Aussie hardware goliath Bunnings has won a landmark legal challenge allowing it to use artificial intelligence-powered facial recognition technology to combat retail crime and protect staff.
The new decision overturns a previous ruling by Australia’s privacy watchdog.
The Administrative Review Tribunal has found the hardware giant did not breach privacy laws during its trial of facial recognition technology, reversing a 2024 determination by Privacy Commissioner Carly Kind that Bunnings had unlawfully collected customers’ biometric data without consent.
While the tribunal upheld Bunnings’ right to use the technology for security purposes, it said the retailer should improve customer notification, signage, internal processes and its privacy policy.
The decision is expected to have broader implications for the retail sector, potentially enabling other retailers to deploy similar AI-based security systems.
Bunnings CEO, Mike Schneider
Tribunal backs limited use of facial recognition
In a statement, Bunnings managing director Mike Schneider said the retailer welcomed the decision and acknowledged areas for improvement.
“Our intent in trialling this technology was to help protect people from violence, abuse, serious criminal conduct and organised retail crime,” Schneider said.
“The tribunal recognised the need for practical, common-sense steps to keep people safe. It also identified areas where we didn’t get everything right, including around signage, customer information and our privacy policy, and we accept that feedback.”
The tribunal found that Bunnings was entitled to use facial recognition technology for the limited purpose of combating serious retail crime and safeguarding staff and customers, noting the scale of theft and abuse the retailer faced.
It also cited technical safeguards in the system, including the rapid deletion of biometric data for customers who were not flagged as known offenders.
How the technology was used
Bunnings first experimented with facial recognition technology in one store in November 2018, then expanded its use to 62 stores across New South Wales and Victoria between January 2019 and November 2021.
The system, developed by Hitachi and supplied via a third party, scanned customers’ faces in CCTV footage and compared them with a database of “enrolled individuals” suspected of theft, fraud, or threatening behaviour.
According to the tribunal, the enrolment list at times included hundreds of individuals. Facial data for customers who were not matched was automatically deleted within milliseconds.
The image database was stored on a central server in Sydney, with copies temporarily held on local store servers.
Privacy concerns remain
The case first emerged publicly in 2022 after consumer advocacy group Choice revealed that Bunnings, Kmart and The Good Guys had been using facial recognition technology.
All three retailers paused the AI practice following the report.
The Office of the Australian Information Commissioner (OAIC) said the tribunal’s ruling confirmed that privacy protections still apply to emerging technologies, even when data is collected momentarily.
The tribunal agreed Bunnings had not sufficiently informed customers that facial recognition technology was in use and needed to strengthen how it managed personal information, particularly for customers not included in the enrolment database.
“The Australian community continues to care deeply about their privacy, and is increasingly worried about the challenges in protecting their personal information.”