The Office of the Australian Information Commissioner (OAIC) has published updates to its guidance for Australian Privacy Principle (APP) entities that are considering using facial recognition technology in high volume and publicly accessible physical spaces such as retail shopfronts.
The updated guidance implements the findings of the Administrative Review Tribunal (ART) in the matter of Bunnings Group Limited (Bunnings), which concerned the retailer's use of facial recognition technology in 62 of its stores for a period between 2018 and 2021. In March 2026, the ART affirmed aspects of the Privacy Commissioner's November 2024 determination against Bunnings, and confirmed that there is a high bar for using facial recognition technology in Australia. These new guidance updates reflect the decision of the Tribunal and provide clarity about the OAIC's regulatory application of the law.
The updated guidance provides greater clarity on how exceptions to the obligation to obtain consent when collecting sensitive information, including biometric information, should be applied in retail settings. As retailers will continue to need to make contextual assessments of the legality of using FRT on a case-by-case basis, the updated guidance seeks to support entities in undertaking those assessments.
"The Bunnings decision by the ART provided important clarification on certain aspects of the Privacy Act, and this updated guidance incorporates those points of clarification. The guidance remains clear, however, that each proposed deployment of FRT will need to be assessed against the requirements of the Act," said the Privacy Commissioner.
"A precautionary approach to the deployment of FRT is required under Australian law. This is consistent with the expectations of the Australian community, a significant and growing proportion of whom think facial recognition technology is one of the biggest privacy risks they face today (from 27% in 2023 to 45% 2026, according to the 2026 Australian Community Attitudes to Privacy Survey (ACAPS)."
Although the Bunnings matter concluded with the ART's March 2026 decision, a separate determination issued in August 2025 by the Privacy Commissioner against Kmart, concerning its use of FRT, remains under review in the ART with hearings scheduled for early 2027.
Read the updated facial recognition technology guidance .
