The Administrative Review Tribunal of Australia (Tribunal) has partially overturned the findings of the Privacy Commissioner on Bunnings’ use of facial recognition technology (FRT) in its stores.
The Tribunal found FRT use was permitted as an exception to Australian Privacy Principle (APP) 3.3 due to the serious threats faced by staff and customers in Bunnings’ stores, but affirmed that Bunnings:
- Breached APP 1.2 by failing to implement practices, procedures and systems that would have ensured that they complied with the APPs, including not conducting a formal, structured and documented risk assessment of the FRT system from the outset which considered privacy implications—instead, the Tribunal found the steps taken “amounted to random enquiries and actions.”
- Breached APP 1.3 by failing to describe its use of FRT in its public Privacy Policy (statements related to images from video surveillance and other cameras in the stores were found not sufficient).
- Breached APP 5.1 by failing to provide reasonable notice of its use of FRT in stores. Even Bunnings’ entry notice stating that “video surveillance, which may include facial recognition, is utilised” was not sufficient—”use of the word ‘may’ did not positively convey that Bunnings was collecting individuals’ sensitive information through an FRT system [and] fails to inform individuals about the purpose… or the main consequences of not collecting the information.”
This demonstrates even where intrusive technology is permitted as a Privacy Act exception, failure to adequately and systematically consider its privacy impacts will amount to a separate breach. If you’re going to use this kind of technology, make sure your notices are in order first!
An appeal period relates to the Tribunal’s decision. One thing is certain—the expectations on reasonable steps (such as formal risk assessments) continue to increase even in the absence of formal Tranche 2 legislation.
