In Bunnings Group Limited and Privacy Commissioner (Guidance and Appeals Panel) [2026] ARTA 130 the Administrative Review Tribunal set aside the Privacy Commissioner’s finding that Bunnings breached Australian Privacy Principle (APP) 3.3 (collection of solicited personal information) because subclause 3.4 applies as facial recognition technology (FRT) was a suitable and effective response to the problem of unlawful activity in the form of retail crime by repeat offenders as envisaged under section 16A of the Privacy Act.
The Tribunal affirmed the Privacy Commissioner’s finding that Bunnings contravened Australian Privacy Principles (APP) 1 (open and transparent management of personal information) and 5 (notification of the collection of personal information) when rolling out FRT in its stores.
The Tribunal found that Bunnings failed to provide appropriate notice to individuals of its use of FRT and should have completed a ‘formal, structured and documented’ risk assessment of its FRT system, which considered the privacy implications.
However, the Tribunal was satisfied that Bunnings was entitled to rely on exemptions to the requirement to obtain consent, for the limited purpose of combatting retail crime and protecting their staff and customers from violence, abuse and intimidation within their stores. Background.
The Privacy Commissioner has not filed an appeal in the matter.
The Privacy Commissioner has announced that specific updates to existing guidance will be made to reflect the Tribunal’s decision and ensure that retailers have up-to-date information about the regulatory application of the law.
“Those updates will also emphasise that the decision in Bunnings confirms a high bar for the use of facial recognition technology in Australia, and that entities will need to conduct a detailed risk assessment specific to their circumstances before deploying the technology. Retailers should view the decision as a useful case study, rather than a green light for deployment of biometric technologies.”
If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.
Author: David Jacobson
Principal, Bright Corporate Law
Email:
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.
