Loading
Privacy breach found. Declarations that Bunnings must not repeat or continue the conduct, publish a statement, and destroy the personal and sensitive information collected through the system that it still held (after one year). A determination makes declarations, not fines; civil penalties need court proceedings (Privacy Act s 80U). ART affirmed the transparency breaches and set aside the consent breach finding.
Bunnings used facial recognition technology across 63 NSW and Victoria stores between November 2018 and November 2021, capturing biometric data from likely hundreds of thousands of shoppers without consent or adequate notification. Commissioner Kind found breaches of APP 1 (governance), APP 3 (sensitive information collection without consent) and APP 5 (notification). On 4 February 2026, the Administrative Review Tribunal affirmed the APP 1 and APP 5 findings but set aside the APP 3 breach, accepting Bunnings could rely on a permitted general situation exemption for the purpose of preventing retail crime and protecting staff. The determination made declarations rather than a penalty: under the Privacy Act, civil penalties require proceedings in the Federal Court or the Federal Circuit and Family Court (s 80U). The case is a landmark precedent for biometric AI governance in Australian retail.
Bunnings used facial recognition technology across 63 NSW and Victoria stores between November 2018 and November 2021, capturing biometric data from likely hundreds of thousands of shoppers without consent or adequate notification. Commissioner Kind found breaches of APP 1 (governance), APP 3 (sensitive information collection without consent) and APP 5 (notification). On 4 February 2026, the Administrative Review Tribunal affirmed the APP 1 and APP 5 findings but set aside the APP 3 breach, accepting Bunnings could rely on a permitted general situation exemption for the purpose of preventing retail crime and protecting staff. The determination made declarations rather than a penalty: under the Privacy Act, civil penalties require proceedings in the Federal Court or the Federal Circuit and Family Court (s 80U). The case is a landmark precedent for biometric AI governance in Australian retail.
Privacy breach found. Declarations that Bunnings must not repeat or continue the conduct, publish a statement, and destroy the personal and sensitive information collected through the system that it still held (after one year). A determination makes declarations, not fines; civil penalties need court proceedings (Privacy Act s 80U). ART affirmed the transparency breaches and set aside the consent breach finding.
This summary is provided for general information and is not legal advice. Enforcement outcomes can be appealed or revised; verify the current position against the primary sources above.