Data Card
Australian regulator updates retail facial recognition guidance after Bunnings ruling
The Office of the Australian Information Commissioner revised its guidance for commercial facial recognition to reflect the Administrative Review Tribunal decision in the Bunnings case.
2026-07-29CC-BY-4.0oaicretail-biometricsprivacy-regulationaustralia
About
Key Facts
- Businesses must give explicit notification before collecting facial data under the Privacy Act.
- The guidance requires a privacy impact assessment before deployment.
- Only narrow statutory exceptions apply for retail crime prevention and staff protection.
Card Text
Retail loss prevention has been the main commercial testing ground for facial recognition outside security and border settings, and it is where consent questions are sharpest. Tying guidance to a tribunal decision converts regulatory preference into an enforcement benchmark.