In a landmark decision that could permanently change how Australian retailers protect their staff, customers and stores, the Administrative Review Tribunal has delivered a decisive defeat to the Office of the Australian Information Commissioner (OAIC), clearing the way for the lawful use of facial recognition technology (FRT) to combat escalating retail crime.

The ruling, in favour of Bunnings, overturns a key finding by the Privacy Commissioner and confirms that large retailers are entitled to deploy facial recognition systems where there is a reasonable suspicion of unlawful activity — provided customers are informed that the technology is in use.

For an industry grappling with unprecedented levels of theft, abuse and violence, the decision is being widely viewed as a turning point and a long-overdue recognition of the realities facing frontline retail workers.

Tribunal Rejects Privacy Commissioner’s Position

The case arose after the OAIC, led by Privacy Commissioner Carly Kind, objected to Bunnings’ use of facial recognition, arguing that the collection of biometric data breached the Privacy Act 1988 and was disproportionate to the threat posed.

Those objections followed complaints by consumer advocacy group CHOICE, which claimed retailers including Bunnings, The Good Guys and Kmart were collecting sensitive personal information without proper consent or transparency.

The tribunal rejected those arguments, finding that Bunnings was facing a “very real and serious problem” of violence and theft and was justified in taking action.

“Both before and during the relevant period, Bunnings faced a very real and serious problem of violence and theft in its stores,” the tribunal wrote.

“We find that Bunnings responded to the significant level of retail crime being perpetrated by repeat offenders by implementing the facial recognition system so as to identify repeat offenders known to Bunnings and prevent them from engaging in further theft or violence.”

Facial Recognition Deemed Lawful and Proportionate

The tribunal found that Bunnings met the necessary threshold to reasonably suspect unlawful activity and that its use of facial recognition technology was proportionate to the risks being addressed.

It noted that the system was designed to minimise privacy impacts. Facial images of customers who did not match known offenders were converted into digital vectors and discarded almost immediately — within milliseconds — while alerts were only generated when a match occurred.

“Unmatched facial images and vector sets were immediately discarded,” the decision stated. “If the FRT system produced a match, an alert was generated.”

The tribunal concluded that the technology’s safeguards meant the privacy impact was not disproportionate when weighed against the benefits of protecting staff and customers.

“The advanced technology in the FRT system limited the impact on privacy when considered against the benefits of providing a safer environment,” it ruled.

Clear Green Light for Major Retailers

The decision is expected to have immediate and far-reaching implications across the retail sector.

Bunnings used facial recognition technology in up to 62 stores between November 2018 and November 2021, while Westfield-owned centres deployed similar systems across dozens of locations during the same period.

Kmart used facial recognition in 28 stores between June 2020 and July 2022, primarily to identify suspected refund fraud, while retailers such as The Good Guys were also using similar technology at the time.

With the tribunal now setting a clear legal framework, major chains including JB Hi-Fi, Woolworths, Coles and Harvey Norman are expected to move toward deploying a new generation of facial recognition systems as part of their security operations.

Tribunal Acknowledges Impact on Workers and Customers

Critically, the ruling validates retailers’ claims about the human cost of retail crime.

The tribunal found Bunnings’ assessment of the harm caused by repeat offenders — including abuse, intimidation and violence — was reasonable and supported by evidence.

“We consider that it was reasonable for Bunnings to take action in response to violence and abuse because of the significant impact it had on staff and customers,” the tribunal said.

“Leaving aside the technicalities, the FRT system allowed Bunnings to vet the vast majority of store customers against their record of ‘problem’ customers.”

Notification, Not Prohibition

While the tribunal found that Bunnings did not sufficiently notify customers during the period in question, it made clear this was a compliance issue — not a rejection of facial recognition itself.

“We have found that during the relevant period, Bunnings was entitled to use FRT for the limited purpose of combating very significant retail crime and protecting their staff and customers,” the tribunal stated.

The ruling provides clear guidance for future use: facial recognition is lawful when targeted, proportionate and transparent.

Public Support Stronger Than Critics Claim

The decision also undermines claims that consumers broadly oppose facial recognition in retail environments.

Research conducted by ChannelNews at the time found that 90 per cent of consumers had no issue with the use of facial recognition technology in stores, particularly when it was used to prevent crime and improve safety.

A Turning Point for Retail Security

The ruling represents a major shift in the balance between privacy regulation and real-world security, giving retailers the legal certainty they have long sought.

For Australian retailers under siege from organised theft and rising violence, the message from the tribunal is clear: they are entitled to use modern technology to protect their people, their customers and their businesses — as long as they do so transparently and responsibly.