would be deleted after an average of 4.17 milliseconds. 

In 2024, the OAIC investigated Bunnings’ use of the technology and determined that it had breached three Australian Privacy Principles ("APPs"). The Tribunal upheld the OAIC’s determination that Bunnings had breached APP 1 and APP 5. Critically, however, it disagreed that Bunnings had breached APP 3 – specifically, it held that the "unlawful activity" exception relied on by Bunnings did apply in these circumstances. 

The Tribunal’s decision makes it clear that facial recognition technology can be implemented legally under the Act, but that it must be implemented for an appropriate purpose and accompanied by adequate privacy protections. 

The decision clarifies that:

• Facial recognition technology will be considered to "collect" personal information and so be subject to the Act, even if that collection is automated and brief; and
• The use of facial recognition technology requires consent of individuals - unless an exception applies.

The decision provides a "roadmap" for organisations looking to use facial recognition technology to prevent or detect unlawful activity, by making clear that they must:

• reasonably believe that the use of the technology is necessary and appropriate in all the circumstances for that purpose (taking into account the suitability and proportionality of the technology and the effectiveness of less-intrusive alternatives); 
• provide detailed notices to individuals regarding its use of facial recognition technology and collection of biometric information, and must also include information about its handling of that information in its publicly available privacy policy;
• have rigorous compliance systems in place, must conduct a privacy impact assessment to identify and mitigate the risks associated with facial recognition technology prior to implementing it; and
• conduct appropriate privacy training for its employees.

​