RETAIL SECURITY / PRIVACY COMPLIANCE
Bunnings Facial Recognition gets the Green Light
By Anderson Consulting Partners | Published: February 6, 2026 | 8 min read | Target Audience: Retail Executives, CISOs &; Compliance Officers
Embedded Files
EXECUTIVE SUMMARY & TRIBUNAL KEY TAKEAWAYS
ART Tribunal Ruling (Feb 2026): Reversed the 2024 Privacy Commissioner's finding, ruling Bunnings was entitled to deploy Facial Recognition Technology (FRT) to protect staff against violent crime.
The 4.17 Millisecond Benchmark: Facial vector sets for non-matched shoppers were processed and deleted within 4.17 ms in RAM, establishing a critical technical standard for data minimisation.
Safety vs. Privacy Justification: Evidence showing 10% of repeat offenders caused 66% of theft loss, combined with staff facing aggression every 2–3 days, created a "permitted general situation" under the Privacy Act.
Transparency Failure: Bunnings still breached APP 1 and APP 5 due to small, vague door posters; explicit entrance signage and formal risk assessments are now mandatory.
Mandatory Human-in-the-Loop: Automated algorithmic matches must serve strictly as investigative leads and require manual operator verification before taking action.
IN THIS ARTICLE
1. Safety Over Privacy?
2. The 4.17ms RAM Benchmark
3. APP 1 & 5 Transparency Gaps
4. OAIC 4-Point Governance Rules
5. How ACP Protects Retailers
The "Green Light" for Retail Facial Recognition: Understanding the Strict New Standards
A landmark decision by the Administrative Review Tribunal (ART) has officially reversed a 2024 privacy ruling, finding that Bunnings was entitled to use Facial Recognition Technology (FRT) to combat violent retail crime.
While industry commentators are calling this a "green light" for Australian retailers, a close reading of the decision reveals that this approval is far from a blank cheque. The Tribunal’s decision establishes a strict new legal and technical baseline for how biometric data must be handled in retail environments.
For security leaders and compliance officers, the message is clear: You can use the technology, but the "how" matters more than ever.
The Justification: Safety Over Privacy?
The Tribunal accepted that the intrusion into customer privacy was "necessary" and "proportionate" given the specific threats Bunnings faced. Evidence presented to the Tribunal highlighted that 66% of theft loss was attributable to just 10% of offenders, and staff were subjected to threatening behavior every two to three days on average.
The Justification: Safety Over Privacy?
The Tribunal accepted that the intrusion into customer privacy was "necessary" and "proportionate" given the specific threats Bunnings faced. Evidence presented to the Tribunal highlighted that 66% of theft loss was attributable to just 10% of offenders, and staff were subjected to threatening behavior every two to three days on average.
The ruling confirmed that protecting staff and customers from "violence, abuse and intimidation" is a legitimate basis for deploying FRT, provided the response is not disproportionate.
The Technical Benchmark: 4.17 Milliseconds
Perhaps the most critical takeaway for IT and security architects is the specific technical standard validated by the Tribunal. The ruling hinged heavily on the system's ability to minimise privacy intrusion through "momentary collection".
The Tribunal noted that while scanning a face constitutes "collection" under the Privacy Act, the Bunnings system was acceptable because non-offender data was:
Held Momentarily
Data for customers not on the "banned list" was processed and deleted within an average of 4.17 milliseconds.
Permanently Deleted
The system ensured that this data was irretrievable and never written to long-term storage.
Secure
The architecture limited susceptibility to cyber-attacks.
This sets a de facto industry standard: To be compliant, systems must likely demonstrate immediate, automated deletion of non-matched biometric data.
Where Governance Failed: The Transparency Gap
Despite winning the right to use the technology, Bunnings was found to have breached privacy laws regarding transparency. The Tribunal ruled that the retailer's posters and entry notices were insufficient to notify visitors that their sensitive information was being collected.
The ruling emphasises that retailers cannot rely on small print. Effective immediately, compliance requires:
Prominent Notification
Clear, undeniable signage explicitly stating the use of FRT.
Formal Risk Assessments
The OAIC noted that retailers should complete a "formal, structured and documented" Privacy Impact Assessment (PIA) before rolling out such technology.
Human Oversight
The Tribunal validated the system in part because false positives were "manually reviewed by staff members" rather than acted upon by automation alone.
The Regulatory Outlook
The Office of the Australian Information Commissioner (OAIC) has responded by reiterating that exemptions to the Privacy Act are assessed on a "case-by-case basis". They emphasised that "good privacy governance" is non-negotiable and that even momentary collection requires strict adherence to privacy principles.
While this decision opens the door for other major retailers to adopt FRT, it slams it shut on reckless implementation. The "Green Light" is conditional on speed, security, and absolute transparency.
Don't leave your security to chance.
Ensure your system is rigorous, integrated, and fully commissioned.
Our goal is to look beyond the hardware and collaborate to make the world a safer place together.
Please Note: The information provided in these articles is general in nature and intended for educational purposes. Every operational environment has unique vulnerabilities; therefore, it is recommended to seek site-specific expert advice for your specific needs.
Page updated
Report abuse