What happened
It was reported that between June 2020 and July 2022, Kmart Australia used facial recognition technology in 28 stores to identify people suspected of refund fraud, a practice involving the return of stolen or previously refunded goods.
The technology captured shoppers’ faces and converted them into biometric templates that could be compared against a database of suspected offenders. However, the system also collected information from ordinary customers who had no connection to suspected fraud, raising questions about whether such widespread surveillance was justified.
In September 2025, Australia’s Privacy Commissioner found that Kmart had breached privacy law by collecting sensitive biometric information without consent or a valid legal justification, and by failing to adequately inform customers about the surveillance.
Kmart maintained that facial recognition was necessary to address refund fraud, but the Commissioner concluded that collecting biometric information from so many people was disproportionate to the problem the company was trying to solve.
The company was ordered not to repeat the conduct and to publish an apology, although no financial penalty was imposed. Kmart challenged the determination through the Administrative Review Tribunal.
What an auditable version would have shown
The important question was not whether facial recognition could identify suspected fraudsters, but whether Kmart had a lawful reason to collect the biometric information of everyone entering the affected stores.
An auditable system would have documented why facial recognition was considered necessary, what legal justification supported its use and whether less intrusive methods could achieve the same outcome without collecting information from thousands of unrelated customers.
A ConductRecord could preserve those decisions and the evidence supporting them, while a ConstraintGate could prevent biometric collection unless the organisation had established an appropriate lawful basis.
However, maintaining detailed records would not make the surveillance lawful if the collection itself was unnecessary or disproportionate.
Where the gap was
Kmart was responding to a genuine retail problem, but its chosen solution involved collecting sensitive information from a far larger group of people than those suspected of wrongdoing.
Headlights identifies a rules-behaviour gap, where an organisation’s operational decisions conflict with the legal and privacy obligations that should govern them.
There is a familiar human behaviour behind this type of decision. When people become focused on solving a problem, particularly one involving financial losses or security concerns, they can give greater weight to the potential benefits of a solution than to its wider consequences.
Facial recognition offered Kmart a way to identify suspected repeat offenders, but the technology also introduced surveillance of ordinary shoppers who had no reason to expect their biometric information would be collected.
The Privacy Commissioner’s finding was not about whether Kmart intended to prevent fraud, but whether the scale and nature of the information collected could be justified under Australian privacy law.
What governance should have looked like
Before introducing facial recognition, Kmart needed to establish whether collecting customers’ biometric information was lawful, reasonably necessary and proportionate, particularly when other fraud prevention measures were available.
That assessment should have considered the privacy consequences for ordinary shoppers, the circumstances in which biometric information could be collected and whether the same objective could be achieved without facial recognition.
A ConstraintGate could help enforce approved collection rules, while a ConductRecord could document the legal reasoning, authorisations and reviews behind the system’s operation.
Where a lawful basis could not be established, the appropriate control would be to prevent collection rather than simply record that it had occurred.
The broader lesson is that technology can provide an effective answer to a business problem while creating a different and potentially more serious problem for the people affected by it.
Failure Pattern: Kmart introduced facial recognition to identify suspected refund fraud, but the system also collected biometric information from ordinary shoppers. Australia’s Privacy Commissioner found the collection unlawful and disproportionate to its intended purpose.
Governance Principle: Organisations must establish that collecting sensitive personal information is lawful, necessary and proportionate before deploying surveillance technology, rather than assuming that a legitimate business objective justifies its use.
The reference implementation of ConstraintGate and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- Kmart’s use of facial recognition to tackle refund fraud unlawful, Privacy Commissioner finds (OAIC)
- Kmart facial recognition broke privacy laws, regulator finds (Information Age, ACS)
- OAIC determines Kmart breached the Privacy Act 1988 (Cth) over use of facial recognition technology (Bird & Bird)
- Key learnings from the OAIC’s determination on Kmart’s use of facial recognition (Maddocks)