Embedded Files
Bunnings Facial Recognition gets the Green Light
The "Green Light" for Retail Facial Recognition: Understanding the Strict New Standards
Date: February 6, 2026
Category: Retail Security / Privacy Compliance
A landmark decision by the Administrative Review Tribunal (ART) has officially reversed a 2024 privacy ruling, finding that Bunnings was entitled to use Facial Recognition Technology (FRT) to combat violent retail crime.
While industry commentators are calling this a "green light" for Australian retailers, a close reading of the decision reveals that this approval is far from a blank cheque. The Tribunal’s decision establishes a strict new legal and technical baseline for how biometric data must be handled in retail environments.
For security leaders and compliance officers, the message is clear: You can use the technology, but the "how" matters more than ever.
The Justification: Safety Over Privacy?
The Tribunal accepted that the intrusion into customer privacy was "necessary" and "proportionate" given the specific threats Bunnings faced. Evidence presented to the Tribunal highlighted that 66% of theft loss was attributable to just 10% of offenders, and staff were subjected to threatening behavior every two to three days on average.
The ruling confirmed that protecting staff and customers from "violence, abuse and intimidation" is a legitimate basis for deploying FRT, provided the response is not disproportionate.
The Technical Benchmark: 4.17 Milliseconds
Perhaps the most critical takeaway for IT and security architects is the specific technical standard validated by the Tribunal. The ruling hinged heavily on the system's ability to minimise privacy intrusion through "momentary collection".
The Tribunal noted that while scanning a face constitutes "collection" under the Privacy Act, the Bunnings system was acceptable because non-offender data was:
Held Momentarily: Data for customers not on the "banned list" was processed and deleted within an average of 4.17 milliseconds.
Permanently Deleted: The system ensured that this data was irretrievable and never written to long-term storage.
Secure: The architecture limited susceptibility to cyber-attacks.
This sets a de facto industry standard: To be compliant, systems must likely demonstrate immediate, automated deletion of non-matched biometric data.
Where Governance Failed: The Transparency Gap
Despite winning the right to use the technology, Bunnings was found to have breached privacy laws regarding transparency. The Tribunal ruled that the retailer's posters and entry notices were insufficient to notify visitors that their sensitive information was being collected.
The ruling emphasises that retailers cannot rely on small print. Effective immediately, compliance requires:
Prominent Notification: Clear, undeniable signage explicitly stating the use of FRT.
Formal Risk Assessments: The OAIC noted that retailers should complete a "formal, structured and documented" Privacy Impact Assessment (PIA) before rolling out such technology.
Human Oversight: The Tribunal validated the system in part because false positives were "manually reviewed by staff members" rather than acted upon by automation alone.
The Regulatory Outlook
The Office of the Australian Information Commissioner (OAIC) has responded by reiterating that exemptions to the Privacy Act are assessed on a "case-by-case basis". They emphasised that "good privacy governance" is non-negotiable and that even momentary collection requires strict adherence to privacy principles.
While this decision opens the door for other major retailers to adopt FRT, it slams it shut on reckless implementation. The "Green Light" is conditional on speed, security, and absolute transparency.
Our goal is to look beyond the hardware and collaborate to make the world a safer place together.
Please Note: The information provided in these articles is general in nature and intended for educational purposes. Every operational environment has unique vulnerabilities; therefore, it is recommended to seek site-specific expert advice for your specific needs.
Page updated
Report abuse