Australian hardware retail chain Bunnings was found to have breached Australians’ privacy by using facial recognition technology (FRT) in 63 stores between 2018 and 2021. The Australian Privacy Commissioner ruled that the retailer collected sensitive data without consent. Bunnings has since defended the practice, arguing it was essential for safety and crime prevention.
Bunnings released security footage of staff members being threatened and assaulted in response to findings from Australia’s privacy watchdog that the company breached the country’s privacy, News.com.au reported on Tuesday (November 19).
The retailer reportedly tested FRT in 63 stores in Victoria and New South Wales from November 2018 to November 2021.
As a result, the Australian Privacy Commissioner ruled that Bunnings’ use of FRT breached privacy laws by collecting sensitive information without customers’ consent.
Australian hardware retail chain Bunnings was found to have breached Australians’ privacy
The Commissioner found that the technology disproportionately interfered with the privacy of all customers entering the stores, not just high-risk individuals, and that Bunnings failed to adequately inform people their data was being collected.
Consequently, Bunnings was ordered to cease using FRT and to stop collecting facial images without consent.
In response to the ruling, Bunnings managing director Mike Schneider defended the technology in a press release published on Tuesday.
Schneider emphasized that the technology was used with strict controls and helped reduce incidents in trial stores.
“We had hoped that based on our submissions, the Commissioner would accept our position that the use of FRT appropriately balanced our privacy obligations and the need to protect our team, customers, and suppliers against the ongoing and increasing exposure to violent and organized crime, perpetrated by a small number of known and repeat offenders,” Schneider said.
According to the manager, the Commissioner acknowledged that FRT had the potential to protect against serious issues, such as crime and violent behavior.
It was condemned for using facial recognition technology (FRT) in 63 stores between 2018 and 2021
“This was the very reason Bunnings used the technology,” Schneider explained. “Our use of FRT was never about convenience or saving money but was all about safeguarding our business and protecting our team, customers, and suppliers from violent, aggressive behavior, criminal conduct and preventing them from being physically or mentally harmed by these individuals.”
As per the official statement, Bunnings trialed FRT in select Victoria and New South Wales stores from 2018 to 2021 as part of broader security measures aimed at reducing theft and ensuring customer and staff safety.
The technology targeted a small group of repeat offenders responsible for most incidents and significantly reduced theft and violent encounters compared to stores without FRT.
Schneider revealed: “Every day we work hard to earn the trust of our team, suppliers, and customers and this includes keeping people safe in and around our stores.
“It’s our highest priority and a responsibility we take very seriously. Across the retail sector, abuse, threat, and assaults in stores continue to rise, with a 50 percent increase at Bunnings last year alone.
“Statistics don’t convey the real impact it has on the lives of our team and our customers, and we provided the OAIC [Office of the Australian Information Commissioner] with numerous examples of violent and abusive situations in our stores.”
The Australian Privacy Commissioner ruled the retailer collected sensitive data without consent
Bunnings expressed deep disappointment with the Commissioner’s ruling, emphasizing the importance of FRT in protecting staff and customers from violence and abuse.
The company argued that ensuring safety, even for a single person, justifies the use of FRT, which helps identify repeat offenders and prevent incidents.
Bunnings also noted ongoing consultations with unions and governments to address the growing challenges faced by frontline workers and seek better legislative protections.
FRT was part of a broader security strategy, supported by training, resources, and strict access controls to ensure accurate identification, Schneider said.
The company updated its privacy policy and store signs during the trial to clearly inform customers about the use of FRT.
The press release further highlighted that theft and violent behavior were major concerns, with a significant portion of incidents involving repeat offenders, and stressed that customer privacy was always protected throughout the process.
Bunnings has since defended the practice, arguing it was essential for safety and crime prevention
“We would never act in a way that we believe would jeopardize customer privacy,” Schneider concluded.
Australian Privacy Commissioner Carly Kind said despite the efforts being “well-intentioned” to address unlawful activity, the technology was not justifiable, News.com.au reported.
Kind said in a statement on Tuesday: “In this instance, deploying facial recognition technology was the most intrusive option, disproportionately interfering with the privacy of everyone who entered its stores, not just high-risk individuals.”
The Privacy Commissioner reportedly determined that Bunnings collected facial recognition data from potentially hundreds of thousands of individuals without their consent and failed to properly inform them.
Bunnings has paused the use of the technology and plans to seek a review of the ruling, asserting that facial recognition is essential for safety.
Previously released CCTV footage showed violent incidents at Bunnings stores, including a man threatening staff with a knife, hammer, and even a gun, as well as staff being assaulted.
Bunnings released security footage of staff members being threatened and assaulted in response to findings from Australia’s privacy watchdog
During the trial, FRT was used to identify and remove individuals with prior records of abusive or criminal behavior.
Commissioner Kind reportedly said facial images were sensitive information because “we can’t change our face” and therefore, consent was generally needed to collect these images, “even if briefly.”
She added: “This decision should serve as a reminder to all organisations to proactively consider how the use of technology might impact privacy and to make sure privacy obligations are met.
“Organisations should be aware that ensuring the use of emerging technologies aligns with community expectations and regulatory requirements is high among our priorities.”
On Tuesday, the OAIC released a new privacy guide for businesses using FRT. The non-profit consumer advocacy organization, which exposed Bunnings, Kmart, and The Good Guys’ use of the technology in 2022, called the Privacy Commissioner’s ruling a “landmark decision” but stressed that more action is needed.
Rafi Alam from Choice criticized Australia’s outdated privacy laws, noting that the technology’s use has only increased during the investigation.
In 2022, it was revealed Bunnings was one of a number of retailers using FRT in stores to check the face of every customer entering the store against a database of banned customers, The Guardian reported on Tuesday.
FRT captures images of people’s faces from video cameras – such as CCTV footage – as a unique faceprint that is then stored and can be compared with other faceprints, according to The Guardian.
“Taking care of your staff and keeping them safe is important,” a reader commented
