# HD-INC-022: Bunnings Scanned Shoppers' Faces Without Telling Them, and Won Only Half Its Appeal

> Bunnings ran facial recognition across 63 stores for three years. The privacy regulator found it unlawful in 2024; in 2026 a tribunal restored the right to use it for crime prevention while leaving the transparency failures standing.

- Source: https://useheadlights.com/library/HD-INC-022/
- Publisher: Headlights (useheadlights.com), author Ellie Harris
- Published: 2026-06-08
- Company: Bunnings Group (Wesfarmers)
- Sector: Retail & hospitality
- Country: Australia
- Year: 2024
- Behaviour in the record (Headlights reading): Rules-behaviour gap; also Normalisation of deviance
- Governance domains: Data protection, Civil liberties
- Licence: CC BY-NC 4.0. Cite as: Harris, E. (2026). Bunnings Scanned Shoppers' Faces Without Telling Them, and Won Only Half Its Appeal. Headlights AI Incident Library, HD-INC-022. https://useheadlights.com/library/HD-INC-022/

## What happened

It was reported that between November 2018 and November 2021, Bunnings used facial recognition technology in 63 stores across Victoria and New South Wales to identify people suspected of theft, violence or threatening behaviour towards staff and customers.

The technology worked through existing security cameras, capturing shoppers' faces as they entered and comparing them against a database of people Bunnings considered a security risk. When there was no match, the biometric information was deleted almost immediately, although most customers would not have realised their faces were being analysed because the signage did not adequately explain what was happening.

Bunnings maintained that the system was introduced to address serious retail crime and protect employees from aggression, but in November 2024, Australia's Privacy Commissioner found that the company had breached privacy law by collecting sensitive biometric information without consent and failing to properly notify customers.

The company challenged the determination, and in February 2026 the Administrative Review Tribunal overturned the finding that the collection itself was unlawful, accepting that Bunnings could rely on legal exceptions when addressing serious retail crime and protecting people in its stores.

However, the Tribunal left standing findings concerning inadequate customer notification and privacy governance, making the outcome more complicated than a straightforward victory for either side. Bunnings had successfully defended its legal basis for using facial recognition, but it had not met all the obligations that came with deploying it.

## What an auditable version would have shown

The dispute raised questions about why Bunnings considered facial recognition necessary, how it assessed the privacy consequences and what customers were told before their information was collected.

An auditable system would have preserved the legal reasoning behind the deployment, the privacy assessments conducted before installation and evidence of the notices displayed in each store, alongside records explaining how biometric information was handled and deleted.

A ConductRecord could document these decisions and any subsequent changes, while a ConstraintGate could check whether required safeguards had been approved before facial recognition was activated.

Having those records would not automatically establish legal compliance, but it would provide a clearer account of how the company considered its obligations and whether its operating practices matched those decisions.

## Where the gap was

Bunnings was responding to a genuine security concern, and the Tribunal accepted that facial recognition could be justified under the relevant legal exceptions, particularly where the purpose was to prevent serious retail crime and protect people from violence or abuse.

The problem was that the company had not adequately informed shoppers about the technology or established the privacy procedures required to govern its use.

Headlights identifies a **rules-behaviour gap**, where an organisation introduces technology for a legitimate purpose but fails to give sufficient attention to the responsibilities that accompany its use.

There is a recognisable human behaviour behind this pattern. When people believe they are addressing an important problem, especially one involving employee safety, they can become focused on whether the proposed solution works while giving less consideration to how it affects everyone else.

In this case, protecting employees from threatening behaviour was a legitimate objective, but ordinary shoppers also had a right to understand that their faces were being analysed as they entered the store.

The Tribunal's decision illustrates that these responsibilities are not mutually exclusive, and that establishing a lawful reason to use technology does not excuse an organisation from meeting its other privacy obligations.

## What governance should have looked like

Before introducing facial recognition, Bunnings needed a documented assessment explaining why the technology was necessary, which legal exceptions applied and how the privacy of ordinary shoppers would be protected.

That assessment should have been supported by clear notices at store entrances, accurate privacy policies and regular reviews of how the technology operated, including how long biometric information was retained and who could access it.

A ConstraintGate could help enforce approved collection and retention rules, while a ConductRecord could preserve evidence of privacy assessments, authorisations and changes to the system over time.

The important distinction is that governance should have been part of the deployment itself rather than something reconstructed after a regulator began investigating.

Bunnings' experience demonstrates that even where a technology serves a legitimate security purpose, an organisation must still be able to explain its use, justify its decisions and show that appropriate safeguards were in place.

**Failure Pattern:** Bunnings deployed facial recognition to identify people associated with serious retail security incidents, but failed to adequately notify customers and establish sufficient privacy governance. Although the Tribunal overturned the finding that biometric collection itself was unlawful, those other findings remained.

**Governance Principle:** Organisations using biometric surveillance must establish a lawful basis, clearly inform affected people and maintain documented safeguards before deploying the technology, regardless of how legitimate its intended purpose may be.

The reference implementation of ConstraintGate and ConductRecord is open source. It lives at [github.com/saffronandindia/headlights-oss](https://github.com/saffronandindia/headlights-oss), Apache 2.0 licensed and free to install. The repository is public now.

## Sources

- [Bunnings breached Australians' privacy with facial recognition tool (OAIC)](https://www.oaic.gov.au/news/media-centre/bunnings-breached-australians-privacy-with-facial-recognition-tool)
- [OAIC statement on the Administrative Review Tribunal's Bunnings decision (OAIC)](https://www.oaic.gov.au/news/media-centre/oaic-statement-on-administrative-review-tribunals-bunnings-decision)
- [Administrative Review Tribunal upholds Bunnings' use of facial recognition technology (Gilbert + Tobin)](https://