Bunnings Breaches Customer Privacy with Facial Recognition Technology

SYDNEY (Reuters) – Wesfarmers-owned Bunnings, the country's biggest home improvement chain, breached the privacy of thousands of customers by using facial recognition technology without gaining consent, an Australian watchdog has found.

Bunnings compared the faces of customers against individuals stored in a database identified as having a history of crime or violent behaviour, according to the Office of the Australian Information Commissioner (OAIC). The system automatically deleted images if no match was found.

Privacy Commissioner Carly Kind stated that while the technology may have been efficient and cost-effective for tackling unlawful activities, it cannot be justified without proper consent.

Bunnings failed to notify individuals that their personal information was being collected and did not include required information in its privacy policy. The company has been ordered to destroy all personal information and cease practices that could harm customer privacy.

Bunnings expressed deep disappointment with the decision and plans to approach the Administrative Review Tribunal for a review. Managing Director Mike Schneider stated that the company believes customer privacy was not at risk, as the electronic data was never used for marketing or tracking purposes.

The facial recognition system captured details of customers visiting 63 stores in Victoria and New South Wales between November 2018 and November 2021, according to the watchdog.

Facial images and other biometric information are considered sensitive under Australian privacy law. The OAIC's decision could influence how businesses deploy facial recognition technology in the future.

In 2022, Consumer group CHOICE complained to the government agency that three retail chains, including Bunnings, were using "unreasonably intrusive" facial recognition technology.