"Facial recognition in Australian retail: where the Bunnings case leaves shoppers"
Facial recognition in Australian retail: where the Bunnings case leaves shoppers
If you assumed Australian privacy law had settled the question of face recognition in shops, February 2026 upended that assumption. The Administrative Review Tribunal overturned the heart of the Privacy Commissioner's 2024 determination against Bunnings — and the ground rules for retail biometrics are now genuinely unsettled. Here's what actually happened and what it means for you as a shopper.
The original determination
In November 2024 the Privacy Commissioner found Bunnings had breached the Privacy Act by trialling facial recognition technology in 62 stores between 2018 and 2021. The system captured customers' facial data and matched it against a database of repeat offenders with histories of criminal or violent behaviour. The Commissioner's view: biometric collection of this kind is highly invasive, and Bunnings hadn't satisfied the necessity and proportionality tests in the Australian Privacy Principles. (OAIC media release, 19 November 2024)
The Tribunal's decision, February 2026
On 4 February 2026 the Tribunal's guidance and appeals panel handed down its review. The outcome was a split, not a clean win for either side:
- Bunnings won on the core collection question. The panel found a "permitted general situation" existed: Bunnings was entitled to use FRT for the limited purpose of combatting very significant retail crime and protecting staff and customers from violence, abuse and intimidation — without asking each customer for consent. The panel pointed to the scale of violence and theft Bunnings faces, the weapons sold in its stores, and the data-minimisation protections Bunnings had in place (data deleted within milliseconds unless matched). (SMH, 5 February 2026)
- The OAIC's findings on notice and governance survived. The Tribunal did not disturb the findings that Bunnings failed to properly notify customers — a general video-surveillance sign at the door was not enough — and that it lacked the policies and procedures the Privacy Act requires. It also reaffirmed that even momentary collection of biometric data by advanced tools "constitutes a collection" under the Act. (OAIC statement, 4 February 2026)
The Privacy Commissioner confirmed in March 2026 that she had not filed an appeal, while maintaining that facial recognition "must meet a high bar to be considered lawful under the Privacy Act." (OAIC statement, 5 March 2026)
The supermarkets move in
Within months, the two biggest Australian grocery chains confirmed they are testing the same technology. In August 2026 Coles and Woolworths confirmed trials of facial recognition technology they are considering installing in stores; neither has decided to deploy it. The Privacy Commissioner responded with a pointed public caution that retailers do not have "an open invitation" to use FRT. (ABC News, 17 August 2026, The Guardian, 18 August 2026)
The practical reading: the Tribunal's decision gives retailers a narrow, purpose-limited pathway for crime and safety use, but every deployment still has to clear the notice, transparency and governance hurdles Bunnings failed.
What shoppers can do
- Read the signage. If a store runs FRT lawfully, it must notify you properly — a bare CCTV notice doesn't cover biometric collection. If you can't find a clear biometric notice, that store is telling you something.
- Complain if notice is missing. The Tribunal's findings mean notice and governance are non-negotiable even where the technology is permitted. A store collecting biometric data without a clear, specific notice is a live Privacy Act complaint — to the business first, then to the OAIC if unresolved.
- Reduce your exposure at the device level. Store cameras capture the face you walk in with; they don't see the hardened phone in your pocket. A de-googled phone (see our GrapheneOS line-up) doesn't stop a camera, but it stops the same identity being stitched across every other system you touch — which is where retail biometrics gets dangerous. For the legal frame on testing your own networks and devices, see our WiFi testing law explainer.
The open question
Whether a supermarket's theft problem clears the same "very significant retail crime" bar a hardware warehouse's violence problem did is exactly what the next determination will decide. Until Parliament clarifies the Privacy Act — the second tranche of privacy reforms is still in exposure-draft stage as of August 2026 — shoppers are the ones carrying the uncertainty.
This post is general information, not legal advice.