Australian Information Commissioner overturned.
Photo: SKU

A precedent for widespread retail biometrics?

LANDMARK RULING

A landmark decision in Australia has paved the way for the widespread use of facial recognition technology in retail settings – a move that could see biometric face scans become routine for shoppers across the country.

The Administrative Review Tribunal (ART) has overturned a prior finding by the nation’s privacy watchdog, ruling that hardware giant Bunnings Group was reasonably entitled to employ AI-driven facial recognition systems in its stores to ‘curb crime’ and ‘protect staff’.

This development represents a significant shift in how Australian privacy law is interpreted, and has sparked sharp debate about the balance between public safety and individual rights.

ART disagreed with key aspects of the Office of the Australian Information Commissioner (OAIC)’s findings handed down in 2024, where it was ruled Bunnings and others had breached privacy law by collecting this data without clear consent or adequate notification.

Bunnings breached laws with facial recognition technology, commissioner says
RELATED ARTICLE

It reviewed and concluded that Bunnings did reasonably believe the use of facial recognition technology was necessary to address escalating incidents of theft and abuse against staff and customers, and that the intrusion on privacy was ‘minimised by the system’s design’.

What an absolute farce.

The tribunal noted that biometric data was not retained beyond the immediate comparison process, and that the company’s intentions were focused on ‘safety and loss prevention’, rather than marketing or behavioural profiling.

Over several years, Bunnings conducted trials of facial recognition technology across dozens of stores in Victoria and New South Wales.

The system was linked to its CCTV network and scanned the faces of every person entering a store, comparing them to a database of known offenders or individuals previously involved in ‘antisocial behaviour’.

Critics argued that the company’s practices amounted to indiscriminate biometric surveillance, with customers unaware that their unique face data was being processed simply by entering a store.

Under Australia’s Privacy Act, sensitive information can only be collected with consent unless specific exceptions apply, and the OAIC found Bunnings had failed to meet these requirements. But now this has backflipped.

Proponents of the ART ruling argue the decision provides ‘clarity for businesses seeking to protect staff and assets in an era of rising retail crime’.

With this legal precedent, major retailers could now adopt similar systems, making face scans far more common in Australian shops.

Privacy advocates are deeply alarmed.

They warn that normalising facial recognition in commercial spaces like shops could blur the line between security and mass surveillance.

Biometrics, unlike passwords or loyalty cards, are permanent – you cannot change your face like you can change a PIN.

As such, any collection and processing of face data raise profound privacy and ethical questions about consent, data security, and long-term use.

The biometric surveillance state continues to grow at alarming speeds.

THE BIOMETRIC DOORWAY OPENS

Endowing CCTV systems with ‘smart’ capabilities – such as face, object and gait recognition – represent a quantum leap in surveillance power that needs to be handled carefully.

In recent years, there has been widespread and unannounced use of the technology in a range of venues, from hotels and clubs, to sports arenas and retailers.

Pubs and clubs argue more facial recognition will help ‘protect public’
RELATED ARTICLE

It is also in stadiums, with consumer group CHOICE found facial recognition technology was in use at the Sydney Cricket Ground (SCG), Qudos Bank Arena, Sydney’s Allianz Stadium, and the Melbourne Cricket Ground (MCG).

Report finds major stadiums in Australia are using facial recognition
RELATED ARTICLE

This decision gives these groups a green light to not only continue, but expand, their programs – all under the guise of ‘safety and security’.

Even if retailers initially use facial recognition solely for safety, it could be expanded, intentionally or inadvertently, into areas like customer analytics, behaviour tracking, or integration with law enforcement databases.

The fear is that an infrastructure built for one purpose could facilitate far broader surveillance over time – and we know that it will.

We already see this with government and police-run surveillance networks, such as Melbourne’s existing ‘smart city’ CCTV arsenal of 280 cameras.

Melbourne Council planning to upgrade CCTV surveillance network
RELATED ARTICLE

These systems are then abused and misused, like when Australian regulators found that a photo-scraper used by federal police was also harvesting sensitive data without consent.

Facial recognition app trialled by police broke privacy laws: AAT
RELATED ARTICLE

For everyday Australians, the implications of unchecked biometric surveillance are real.

Walking into a shop may soon involve being scanned and compared against a digital database – without explicit consent beyond signs at the entrance.

While some welcome stronger tools to deter crime, others see it as a step toward an omnipresent surveillance society. One straight out of a science fiction novel.

As technology evolves faster than regulation, it seems like it will only get worse from here – and with this precedent now set, biometrics will become more commonplace in the future.

What are your thoughts on this decision being overturned?

What will it mean for the future of Australian retail?

Be sure to leave your thoughts in the comment section below!