Facial Recognition Tech Lands Bunnings in Breach of Australian Privacy Laws

Bunnings, one of Australia’s most prominent retail chains, has been found in violation of the country’s privacy laws due to its use of facial recognition technology. This decision follows a two-year investigation by the Office of the Australian Information Commissioner (OAIC), which concluded that Bunnings unlawfully collected and processed sensitive biometric information from customers without their consent. The retailer had used facial recognition as part of its efforts to prevent crime and violent behavior in its stores.

Between November 2018 and November 2021, Bunnings deployed facial recognition technology across 62 of its stores in New South Wales and Victoria. The technology was used to analyze the faces of hundreds of thousands of customers, comparing their facial images against a database containing profiles of individuals deemed to pose a potential risk due to previous criminal or violent conduct. Under Australia’s Privacy Act, facial recognition data, along with other biometric information, is classified as sensitive and requires a high level of protection. This includes obtaining explicit consent for its collection and use, a standard that the OAIC determined Bunnings failed to meet.

The OAIC identified several areas of non-compliance by the retailer. Bunnings did not adequately inform customers about the collection and use of their personal information, nor did it implement appropriate systems and practices to ensure compliance with Australian privacy laws. Additionally, the company failed to include details of its collection, storage, and usage of facial recognition data in its privacy policies. These oversights, coupled with the lack of consent from individuals, were deemed significant breaches of privacy regulations.

As part of the ruling, Bunnings has been ordered to destroy all facial recognition data it still possesses within a year. The company must also make a public statement about the breach within the next 30 days and is prohibited from using facial recognition technology again in the future. Despite the decision, Bunnings has announced its intention to challenge the OAIC’s determination. The retailer argued that its use of the technology was a necessary measure to address the growing prevalence of organized crime and violent incidents in its stores.

In a statement, Bunnings emphasized that the facial recognition system was deployed only in a limited number of locations and was subject to strict controls. The company expressed disappointment with the OAIC’s ruling, stating that it had hoped the commissioner would acknowledge that the measures appropriately balanced privacy obligations with the need to protect employees, customers, and suppliers from repeated acts of aggression and criminal behavior.

The investigation into Bunnings’ practices was initiated in 2022 following a broader inquiry by CHOICE, a consumer advocacy group, into the use of facial recognition technology by Australia’s largest retailers. This inquiry included major chains such as Kmart and The Good Guys. While the investigation into The Good Guys was later discontinued, Kmart remains under scrutiny.

OAIC Commissioner Carly Kind addressed the broader implications of the case, stressing the sensitivity of biometric information and its classification under privacy laws. Kind highlighted that facial images and other biometric data are unique and immutable, underscoring why such information is subject to heightened protections under the Privacy Act. She acknowledged that facial recognition technology may have seemed like a practical and cost-effective tool for Bunnings to combat unlawful activity, including incidents of violence. However, she cautioned that the convenience or utility of a technology does not necessarily justify its deployment, especially when it infringes upon individuals’ privacy rights.

This case represents a significant moment in the ongoing debate around the use of facial recognition technology and its implications for privacy. It also serves as a reminder to businesses of the importance of adhering to legal standards when deploying systems that process sensitive personal information. The outcome of Bunnings’ appeal, along with the findings from the ongoing investigation into Kmart, is expected to set critical precedents for how biometric technologies are used in Australia’s retail sector moving forward.