At a glance
- Company
- BunningsHardware and home improvement retailer
- Size
- Enterprise (1,000+ employees) Bunnings says its network includes 285 large warehouse stores and 68 smaller stores in Australia and New Zealand.
- Industry
- E-commerce and retail
- Where and when
- Australia. November 2018 – November 2021; regulator’s decision 2024, tribunal’s decision February 2026.
- Who produced the figures
- Official recordThe figures and findings come from the Office of the Australian Information Commissioner (OAIC): its announcement and fact sheet on the 2024 decision, and its two statements on the tribunal’s 2026 decision, which quote the tribunal. The OAIC gave 63 stores in 2024 and 62 in later statements. The case counts as went wrong because the tribunal upheld the findings that Bunnings did not tell shoppers and had no proper privacy procedures. Bunnings’ view comes from its own statement.
What happened
From November 2018 to November 2021 Bunnings ran a facial recognition system in 63 stores in Victoria and New South Wales. Its CCTV cameras captured the face of every person who came in. The regulator put that at “likely hundreds of thousands of individuals”. The system compared each face with a database of people Bunnings had flagged as a risk, for example for past crime or violent behaviour.
The regulator found that Bunnings did not take reasonable steps to tell shoppers. The Privacy Commissioner, Carly Kind, said people who entered those stores “would not have been aware” that facial recognition was in use. Bunnings paused the system while the regulator investigated.
What the regulator decided in 2024
The Commissioner found four breaches of Australia’s Privacy Act. The law treats a face as sensitive information, which normally needs the person’s consent.
- No consent. Bunnings collected sensitive information without consent, and the exceptions in the law did not apply.
- No notice. It did not take reasonable steps to tell people their information was being collected, or why.
- No procedures. It did not put in place the practices and systems needed to comply with the law.
- A privacy policy that left it out. Its privacy policies did not say what it collected through the system or how.
The Commissioner said the technology was “the most intrusive option”, because it affected everyone who entered, not just high-risk people. She also said: “just because a technology may be helpful or convenient, does not mean its use is justifiable.”
She ordered Bunnings not to repeat the conduct, to publish a statement about it, and to destroy, after one year, the information from the system that it still held.
What the tribunal decided in 2026
Bunnings asked the Administrative Review Tribunal to review the decision. The tribunal ruled on 4 February 2026.
Overturned: the consent finding. The tribunal held that Bunnings could rely on an exception to the need for consent. It pointed to repeat offenders, the size and layout of the stores, and products that “can be used as a weapon, such as an axe, a screwdriver or a drill”. It also noted the protections Bunnings had in place to keep and use as little data as possible. It said the use “involves a significant intrusion into the privacy of individuals”, but that Bunnings was entitled to it “for the limited purpose of combatting very significant retail crime” and protecting staff and customers.
Upheld: the notice and procedure findings. The tribunal agreed that Bunnings had not given shoppers proper notice. It said Bunnings should have completed a “formal, structured and documented” risk assessment that considered privacy.
Upheld: a scan that lasts milliseconds still counts. The tribunal agreed that capturing a face is a collection of personal information, even when the system keeps it only for a moment.
Upheld: how to judge the exception. The tribunal kept the Commissioner’s three tests: whether the technology works against the problem, whether a less intrusive option exists, and whether the intrusion is proportionate.
The Commissioner did not appeal. She said retailers “should view the decision as a useful case study, rather than a green light”.
What Bunnings said
Bunnings calls the system a “trial” meant to protect people from “violence, abuse, serious criminal conduct and organised retail crime”. It welcomed the tribunal’s decision. It said the tribunal “identified areas where we didn’t get everything right, including around signage, customer information, processes and our privacy policy”, and that it accepts that feedback.
A second retailer
In 2025 the same regulator found that Kmart broke the same law. Kmart had used facial recognition in 28 stores from June 2020 to July 2022, against refund fraud. That decision is under review by the tribunal.
What the case shows
- Write the risk assessment before you switch the system on. The tribunal accepted Bunnings’ reason for using the technology. It still found against the chain for not assessing the privacy risks in a formal, documented way.
- Tell people plainly. One finding that stood was that shoppers did not know. Signs, customer information and the privacy policy all fell short, by Bunnings’ own account.
- A good reason does not cover everything. Fighting crime justified collecting faces without consent. It did not excuse the missing notice or the missing procedures.
- Every face counts. The system scanned everyone who walked in. Both the regulator and the tribunal treated each brief scan as a collection of personal information.
What this says about the practices
Practices that were missing
Read next
- Rite Aid: banned from facial recognition for five years after buying it without testing itRite Aid used facial recognition to spot suspected shoplifters. The US consumer regulator said the chain never asked its vendors how accurate the system was, never tested it and did not train staff. Shoppers were wrongly accused. The chain was banned from the technology for five years.
- Air Canada: held responsible for what its website chatbot told a customerAir Canada’s website chatbot gave a customer wrong information about refunds. A Canadian tribunal ordered the airline to pay. It rejected the argument that the company was not responsible for its chatbot.
- Fiverr cut about 250 jobs to become “an AI-first company” and promised investors a higher marginFiverr let go about 30% of its staff and told investors it would reach a 25% adjusted EBITDA margin in 2026, a year early. The cut is on record in its annual report. The margin promise is not: by mid-2026 its revenue was falling and its own forecasts pointed lower.
Sources
- Office of the Australian Information Commissioner (19 November 2024). Bunnings breached Australians’ privacy with facial recognition tool. Media release on Commissioner initiated investigation into Bunnings Group Limited (Privacy) [2024] AICmr 230. oaic.gov.au
- Office of the Australian Information Commissioner (2024). Bunnings determination. Fact sheet (PDF). oaic.gov.au
- Office of the Australian Information Commissioner (4 February 2026). OAIC statement on Administrative Review Tribunal’s Bunnings decision. On Bunnings Group Limited and Privacy Commissioner [2026] ARTA 130. oaic.gov.au
- Office of the Australian Information Commissioner (5 March 2026). Privacy Commissioner statement on Administrative Review Tribunal’s Bunnings decision. oaic.gov.au
- Bunnings (4 February 2026). Bunnings statement: Response to Administrative Review Tribunal of Australia’s decision. Company statement (PDF). media.bunnings.com.au
- Office of the Australian Information Commissioner (18 September 2025). Kmart’s use of facial recognition to tackle refund fraud unlawful, Privacy Commissioner finds. Media release. oaic.gov.au