Cameras in signs: what the facial recognition cases decided

A screen that looks back: 7-Eleven

The OAIC counts the Kmart determination as its second on facial recognition technology in retail settings, after Bunnings. The 7-Eleven case came earlier, and it began with screens. In its release of 14 October 2021, the OAIC said customers completed in-store surveys on tablets with built-in cameras in 700 stores, from June 2020 to August 2021. The faces were turned into algorithmic representations, or “faceprints”, compared with each other to weed out surveys that might not be genuine, and also used to build a broad picture of who was answering. The Commissioner found the images and faceprints were sensitive information because they were “biometric information that was used for the purpose of automated biometric identification”, and the faceprints were also “biometric templates”.

The determination, [2021] AICmr 50, is dated 29 September 2021, with a corrigendum of 12 October 2021. It found breaches of APP 3.3 and APP 5.1. On what a screen should have said, the Commissioner wrote that 7-Eleven:

“should have included a collection notice on, or in the vicinity of, the tablet screen. The collection notice should have notified customers about APP 5 matters before the start of the survey, and crucially, before the first facial image of the customer was captured.”

[2021] AICmr 50, paragraph 122

The determination also found that “simply publishing a privacy policy on a website does not amount to compliance with APP 5”, and that consent inferred from a privacy policy “would not be current and specific” to the circumstances of collection. The OAIC reported that 7-Eleven had stopped collecting facial images and destroyed those it held, and that it was ordered to destroy the faceprints too.

Three cases, each with its date

What the Tribunal changed for Bunnings

The Administrative Review Tribunal lists Bunnings Group Limited and Privacy Commissioner among its Guidance and Appeals Panel decisions, published 4 February 2026. Its summary says the Panel found no breach of the Privacy Act in the use of facial recognition itself, because that was a permitted use, but did find breaches in the notification and the privacy policies.

The OAIC’s statement the same day said the Tribunal “affirmed” the Commissioner’s findings under APP 1 and APP 5, and “departed from” the finding under APP 3.3. According to the OAIC, the Tribunal accepted that Bunnings could rely on exemptions from the consent requirement for a limited purpose: combatting retail crime and protecting staff and customers from violence, abuse and intimidation in its stores. It said the Tribunal also affirmed the factors the Commissioner set for deciding whether Bunnings could rely on an exemption: whether the system was a suitable and effective response to repeat offenders, whether less privacy-intrusive alternatives were available, and whether its use was proportionate. It also reported the Tribunal’s finding that Bunnings should have completed a structured, documented assessment of the system’s privacy risks. The statement noted that an appeal period applied.

On 29 July 2026 the OAIC described the Bunnings matter as concluded and published updated guidance on facial recognition in retail spaces that reflects the Tribunal’s decision.

Kmart, still under review

In its release of 18 September 2025, the OAIC said Kmart had argued it did not need consent because of the Privacy Act exemption for collection an organisation reasonably believes is needed to deal with unlawful activity or serious misconduct. The release reported the Commissioner’s view that the system collected the information of everyone who entered the stores, that less intrusive methods were available, and that the collection was a disproportionate interference with privacy. The OAIC also said Kmart stopped using the system in July 2022. Those findings are the subject of the review still under way.

What the law asks of a sign with a camera

The rule on notice is Australian Privacy Principle 5.1. It applies “At or before the time or, if that is not practicable, as soon as practicable after, an APP entity collects personal information about an individual”, and requires the entity to “take such steps (if any) as are reasonable in the circumstances” to notify the individual of those APP 5.2 matters that are reasonable in the circumstances, or otherwise to make sure the individual is aware of them. APP 5.2 lists ten matters, among them the entity’s identity and contact details, the purposes of collection, and the main consequences if the information is not collected; the full list is in the Act.

On consent, the OAIC’s Bunnings factsheet puts it this way: “APP 3.3 says an entity must not collect sensitive information unless the individual consents or an exception applies.” These rules bind an APP entity, which includes a body corporate other than a small business operator.

In September 2025 the OAIC said its Bunnings and Kmart determinations “do not impose a ban on the use of FRT”, and that the Privacy Act is technology-neutral. It said then that its guidance asks entities to think about factors such as proportionality, transparency, the risk of bias and discrimination, and how sensitive personal information is governed. The OAIC published updated guidance on 29 July 2026; this guide does not set out what changed.