Australia's Administrative Review Tribunal has reversed an earlier finding by the Privacy Commissioner and ruled that Bunnings did not unlawfully use artificial intelligence facial recognition to identify customers, while also urging the retailer to strengthen its privacy practices and notify patrons about the technology's presence. (Sources: [2],[1])

The tribunal's judgment came after a multi‑year dispute following a 2024 determination by the Privacy Commissioner, Carly Kind, which had concluded that Bunnings had collected biometric information without proper consent. According to reporting, the initial investigation prompted calls for the deletion of sensitive data and heightened scrutiny from regulators and consumer groups. (Sources: [3],[4])

Details disclosed in the review show the system was trialled from November 2018 and, by late 2021, had been operating across more than 60 stores in New South Wales and Victoria. The facial‑matching software, developed by Hitachi and deployed via a third party, compared live CCTV images against an "enrolment" list of individuals allegedly involved in theft, refund fraud or abusive conduct. The database at times contained hundreds of names, and images were stored on both a central server and local store memory. (Sources: [1],[3])

The tribunal accepted that the technical configuration included safeguards intended to limit privacy intrusion, such as rapid deletion of non‑matches and architectural measures to reduce susceptibility to cyber‑attack, and it weighed those features against Bunnings' stated aim of addressing serious retail crime and protecting staff and customers. Nonetheless the panel emphasised that Bunnings fell short on signage, customer notification and some internal processes. (Sources: [1],[4])

Bunnings' leadership welcomed the ruling while acknowledging the tribunal's criticisms. In a statement, managing director Mike Schneider framed the pilot as an effort to shield employees and shoppers from violence and organised offending, and said the company accepted the need to improve how it communicates and documents the use of such systems. The company previously told investigators that images not matched to an enrolled individual were deleted within milliseconds. (Sources: [1],[7])

Regulators and advocacy groups responded with caution. The Office of the Australian Information Commissioner said the decision reaffirmed privacy protections under the Privacy Act and underlined that even fleeting automated collection of personal information constitutes collection under the law; the OAIC also stressed that Bunnings should have better managed and notified individuals about the handling of data not belonging to enrolled persons. Consumer group CHOICE had earlier welcomed the Privacy Commissioner's finding and warned businesses to reconsider deploying facial recognition without clear consent. (Sources: [4],[6],[3])

Legal and industry observers note broader implications. Analysis by law firms highlighted how the earlier determination flagged the importance of consent, transparent notification and adherence to Australian Privacy Principles; commentators say the tribunal ruling may nevertheless provide a framework for other retailers considering comparable AI tools, provided they adopt stronger privacy protections and clear customer communications. (Sources: [5],[2])

Retail experts argue the decision could accelerate adoption of computer vision and AI for loss prevention and staff safety, while also encouraging debate about limits and oversight. Gary Mortimer, a professor of retail and consumer behaviour, told media that technology can reduce risks to staff and deter repeat offending but that clearer signage and transparent policies are essential to maintain public trust as such systems become more widespread. (Sources: [1],[2])

Source Reference Map

Inspired by headline at: [1]

Sources by paragraph:

Source: Noah Wire Services