Key points

• The Australian Privacy Commissioner has determined that Bunnings Group Limited (Bunnings) interfered with the privacy of individuals through its use of a facial recognition system for security and loss prevention purposes across 62 stores in the period between January 2019 and November 2021.¹
• Bunnings must cease using the facial recognition system in breach of the Privacy Act and publish a statement on its website including details of how it used the system and what it did with the biometric information it collected. The Privacy Commissioner is not seeking to impose any civil penalty in this matter.
• The determination makes it clear for any organisation considering implementing facial recognition technology (FRT) for safety or loss prevention purposes that it must obtain each individual’s consent to the collection of their biometric information, be transparent about the collection of that information through appropriate notices, and implement appropriate organisational methods to ensure compliance with the Australian Privacy Principles (APPs). The determination is also important because it sheds light on the scope of certain exceptions (or ‘permitted general situations’) contained in the Privacy Act which permit the collection of sensitive information without consent.
• Bunnings has stated that it intends to appeal the determination in the Administrative Appeals Tribunal.

Overview

In her long-awaited determination dated 29 October 2024, Australian Privacy Commissioner Carly Kind has found that Bunnings breached a number of APPs through its use of an FRT system across 62 stores in NSW and Victoria between January 2019 and November 2018.

Bunnings did this by:

• collecting sensitive biometric information and criminal history information about individuals without their consent, in breach of APP 3.3; and
• failing to provide adequate notification about the collection of that information, in breach of APP 5.1.

Bunnings was not able to rely on certain permitted general situations in the Privacy Act which permit the collection of biometric information without consent.

The Privacy Commissioner also found that Bunnings:

• failed to implement practices, procedures and systems to ensure that it complied with the APPs, in breach of APP 1.2(a); and
• failed to include required information in its privacy policy, in breach of APP 1.3.

Whilst the FRT system has not been in use since November 2021, Bunnings has been ordered by the Privacy Commissioner to not use the system in breach of APPs and publish a notice on its website setting out:

• how the FRT system operated including how it collected facial images, what Bunnings did with the facial images, the fact that matches and alerts were generated, and how Bunnings acted on those alerts;
• the fact that Bunnings did not seek consent to the collection of individuals’ sensitive information for the purposes of operating the FRT system; and
• a detailed description of the relevant matters that Bunnings omitted from its privacy notices and policies during the relevant period.

Background

Between January 2019 and November 2021, Bunnings operated FRT in 62 stores across Victoria and New South Wales. Bunnings did so in order to identify persons of interest (POI), being individuals who had:

• engaged in, or were reasonably suspected of engaging in, ‘actual or threatened violence’ to the respondent’s staff or other members of the public;
• committed, or were reasonably suspected of committing, ‘Organised Retail Crime’, being theft or fraudulent activity that had occurred multiple times, in multiple stores, and by two or more individuals, with the intent of converting proceeds to financial gain;
• demonstrated ‘violent, threatening or other inappropriate behaviour’, resulting in the respondent’s staff issuing them with a prohibition notice that ‘formally notified [them] that they were prohibited from entering a Bunnings store’;
• engaged in ‘serious cases of theft’; or
• committed criminal conduct.

If a POI was detected in a store then the relevant team members would decide what action to take, for example, calling the police or asking the POI to leave the store. Bunnings states on its website that it ‘trialled the use of facial recognition technology (FRT)…with the sole and clear intent of keeping [its] team and customers safe and preventing unlawful activity by repeat offenders.’²

At a high level, the FRT system worked by enrolling an image of each POI into an enrolment database and converting that image into a biometric ‘vector set’. Then, for each person entering an FRT-equipped store, the FRT system would extract a facial image from the CCTV feed and convert that image into a biometric vector set. That vector set was then compared against the vector sets in the enrolment database to find a match. If no match was found, the facial image and vector set created in-store was deleted from the FRT system in 4.17 milliseconds. If a match was generated, an alert was sent to the security team who then conducted a manual check of the facial image generated in store against the facial image in the enrolment database. If a POI was positively identified, then the relevant team members would determine the appropriate action to take.

In June 2022, consumer advocacy group CHOICE published the results of its investigation into retailers’ use of FRT,³ highlighting that:

• ‘Kmart, Bunnings and The Good Guys are using facial recognition technology in retail stores’;
• ‘Despite some limited signage in some stores, customers remain largely unaware of the practice’; and
• ‘Privacy experts are raising the alarm and CHOICE says they may be in breach of the Privacy Act’.

Following the CHOICE report, on 11 July 2022 the former Privacy Commissioner opened an investigation under s 40(2) of the Privacy Act into Bunnings’ acts and practices associated with its use of FRT during the relevant period, particularly whether Bunnings breached APP 3.3 (by collecting sensitive information without consent), APP 3.5 (by collecting personal information by other than lawful and fair means) and APP 5.1 (by failing to take reasonable steps to notify individuals of matters).

Determination

Bunnings’ key arguments were that:

• it did not ‘collect’ biometric information of individuals entering the store in cases where there was no match, because that information was deleted within 4.17 milliseconds. On that basis the activity lacked the necessary purposive character of ‘collection’ under the Privacy Act;
• alternatively, if it was found to have collected that information, the circumstances were within the scope of the permitted general situations outlined at items 1 and 2 of section 16A of the Privacy Act which permit the collection of sensitive information without consent; and
• it took such steps as were reasonable in the circumstances to notify those individuals of the collection as required by APP 5.1, by way of ‘layering’ information through entry notices displayed at entry points to stores, its in-store privacy posters and its generally available privacy policy.

Collection

The Privacy Commissioner determined that Bunnings did in fact collect the biometric information of non-matched individuals. This is because even though the data was held for a short time, it was stored on a hard disk in an electronic device. The Privacy Commissioner stated ‘…it does not matter for the purposes of establishing ‘collection’ that the information of non-matched individuals was held momentarily before being deleted, or that the matching process was conducted automatically and without human intervention.’

Permitted General Situations

Bunnings relied on two permitted general situations (PGS) set out in s 16A of the Privacy Act.

In relation to identifying violent POIs, Bunnings relied on PGS 1 which provides an exception where:

• it is unreasonable or impracticable to obtain the individual's consent to the collection, use or disclosure; and
• the entity reasonably believes that the collection, use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.

For the same POIs, and also in relation to POIs who engaged in significant theft (so-called organised retail crime (ORC)), Bunnings relied on PGS 2, which provides an exception where:

• the entity has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the entity's functions or activities has been, is being or may be engaged in; and
• the entity reasonably believes that the collection, use or disclosure is necessary in order for the entity to take appropriate action in relation to the matter.

In both cases, the Privacy Commissioner highlighted the word ‘necessary’ in construing a narrow and limited application of these PGSs.

In summary, the Privacy Commissioner found that Bunnings could not have held a reasonable belief that the collection of sensitive information through use of FRT was necessary under either PGSs, given that other (albeit more costly or less efficient) methods for detecting POIs were available and that the largescale collection of sensitive information was not a reasonably proportionate measure to detect a relatively small number of POIs.

Notification

APP 5.1 requires entities to ‘take such steps (if any) as are reasonable in the circumstances to: (a) notify the individual of such matters referred to in APP 5.2 as are reasonable in the circumstances; or (b) otherwise ensure that the individual is aware of any such matters’. Such notification must be made either at or before the time or, if that is not practicable, as soon as practicable after, an APP entity collects personal information about an individual. APP 5.2 lists a number of matters including that if the individual may not be aware that the entity has collected the personal information, the fact that the entity collects the information, the purposes for which the entity collects the information and the main consequences (if any) for the individual if all or some of the personal information is not collected by the entity.

In this case, Bunnings relied on its entry signage, in store privacy posters and its privacy policy, as a way of ‘layering’ the notice given to customers about its use of FRT. However, neither of these expressly referred to the collection of sensitive information via the use of FRT and therefore neither of them addressed the other relevant APP 5.2 matters. This also led to a finding that Bunnings breached APP 1.3 in relation to the requirements for privacy policies.

In finding that Bunnings breached APP 5.1, the Privacy Commissioner stated that Bunnings should have clearly communicated via a prominent physical notice or otherwise, that it was collecting individuals’ sensitive information through a FRT system and other relevant matters, in a manner that ordinary persons would have been likely to understand.

Practices and Procedures

APP 1.2 requires an APP entity to take such steps as are reasonable in the circumstances to implement practices, procedures and systems relating to the entity’s functions or activities that will ensure that the entity complies with the APPs and will enable the entity to deal with inquiries or complaints from individuals about the entity’s compliance with the APPs.

Whilst Bunnings did take certain steps to ensure its compliance with the APPs, Bunnings was found not to have complied with APP 1.2 due to it not having conducted a thorough privacy impact assessment (PIA), or developing written policies and procedures governing the use of the FRT system which should have included:

• how the FRT system collects, uses, holds and discloses personal information;
• the circumstances in which the FRT system can be used;
• controls on staff access to the FRT system and the Database;
• processes for enrolling and reviewing images in the Database;
• processes for assessing positive matches, including false positives;
• training requirements for relevant staff involved in the use of FRT; and
• details of how and by whom the efficacy of the FRT system would be periodically reviewed.

Key takeaways

Before implementing any FRT system, we recommend organisations should:

• undertake a thorough PIA;
• develop written policies and procedures governing the use of the FRT system, and put steps in place to ensure that those policies and procedures are operationalised and adhered to;
• implement appropriate staff training on the use of the FRT;
• develop and implement appropriate in-store notifications setting out as much detail as possible about the collection of sensitive information via FRT, the purposes of the collection and the consequences of non-collection; and
• update their privacy policy to include all required information in relation to the collection and handling of sensitive information via FRT.

Consent

In addition to the above, one of the key requirements for using FRT is that an entity must obtain consent to the collection of sensitive information from each individual. Interestingly (but not surprisingly), the Privacy Commissioner did not provide any guidance in her determination as to how this could be practically achieved in the retail setting.

The APP Guidelines state that in order for consent to be valid, it must be informed, voluntary, current and specific, and given by individuals who have the requisite capacity. The Guidelines also state that an APP entity should generally seek express consent from an individual before handling the individual’s sensitive information, given the greater privacy impact this could have. On that basis, express consent to the collection of biometric information via FRT should be obtained, however it is difficult to envisage how such consent could be obtained in the retail setting, and we are certain that the industry would welcome further guidance from the OAIC on this point.

Next steps

Please contact Dentons’ privacy and cyber experts if your organisation is considering implementing FRT or to discuss any aspect of this determination.

1. Commissioner Initiated Investigation into Bunnings Group Ltd (Privacy) [2024] AICmr 230 (29 October 2024).
2. Facial Recognition Technology - Bunnings Australia.
3. https://www.choice.com.au/consumers-and-data/data-collection-and-use/how-your-data-is-used/articles/kmart-bunnings-and-the-good-guys-using-facial-recognition-technology-in-store.