Tribunal overturns privacy ruling over customer data collection
Bunnings has successfully overturned a decision by the privacy commissioner that found the hardware retailer breached the privacy of thousands of customers by trialling facial recognition technology to clamp down on shoplifters.
During 2018 and 2021, Bunnings trialled technology in 62 stores that captured customer facial data and compared it against a database of repeat offenders with a history of previous criminal or violent behaviour. In late November 2024, the Office of the Australian Information Commissioner (OAIC) determined this trial breached customer privacy.
On Wednesday, the Administrative Review Tribunal found that Bunnings had the right to bypass asking customers for consent to be filmed for the specific purpose of combatting retail crime and protecting staff and customers from violence and intimidation.
“A permitted general situation existed in relation to the collection of information by Bunnings,” the tribunal’s guidance and appeals panel found.
Bunnings managing director Mike Schneider, who has been vocal about fighting the OAIC’s original determination, said people’s safety had always been the retailer’s highest priority.
“Our intent in trialling this technology was to help protect people from violence, abuse, serious criminal conduct and organised retail crime,” Schneider said.
While the tribunal found Bunnings was allowed to use the technology to combat retail crime, it upheld the OAIC’s original ruling that Bunnings did not properly communicate with customers about its use and that the general notification on the entry about video surveillance was insufficient.
“We find that Bunnings fell short of implementation of practices, procedures and systems relating to Bunnings’ functions or activities that would have ensured that they complied with the Australian Privacy Principles,” the tribunal panel decision stated.
Even though data was deleted within four milliseconds, the technology “nevertheless collected sensitive information for inclusion in a record”.
Schneider acknowledged the tribunal found areas where Bunnings didn’t get it right. “We accept that feedback,” he said.
“Keeping people safe in and around our stores is a responsibility we take very seriously, and we remain committed to engaging constructively on how safety and privacy are balanced in the future.”
The OAIC said the tribunal’s decision confirmed that the Privacy Act protected individual privacy in the wake of emerging technology. It is “carefully considering” the tribunal’s decision, which itself can be appealed.
“Limited exemptions are subject to robust criteria that must be assessed on a case-by-case basis,” an OAIC spokesperson said.
“The Australian community continues to care deeply about their privacy, and is increasingly worried about the challenges in protecting their personal information.”
More to come
The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.
Jessica Yun is a business reporter covering retail and food for The Sydney Morning Herald and The Age.Connect via X or email.From our partners
