The federal Privacy Commissioner is investigating the personal information-handling practices of Bunnings and Kmart, focusing on their use of facial recognition technology to identify people who had previously been involved in “incidents of concern”.