An appeals body has ruled hardware giant Bunnings had the right to use facial recognition technology to combat soaring retail crime.
However, the Administrative Review Tribunal also took the Wesfarmers-owned chain to task for not telling customers that it was gathering their images.
In late-2024, Australia’s Privacy Commissioner found Bunnings breached privacy laws between 2018 and 2021 by trialling the use of facial recognition in stores across Victoria and NSW to try and stem abusive and violent behaviour against staff.
Sign up to The Nightly’s newsletters.
Get the first look at the digital newspaper, curated daily stories and breaking headlines delivered to your inbox.
By continuing you agree to our Terms and Privacy Policy.
Its system captured customers’ faces, comparing them against a database of people who were banned — or involved in previous abuse — and if there was a match, an alert was sent to “prevention team members”.
If there was no match, the data was processed and almost immediately deleted.
A furious Bunnings appealed the Privacy Commissioner’s ruling, arguing that facial recognition technology had been proven to reduce retail crime.
In its decision on Wednesday, the review tribunal said Bunnings “was entitled to use FRT for the limited purpose of combating very significant retail crime and protecting their staff and customers from violence, abuse and intimidation within its stores”.
The tribunal said its decision was influenced by “the extent of retail crime being faced by Bunnings staff and customers and … the technological features of the FRT system which minimised the intrusion on privacy by permanently deleting collected sensitive information and by limiting its susceptibility to cyber-attack”.
“The advanced technology in the FRT system limited the impact on privacy so as not to be disproportionate when considered against the benefits of providing a safer environment for staff and customers in Bunnings stores,” it said.
However, the ART also found that Bunnings failed its obligations to inform customers of what it was doing.
“If personal information is to be collected by FRT, Bunnings and other (companies) must take reasonable steps to provide notification that personal information is being collected and to implement appropriate practices, procedures and systems,” the tribunal said.
Bunnings boss Mike Schneider welcomed the decision as recognising “the need for practical, common-sense steps to keep people safe”.
“It also identified areas where we didn’t get everything right, including around signage, customer information, processes and our privacy policy, and we accept that feedback,” he said.
Penalties for violent retail crime haven been toughened up around Australia to meet the growing incidences of abuse and assault against store staff, particularly since COVID-19.
Wesfarmers told its annual meeting in October that it had recorded 13,500 customer threatening incidents in its retail stores — including more than 1000 instances of physical assault and several hundred threats of serious harm, often with a weapon, over the preceding 12 months.
Threatening incidents at its Kmart and Target stores had risen 29 per cent, while incidents involving threats of serious harm in Bunnings stores had soared 66 per cent.
