Facial Recognition
Trust Centre

Australian retailers face increasing levels of theft, fraud, and violence against staff. This store uses facial recognition to identify individuals who have previously been involved in criminal activity or threatening behaviour, so that staff can be alerted before an incident occurs.

In February 2026, the Administrative Review Tribunal confirmed that facial recognition technology can be lawfully used in Australian retail environments for this purpose, provided appropriate safeguards are in place.

No. When you enter the store, the system captures your face and converts it into a mathematical code to compare against a watchlist. If there is no match, this code is deleted within milliseconds. Your face is not stored, and no record of your visit is kept in the facial recognition system.

Like standard CCTV, the camera does record footage which is retained for 7 days and then automatically deleted. This is the same as any other security camera in the store.

The watchlist only includes individuals who have been involved in documented incidents of criminal activity (such as theft, fraud, or organised retail crime), violence, abuse or threats directed at staff or customers, or who are subject to formal trespass notices or police warrants.

The watchlist is reviewed regularly and individuals are removed when their inclusion is no longer justified.

If the system identifies a potential match, an alert is sent to an authorised store manager. The manager reviews the alert by comparing the live image with the watchlist photo side by side. Only after this human review does the manager decide whether to take any action.

The system never acts on its own. Every decision is made by a person.

The facial recognition engine used in this store does not rely on deep learning, which means it is not subject to the training data biases that can affect other systems. The store also monitors accuracy and false match rates on an ongoing basis to ensure the system is performing fairly across all demographics.

Access to the facial recognition system is strictly limited to authorised personnel. Only designated store managers can view match alerts. The watchlist is managed through a secure, access-controlled platform with full audit logging of every action.

No data is shared with any third party for marketing, analytics, or any purpose unrelated to safety and crime prevention.

The use of facial recognition in this store is authorised under the Privacy Act 1988 (Cth). Specifically, the store relies on permitted general situations under section 16A of the Act, which allow the collection of biometric information without consent where it is necessary to prevent serious threats to safety or to take action in relation to suspected unlawful activity.

This approach was confirmed as lawful by the Administrative Review Tribunal in the Bunnings decision of February 2026. The Australian Privacy Commissioner has confirmed she will not appeal this decision.