By Sarah Sacher -
Snapshot
- The Administrative Review Tribunal found Bunnings’ use of facial recognition technology to address crime by repeat offenders was permitted under the Privacy Act 1988 (Cth).
- While diverging on the factual findings, the Tribunal affirmed the Privacy Commissioner’s framework for assessing whether a ‘permitted general situation’ exists under the Privacy Act, setting a high bar for use of facial recognition technology going forward.
- This decision is an important test of how Privacy Act principles apply to high-risk AI technologies, and provides some useful clarity. However, the decision turned closely on Bunnings’ specific circumstances and should not be viewed as an endorsement of using facial recognition technology.
Australia is long overdue for modernising reforms to the Privacy Act 1988 (Cth) (‘Privacy Act’) to better address emerging technologies like AI. In 2023, the Australian government committed to a suite of updates to the Privacy Act, including new protections related to facial recognition technology (‘FRT’) and a test for assessing ‘fair and reasonable’ use of personal information. But, these reforms are yet to be implemented.
While we remain in a state of privacy reform limbo, technology marches on. The increased adoption of FRT, particularly in retail environments, has brought urgent privacy risks to the fore in a context of significant regulatory uncertainty.
Bunnings Group Limited and Privacy Commissioner [2026] ARTA 130 (‘Bunnings’) is an important test of how existing Privacy Act principles apply to high-risk tools such as FRT, that were unimaginable back in the 1980s when the Privacy Act was first drafted—an era when fax machines were the height of technological advancement. It provides some much-needed clarity on how similar cases may be treated but is unlikely to be the final word.
