Australia's privacy regulator updated its facial recognition guidance for retail settings on 29 July 2026 to reflect the Administrative Review Tribunal's Bunnings decision of 4 February 2026

Event date / reported

Evidence stage

Tasks this bears on

Where this applies

Australia only, and only the collection of biometric information under the Privacy Act 1988 (Cth). The document is the regulator's own guidance, not a statute, and it says the Act is technology-neutral and neither bans nor permits facial recognition. What it sets out is the route to lawfulness in a shop: collecting sensitive information must be reasonably necessary and consented to, and an entity that cannot obtain valid consent — including where consent is unreasonable or impracticable — must not use the technology unless one of two narrow exceptions applies; before deploying it, an entity is expected to run a documented risk assessment and to give genuine consideration to whether less privacy-intrusive methods could achieve the same outcome. The passage bearing on this task is the guidance's own case study of the Bunnings decision, which records that identifying known offenders let staff be alerted and remove people before an incident, and that Bunnings also used human intervention to verify matches identified by the system, which the guidance says adequately mitigated the risk of acting on a false positive match. Two counter-signals from the same document: the Tribunal accepted that the deployment was effective and that no less intrusive control could identify repeat offenders in stores of that kind, so this is not a record of a ban; and a separate determination against Kmart Australia over facial recognition used against refund fraud remains under review in the same Tribunal, so that half is unsettled. The duties fall on the retailer, not on the person at the till. The document says nothing about how many shops use the technology, nothing about staffing levels, and nothing about any country other than Australia.

What this means

What it does not yet show

It does not establish that any shop has switched the technology off, how many shops use it, or that anyone's hours on the floor changed either way. It is guidance rather than a statute, the matter it draws its case study from went the retailer's way on necessity and proportionality, and a second case on the same technology is still before the tribunal.

What you can check

Does it change the assessment?

Source