Bunnings And Beyond: Privacy Lessons For Government Agencies

The Administrative Review Tribunal’s decision on Bunnings’ use of Facial Recognition Technology (FRT) in February this year may have gone under the radar for government lawyers given the affected organisation was a retail giant and the scenario appeared unrelated to the day-to-day activities of an Australian government agency.

However, the decision contains important lessons for departments and agencies that collect sensitive information, particularly where new technologies are involved or obtaining explicit consent may not be practicable.

While the Tribunal partly overturned the Privacy Commissioner’s ruling regarding Australian Privacy Principle (APP) 3 and section 16A of the Privacy Act, which outlines the obligations around collection of information and when consent is required, it upheld the finding that Bunnings breached APPs 1.2, 1.3 and 5.1, which relate to privacy processes and its notification obligations.