Bunnings has successfully overturned a decision by the privacy commissioner that found the hardware retailer breached the privacy of thousands of customers by trialling facial recognition technology to clamp down on shoplifters.
During 2018 and 2021, Bunnings trialled technology in 62 stores that captured customer facial data and compared it against a database of repeat offenders with a history of criminal or violent behaviour. In late November 2024, the Office of the Australian Information Commissioner (OAIC) determined this trial breached customer privacy.
On Wednesday, the Administrative Review Tribunal found that Bunnings could bypass asking customers for consent to be filmed for the specific purpose of combating retail crime and protecting staff and customers from violence and intimidation.
“A permitted general situation existed in relation to the collection of information by Bunnings,” the tribunal’s guidance and appeals panel found.
Bunnings managing director Mike Schneider, who has been vocal about fighting the OAIC’s original determination, said people’s safety had always been the retailer’s highest priority.
“Our intent in trialling this technology was to help protect people from violence, abuse, serious criminal conduct and organised retail crime,” Schneider said.
While the tribunal found Bunnings was allowed to use the technology to combat retail crime, it upheld the OAIC’s original ruling that Bunnings did not properly communicate with customers about its use and that the general notification on the entry about video surveillance was insufficient.
“We find that Bunnings fell short of implementation of practices, procedures and systems relating to Bunnings’ functions or activities that would have ensured that they complied with the Australian Privacy Principles,” the tribunal panel decision stated.
Even though the data collected – which is rapidly matched against existing data about the faces of alleged offenders – was deleted within four milliseconds, the technology “nevertheless collected sensitive information for inclusion in a record, therefore falling under the Privacy Act”.
Schneider acknowledged the tribunal found areas where Bunnings didn’t get it right. “We accept that feedback,” he said.
“Keeping people safe in and around our stores is a responsibility we take very seriously, and we remain committed to engaging constructively on how safety and privacy are balanced in the future.”
The OAIC said the tribunal’s decision confirmed that the Privacy Act protected individual privacy in the wake of emerging technology. It is “carefully considering” the tribunal’s decision, which itself can be appealed.
“Limited exemptions are subject to robust criteria that must be assessed on a case-by-case basis,” an OAIC spokesperson said.
“The Australian community continues to care deeply about … privacy, and is increasingly worried about the challenges in protecting … personal information.”
Australia’s retail sector has broadly welcomed the Tribunal’s decision, while privacy advocates have expressed concern.
Chris Rodwell, Australian Retail Council CEO, said it recognised that facial recognition technology can help protect workers and customers, so long as it’s used transparently and with strong privacy safeguards. This includes clear signage informing customers of the monitoring.
“Retail crime is escalating and is often driven by repeat, high-harm offenders. It’s critical retailers have the capacity to use suspect-matching to identify these known offenders. Workers and customers depend on it,” he said.
“This is a positive step forward in combating retail crime.”
Nick McDonnell, vice president of trust and safety at retail theft reporting platform Auror, welcomed the Tribunal’s decision as providing assurance to retailers tackling violence and crime that they “can fight back”.
“Bunnings’ leadership on this serious issue has been outstanding. They’ve shown this is not a shoplifting problem but a safety and violence one, and that tech plays an important role in combating it,” McDonnell said.
Auror data showed a 26 per cent annual increase in 2025 in retailers reporting threatening customer behaviour. Violent incidents rose by 17 per cent over the same period, while reports of weapons grew by 10 per cent.
Tom Sulston, head of policy at Digital Rights Watch, said the Tribunal’s decision to overturn the OAIC’s finding “clearly goes against community expectations”.
“We need to go to the shops without having our biometric information collected by big corporations,” Sulston said.
The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.
Jessica Yun is a business reporter covering retail and food for The Sydney Morning Herald and The Age.Connect via X or email.
Elias Visontay is a National Consumer Affairs Reporter at The Sydney Morning Herald and The Age.Connect via email.