Privacy Commissioner publishes updated guidance on facial recognition in retail spaces

The OAIC published updates on 29 July 2026 to its guidance for entities considering using facial recognition technology in high volume, publicly accessible physical spaces such as retail stores. The update follows a February 2026 decision of the Administrative Review Tribunal, which affirmed aspects of the Privacy Commissioner's November 2024 determination against Bunnings Group Limited concerning its use of the technology in 62 stores between 2018 and 2021.

The Tribunal found that Bunnings was entitled to use facial recognition for the limited purpose of combatting significant retail crime and protecting staff and customers, given the particular threats the retailer faced, but it did not disturb findings that the deployment had not been properly notified to customers. The OAIC's updated guidance incorporates this clarification and provides more detail on how exceptions to the requirement for consent when collecting sensitive information, including biometric information, may apply in retail settings under the Australian Privacy Principles.

The guidance sets out considerations across accountability and privacy impact assessments, the lawful basis for collecting sensitive information, transparency and notification obligations, accuracy and bias, and data deletion and security. The Privacy Commissioner said the Bunnings decision provided important clarification on aspects of the Privacy Act and that each proposed deployment of facial recognition will still need to be assessed against the requirements of the Act, describing a precautionary approach as required under Australian law.

A separate determination against Kmart Australia Limited concerning its use of the technology, issued in August 2025, remains under review before the Administrative Review Tribunal, so that matter has not been finally resolved.