Office of the Australian Information Commissioner (OAIC) — Bunnings Group Limited
The Privacy Commissioner found Bunnings breached the Privacy Act by capturing the faces of hundreds of thousands of customers via facial-recognition CCTV across 63 stores without consent, and ordered it to cease the practice.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the authority's press release on 2026-09-18. Every holding carries a short verbatim quote from that text.
- Decided by
- Office of the Australian Information Commissioner
- Parties
- Office of the Australian Information Commissioner v. Bunnings Group Limited
- Decision date
- November 19, 2024
- Remedy
- Bunnings was ordered not to repeat or continue the acts and practices that led to the interference with individuals' privacy.
- Appeal
- Appeal status not stated
Key holdings
Bunnings breached privacy law by collecting individuals' sensitive biometric information without obtaining consent.
“Commissioner Kind found Bunnings collected individuals’ sensitive information without consent, failed to take reasonable steps to notify individuals that their personal information was being collected”
Deploying storewide facial recognition technology disproportionately interfered with customer privacy.
“deploying facial recognition technology was the most intrusive option, disproportionately interfering with the privacy of everyone who entered its stores, not just high-risk individuals”
Bunnings failed to implement governance practices and systems required to ensure Privacy Act compliance.
“finding Bunnings failed to take reasonable steps to implement practices, procedures and systems required to comply with the Privacy Act.”
The Commissioner issued orders prohibiting Bunnings from repeating or continuing its privacy-infringing conduct.
“The Commissioner has made various orders, including that Bunnings must not repeat or continue the acts and practices that led to the interference with individuals’ privacy.”
In plain English
Australian Privacy Commissioner Carly Kind determined that Bunnings Group Limited breached Australians' privacy rights by using facial recognition technology in 63 stores across Victoria and New South Wales between November 2018 and November 2021. The system captured facial images from CCTV footage of hundreds of thousands of store visitors without their knowledge or consent. Although Bunnings deployed the surveillance system to address unlawful activity, violent incidents, and aggressive behavior, the regulator found that the measure was disproportionate and excessively intrusive. Under the Privacy Act, facial images and biometric data are classified as sensitive information requiring heightened legal protection and individual consent. The investigation revealed that Bunnings failed to properly notify shoppers, omitted necessary details from its privacy policy, and lacked adequate governance systems and practices to ensure statutory compliance. The Office of the Australian Information Commissioner issued orders directing Bunnings not to repeat or continue the unlawful privacy practices. Bunnings cooperated with the investigation and paused its use of the technology pending the outcome, retaining the right to seek review of the determination.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.