30 July 2026
5 min read
#Australian Government, #Data & Privacy
Published by:
The Administrative Review Tribunal’s decision on Bunnings’ use of Facial Recognition Technology (FRT) in February this year may have gone under the radar for government lawyers given the affected organisation was a retail giant and the scenario appeared unrelated to the day-to-day activities of an Australian government agency.
However, the decision contains important lessons for departments and agencies that collect sensitive information, particularly where new technologies are involved or obtaining explicit consent may not be practicable.
While the Tribunal partly overturned the Privacy Commissioner’s ruling regarding Australian Privacy Principle (APP) 3 and section 16A of the Privacy Act, which outlines the obligations around collection of information and when consent is required, it upheld the finding that Bunnings breached APPs 1.2, 1.3 and 5.1, which relate to privacy processes and its notification obligations.
Under APP 3, an APP entity may only solicit and collect sensitive information if the individual consents, unless an exception applies. Those exceptions, which include the permitted general situation relied on by Bunnings, are set out in APP 3.4.
Section 16A of the Privacy Act outlines the permitted general situations, which include, relevantly for Bunnings’ case, that there is reason to suspect unlawful activity or serious misconduct has occurred, and the collection of information is necessary to take appropriate action. The retailer had to work hard to establish that the exception applied by evidencing that its use of FRT was proportionate to the unlawful activity it was seeking to mitigate.
Another APP 3.4 exception that did not apply to Bunnings, but may be more relevant to government agencies, is where the collection of sensitive information is required or authorised by law.
If an agency is collecting sensitive information that is also ‘protected information’ (generally defined as information collected in accordance with the agency’s duties and responsibilities under the relevant legislation), the ‘required or authorised by law’ exception is likely to be more relevant or may provide an additional pathway to authorising that collection.
In that regard, both Bunnings and an agency (through different APP 3.4 exceptions) may have lawful authority to collect sensitive information without an individual’s consent.
The aspect of the case that is still very relevant for Commonwealth privacy practice, is the ruling upheld that Bunnings was in breach of APPs 1.2, 1.3 and 5.1. These lessons are still worth exploring.
Bunnings’ failure in implementing and using the FRT system was that it was not sufficiently transparent about how the system operated. Agencies may similarly fall into the trap of assuming that, because the collection, use and disclosure of personal information is authorised by law, they have ‘ticked off’ compliance with the Privacy Act. In doing so, they risk overlooking further requirements to provide notice, governance frameworks and transparency to individuals.
When implementing new technologies or projects that involve the collection, use and disclosure of personal or protected information, government agencies should consider whether they have appropriate governance and compliance measures in place, whether their privacy policies contain relevant information, and whether individuals are receiving adequate notice about how their information is being collected and used.
Strengthen compliance systems
The Commissioner identified the systemic failures of Bunnings to implement practices, procedures and systems to ensure compliance with the APPs, breaching APP 1.2. For example, Bunnings did not conduct a privacy impact assessment (PIA) before implementing the FRT system, nor did it adequately document its privacy governance framework.
Commonwealth agencies have specific obligations to conduct PIAs for high-risk privacy projects. Alongside PIAs, agencies should also consider whether a specific project requires updates to other parts of their privacy governance framework, such as internal security practices or data breach response procedures.
Include relevant information in privacy policy
Although Bunnings updated its privacy policies following the introduction of FRT, the Commissioner considered those updates insufficient because they did not mention biometric information or the use of FRT, as required by APPs 1.4(a) and 1.4(b). The lesson for government agencies is to be as specific as possible, especially where sensitive information is being collected or the technology used to collect that information could be perceived as intrusive or novel.
Explain collection practices clearly
Bunnings was found to have breached APP 5.1 by failing to adequately notify individuals about the collection of their biometric data. While signage and privacy policies were in place, they did not sufficiently communicate the use of FRT, the purposes for collection or the consequences of refusing to provide biometric data. The decision referenced APPs 5.2(b), 5.2(d) and 5.2(e), highlighting the need for clear, accessible and transparent communication.
Interestingly, if Bunnings had provided adequate notice under APPs 1 and 5, it may have been able to demonstrate compliance with APP 3, on the basis that consent could have been inferred.
Further considerations
The decision also highlights several other practical considerations for agencies collecting sensitive information (such as biometric information), including:
If you have questions about the decision or need assistance with a privacy project, including conducting a privacy impact assessment, please contact us here.
Disclaimer
The information in this article is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, we do not guarantee that the information in this article is accurate at the date it is received or that it will continue to be accurate in the future.
Published by:
