AustraliaRetail and e-commerce2018–2021Bunnings
In-store facial recognition against repeat offenders
Bunnings scanned shoppers' faces in 63 stores; the privacy regulator ruled against it and a tribunal later overturned that finding
Problem
The Australian hardware chain said a small group of repeat offenders caused most violent and organised crime incidents in its stores; its managing director put the share at 70%. It wanted to identify known offenders as they entered.
Approach
From November 2018 to November 2021 Bunnings ran a facial recognition system designed by Hitachi and supplied through a third party, first in one store and then in 62 more in New South Wales and Victoria. Cameras compared every visitor's face with a list of "enrolled individuals"; Bunnings said non-matching faces were deleted in an average of 4.17 milliseconds. The Privacy Commissioner opened an investigation in 2022 and in November 2024 found the scanning breached the Privacy Act because customers had not consented.
Results
Takeaway
The regulator counted even millisecond-long storage as data collection; in February 2026 the Administrative Review Tribunal accepted the crime-prevention purpose and found no breach in scanning itself, but faulted Bunnings' customer notices. Notice and the scale of the crime problem weighed heavily in the two rulings.
Categories
- Size
- Large enterprise
- Industry
- Retail and e-commerce
- Business function
- Finance, risk and legalProduction and quality
- Innovation type
- Process innovation
- AI technology
- Computer vision
- Adoption
- Vendor solution
- Goal
- Quality and risk
- Evidence
- Regulator, audit or court
Sources
Source summaries
Privacy Commissioner Carly Kind determined that Bunnings interfered with the privacy of hundreds of thousands of customers in 63 stores between November 2018 and November 2021. The commissioner judged facial recognition the most intrusive option and ordered Bunnings to stop, destroy the data and publish a statement, without a financial penalty. Bunnings said it was disappointed and would seek a review.
The Administrative Review Tribunal decided (2026 ARTA 130) that Bunnings was entitled to use facial recognition for the limited purpose of fighting serious retail crime and did not breach privacy law by scanning faces. The tribunal said Bunnings should have done more to notify customers and improve its signage and privacy policy. The privacy regulator said the decision confirmed that momentary collection still counts as collection.
Full details are in the original sources.
