All Australian Retailers: No Blanket Permission for Facial Recognition Tech

• The Administrative Review Tribunal's decision sets a high bar for Australian retailers using facial recognition technology.
• Entities must generally obtain an individual's valid consent before collecting biometric information through FRT.
• Businesses must adopt a 'privacy by design' approach and conduct thorough privacy impact assessments when implementing FRT.
• The OAIC is taking a precautionary approach to regulating FRT use in response to growing public concern.

The guidance remains clear, however, that each proposed deployment of FRT will need to be assessed against the requirements of the Act

The Administrative Review Tribunal's (ART) decision in the Bunnings Group Limited matter has set a high bar for Australian retailers using facial recognition technology in their stores. The tribunal confirmed that there is no blanket permission for FRT use, and entities must demonstrate compliance with the Australian Privacy Principles (APPs). This means that retailers cannot simply assume they can use FRT without meeting specific requirements. In fact, the ART's findings suggest that the onus is on businesses to prove that their use of facial recognition technology is justified. The Office of the Australian Information Commissioner (OAIC) has updated its guidance to reflect these findings and provide clarity for organisations considering using FRT in high-volume, publicly accessible spaces.

When it comes to collecting biometric information through facial recognition technology, consent is a critical issue. The OAIC's updated guidance makes clear that entities must generally obtain an individual's valid consent before collecting sensitive information like biometric templates or facial images. This means that businesses cannot rely on implied or opt-out consent for the collection of such data. Instead, they must ensure that customers are explicitly informed and provide their consent before any collection occurs. The guidance also emphasizes the importance of adopting a 'privacy by design' approach, conducting thorough privacy impact assessments, and implementing robust security measures to protect biometric information.

The use of facial recognition technology in retail spaces has sparked growing public concern. According to the 2026 Australian Community Attitudes to Privacy Survey, 45% of Australians now regard FRT as one of the biggest privacy risks they face, up from 27% in 2023. In response to these concerns, the OAIC is taking a precautionary approach to regulating FRT use. As Privacy Commissioner Carly Kind noted, Australian law requires businesses to assess each proposed deployment of facial recognition technology against the requirements of the Act. This means that retailers must carefully consider whether their use of FRT is reasonably necessary and proportionate before deploying it in their stores.

Lawyers advising Australian retailers on the use of facial recognition technology must ensure their clients obtain valid consent from customers, conduct thorough privacy impact assessments, and implement robust security measures to protect biometric information.

Source: Original reporting via OAIC