Bunnings Found to Breach Customer Privacy With Widespread Use of Facial Recognition Tech

A two-year investigation has led Australia’s privacy commissioner to issue a landmark finding against the country’s largest hardware retailer, Bunnings, for using facial recognition technology in 387 stores without informing customers.
“Individuals who entered the relevant Bunnings stores at the time would not have been aware that facial recognition technology was in use and especially that their sensitive information was being collected, even if briefly,” Australian Privacy Commissioner Carly Kind said.
The commissioner found Bunnings interfered with the privacy of hundreds of thousands of customers across 63 of its New South Wales and Victoria stores between Nov. 6, 2018 and Nov. 30, 2021.
The conglomerate says it will seek a review of OAIC’s ruling before the Administrative Review Tribunal and justifies deploying the technology because “keeping our team, customers, and suppliers safe in and around our stores is our number one priority.”
“Our use of [facial recognition technology] was never about convenience or saving money but was all about safeguarding our business and protecting our team, customers, and suppliers from violent, aggressive behaviour, criminal conduct and preventing them from being physically or mentally harmed by these individuals.
“It was not used in isolation but in combination with various other security measures and tools to deliver a safer store environment.”
In July, after consumer watchdog group Choice alerted the Office of the Australian Information Commissioner (OAIC) to the practice, the OAIC opened investigations into the personal information handling practices of Bunnings, Kmart Australia, and Good Guys Discount Warehouses. Bunnings and Kmart are both owned by Wesfarmers.
As well as “images from facial recognition software,” and that it may go so far as to use “inferred information and characteristics as a result of undertaking data analysis” on such images.
However, the privacy commissioner held this policy was insufficient, given that most people will not go to a store’s website and read that information.
Instead, Bunnings was obliged by the law to gain proper consent to use the technology on them.
Sixty-six percent said they would be reluctant to provide biometric information to a business, organisation, or government.