orderConcluded
Office of the Australian Information Commissioner (OAIC) — Kmart Australia Limited
September 18, 2025 · Australia
The Privacy Commissioner found Kmart's use of facial recognition to tackle refund fraud across 28 stores (2020-2022) unlawful, collecting sensitive biometric data without consent, and ordered Kmart to cease, apologise, and delete the biometric data.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.