Office of the Australian Information Commissioner (OAIC) — Kmart Australia Limited

Decided by

Office of the Australian Information Commissioner

Parties

Office of the Australian Information Commissioner v. Kmart Australia Limited

Decision date

September 18, 2025

Remedy

The Privacy Commissioner issued a regulatory determination finding Kmart breached privacy laws through its use of facial recognition technology.

Appeal

Appeal status not stated

Key holdings

1. The Privacy Commissioner found that Kmart breached privacy laws by collecting personal and sensitive information through a facial recognition system.

   “Privacy Commissioner Carly Kind has found that Kmart Australia Limited (Kmart) breached Australians’ privacy by collecting their personal and sensitive information through a facial recognition technology (FRT) system”

2. Kmart collected sensitive biometric information without notifying shoppers or obtaining their consent.

   “Kmart did not notify shoppers or seek their consent to use FRT to collect their biometric information, which is sensitive personal information and enjoys higher protections under the Privacy Act.”

3. The indiscriminate collection of biometric data from store visitors was a disproportionate interference with customer privacy.

   “the collection of biometric information on Kmart customers was a disproportionate interference with privacy.”

4. Kmart could not reasonably rely on an exemption for addressing unlawful activity because the privacy impact outweighed the system's benefits.

   “I do not consider that the respondent (Kmart) could have reasonably believed that the benefits of the FRT system in addressing refund fraud proportionately outweighed the impact on individuals’ privacy”

In plain English

Privacy Commissioner Carly Kind of the Office of the Australian Information Commissioner found that Kmart Australia Limited breached Australians privacy by collecting personal and sensitive information using facial recognition technology. Between June 2020 and July 2022, Kmart deployed facial recognition technology to capture the faces of every person entering 28 of its retail stores, as well as all individuals at returns counters, in an effort to combat refund fraud. The Privacy Commissioner concluded that Kmart failed to notify shoppers or obtain their consent before collecting their biometric information. Kmart claimed it could rely on a legal exemption for tackling unlawful activity or serious misconduct without consent. However, the Privacy Commissioner determined that Kmart did not meet the required conditions for this exemption. The facial recognition technology system indiscriminately collected sensitive biometric information from thousands of shoppers who were not suspected of wrongdoing. Moreover, less intrusive alternative methods were available to address refund fraud, and the system had limited utility. As a result, the Privacy Commissioner found that the collection of biometric data was a disproportionate interference with customer privacy. Kmart ceased operating the system in July 2022 following the start of the investigation and cooperated throughout. The Privacy Commissioner highlighted that while businesses have legitimate interests in safety and fraud prevention, these reasons do not grant a free pass to avoid compliance with privacy obligations.