Privacy Lessons For Victorian Government Agencies From The Bunnings Decision

The Administrative Review Tribunal’s decision on Bunnings’ use of Facial Recognition Technology (FRT) in February this year may have gone under the radar for government lawyers given the affected organisation was a retail giant and the scenario appeared unrelated to the day-to-day activities of a Victorian government agency.

However, the decision contains important lessons for Victorian public sector organisations that collect sensitive or delicate information, particularly where new technologies are involved or obtaining explicit consent may not be practicable.

While the decision was considered under the Commonwealth Privacy Act and the Australian Privacy Principles (APPs), the Tribunal’s findings regarding transparency, governance and notification obligations are also relevant to Victorian public sector organisations subject to the Privacy and Data Protection Act 2014 (Vic) (PDP Act) and the Information Privacy Principles (IPPs).