Bunnings will fight a finding that it invaded customers’ privacy by using facial recognition technology in its stores without proper consent.

The landmark ruling handed down by the Privacy Commissioner on Tuesday follows a two-year investigation.

“Individuals who entered the relevant Bunnings stores at the time would not have been aware that facial recognition technology was in use and especially that their sensitive information was being collected, even if briefly,” Australian Privacy Commissioner Carly Kind said.

“We can’t change our face. The Privacy Act recognises this, classing our facial image and other biometric information as sensitive information, which has a high level of privacy protection, including that consent is generally required for it to be collected.”

The Office of the Australian Information Commissioner found Bunnings had analysed the faces of “hundreds of thousands” of customers in 62 stores in NSW and Victoria between November 2018 and November 2021.

The images were compared against the faces of people Bunnings had enrolled in a database who had been identified as posing a risk, for example, due to past crime or violent behaviour, according to the OAIC.

The practice was revealed when consumer group Choice made an official complaint about its use by Bunnings, Kmart and The Good Guys to the office in 2022.

All three retailers halted the practice after Choice’s complaint.

Kmart is also being investigated for its use of the tech. A finding is yet to be made.

There was no investigation by the regulator into The Good Guys.

How the retailer used its facial recognition tech. Source: Bunnings

Facial recognition and biometric information are both classed as sensitive information under the Privacy Act.

The commissioner found that Bunnings breached customers’ privacy by capturing their sensitive information without consent.

“Just because a technology may be helpful or convenient does not mean its use is justifiable,” Kind said.

“In this instance, deploying facial recognition technology was the most intrusive option, disproportionately interfering with the privacy of everyone who entered its stores, not just high-risk individuals.”

Kind found that Bunnings failed “to take reasonable steps to notify individuals” about their personal information being collected, as well as “implement practices, procedures and systems” that complied with Australia’s privacy laws.

Nor did the retailer include existing privacy policies in its collection, holding and use of personal information.

Bunnings has been ordered to destroy all personal and sensitive information collected via the facial recognition technology system that it still holds after one year.

It must also make a public statement in the next 30 days on the issue, and agree not to use the tech again.

Bunnings says crime and violence in store is a growing threat. Source: Bunnings

Choice hailed the findings on Tuesday.

‘This is a landmark decision that will prompt all businesses to think carefully about the use of facial recognition in Australia going forwards,” senior campaigns and policy adviser Rafi Alam said.

“We know the Australian community has been shocked and angered by the use of facial recognition technology in a number of settings, including sporting and concert venues, pubs and clubs, and big retailers like Bunnings.”

Bunnings, meanwhile, has said it will seek review of the decision.

In a statement on Tuesday, it said it had “hoped that based on our submissions, the commissioner would accept our position that the use of [facial recognition technology] appropriately balanced our privacy obligations and the need to protect our team, customers, and suppliers against the ongoing and increasing exposure to violent and organised crime, perpetrated by a small number of known and repeat offenders”.

The Wesfarmers-owned hardware giant said the tech had been trialled in “a limited number” of stores, with “strict controls around its use”.

Managing director Mike Schneider said the use of facial recognition technology was “never about convenience or saving money but was all about safeguarding our business and protecting our team, customers and suppliers”.

He said 70 per cent of Bunnings’ in-store incidents were caused by the same group of people. Facial recognition was the fastest and most accurate way of identifying and quickly removing them.

He said stores were noting “increasing exposure to violent and organised crime” and using the technology was “justifiable” if even one person could be protected from trauma.

“The electronic data was never used for marketing purposes or to track customer behaviour,” he said.