A new ruling has found Bunnings took customers’ private biometric information without consent, failed to take steps to notify them, and left holes in their privacy policy.