Hardware giant Bunnings has been given the green light to use facial recognition technology on customers in order to prevent crime.
The administrative review tribunal this week reversed a 2024 ruling by the Australian privacy commissioner that had found Bunnings breached the privacy of store visitors by scanning and checking their faces.
However, the tribunal agreed that Bunnings had not properly notified customers that their faces were being scanned.
Bunnings deployed facial recognition in 62 stores in New South Wales and Victoria between January 2019 and November 2021, after a two-month trial in one store in 2018.
Hundreds of thousands of people who entered the stores in this time had their faces scanned and checked against facial images of hundreds of people who had been banned from Bunnings stores. If there was no match, the image was deleted.
Sign up: AU Breaking News email
Bunnings appealed the privacy commissioner’s decision to the administrative review tribunal.
In a ruling on Wednesday, the ART found Bunnings was entitled to use facial recognition “for the limited purpose of combatting very significant retail crime and protecting their staff and customers from violence, abuse and intimidation within its stores”.
“The [technology used by Bunnings] limited the impact on privacy so as not to be disproportionate when considered against the benefits of providing a safer environment for staff and customers in Bunnings stores,” the tribunal said in its decision.
The ART heard from two store managers from Box Hill and Broadmeadows about the extent of violence in their stores.
“This kind of threatening or abusive behaviour occurred every two to three days on average and caused team members to be visibly shaken and upset,” the ART said of Box Hill manager Shawn Adam’s evidence. “He was, on a daily basis, extremely concerned for his team members and customers.”
Bunnings’ national security manager, Alexander MacDonald, told the ART that in the hundreds of investigations he had undertaken into thefts and violent incidents in Bunnings stores “a high proportion of these investigations resulted in the identification of repeat offenders, organised retail criminals and persons who pose a serious risk to the safety of staff or customers”.
The hardware giant had calculated that, on average across each financial year, at least 66% of theft loss was attributable to the top 10% of offenders.
The ART found that the facial recognition technology had in some cases generated false positives but those were manually reviewed by staff members and discarded.
MacDonald told the tribunal he was aware of studies that had demonstrated a risk of false positives in facial recognition being skewed towards non-white and non-male subjects. However, he said the system used by Bunnings had not shown any racial bias.
The tribunal found that posters and entry notices put up by Bunnings had not met its obligations to notify visitors about the collection of personal information.
Bunnings’ managing director, Mike Schneider, welcomed the ruling.
“The safety of our team, customers and suppliers has always been our highest priority,” he said. “Our intent in trialling this technology was to help protect people from violence, abuse, serious criminal conduct and organised retail crime.”
He said Bunnings accepted the feedback from the tribunal around signage and informing customers.
A spokesperson for the office of the Australian information commissioner said the decision confirmed the Privacy Act has strong protections for individual privacy and that limited exemptions must be assessed on a case-by-case basis.
The OAIC had not ruled out appealing the decision, stating it was considering the implications.
