Bunnings acknowledged that when it started using FRT it did not inform customers on its conditions of entry poster, but said that during the trial it started referring to its use of FRT on both its entry sign and in its privacy policy.

Privacy commissioner Carly Kind said Bunnings had failed to comply with the Privacy Act, and ordered the company to not repeat or continue the practices, and destroy all the information collected via the facial recognition system. The company was not fined.

Kind said Bunnings had been co-operative throughout the investigation and paused its use of facial recognition technology pending the outcome.

“Individuals who entered the relevant Bunnings stores at the time would not have been aware that facial recognition technology was in use and especially that their sensitive information was being collected, even if briefly,” she said.

Loading

The Privacy Act classes facial images and other biometric information as sensitive information, Kind says, giving it a high level of privacy protection, including that consent is generally required for it to be collected.

“We acknowledge the potential for facial recognition technology to help protect against serious issues, such as crime and violent behaviour. However, any possible benefits need to be weighed against the impact on privacy rights, as well as our collective values as a society.

“In this instance, deploying facial recognition technology was the most intrusive option, disproportionately interfering with the privacy of everyone who entered its stores, not just high-risk individuals.”

The Office of the Australian Information Commissioner (OAIC) opened an investigation into Kmart for its use of FRT at the same time as the Bunnings investigation. The Kmart investigation is ongoing. Wesfarmers, which operates Kmart, Bunnings and Officeworks, confirmed Officeworks does not use the technology.

Australian Retailers Association chief industry affairs officer Fleur Brown said technology played an important role in security measures vital to the safety of customers and employees, who are facing higher rates of aggravated abuse and assault. She urged Kind to review her decision, saying FRT was already used in Australia and overseas in places such as airports and stadiums to identify repeat offenders and allow safety measures to be taken.

“We believe this decision from the privacy commissioner should be reconsidered with broader consultation from Australian retailers and authorities to ensure staff and customer safety is prioritised,” Brown said.

Lisa Asher, a retail expert from the University of Sydney Business School, has recently completed a large research report on Bunnings’ business practices and use of technology.

She said that facial recognition technology had been widely implemented in many large-format stores including supermarkets and Bunnings, which the retailers said was in response to high levels of theft and for staff safety.

“We are seeing technology outpace privacy laws, and we have an opportunity to re-examine the laws in the context of data privacy. A review of data privacy laws considering these technologies should take place to ensure that consumers are protected, and that data adheres to strict standards.”