Learnings from the Bunnings FRT appeal: Using a sledgehammer to crack a nut

This month's decision of the Administrative Review Tribunal (Tribunal) on Bunnings' use of Facial Recognition Technology (FRT) provides important guidance for businesses using or considering FRT in Australia.

The Tribunal set aside the Privacy Commissioner's finding that Bunnings breached Australian Privacy Principle (APP) 3.3, regarding consent but otherwise confirmed that Bunnings acted in breach of APP 1.2, 1.3 and 5.1 which relate to privacy processes and notification of individuals.

While the Tribunal's decision has been widely portrayed in the media as a victory for Bunnings (in terms of allowing it to use FRT), much of the original determination which found Bunnings breached its basic privacy obligations in terms of its privacy notices and policies and procedures was upheld.