Bunnings keen to roll out facial recognition tech to all its stores

Bunnings aims to roll out facial recognition technology in all stores, despite a determination from the privacy commissioner that the hardware giant’s use of the technology breached Australia’s privacy laws.

The retailer said last week that it would seek a review of the privacy commissioner’s determination that it breached the privacy of hundreds of thousands of customers, arguing its use of facial recognition technology (FRT) appropriately balanced privacy with the need to protect staff against violent and organised crime.

A still of a gunman from Bunnings security footage.Credit: Supplied

In a trial between 2018 and 2021, Bunnings took the data of customers’ faces and compared the information against a database of individuals the company had deemed a risk due to past crime or violent behaviour.

The company says it compared customers’ faces with a database of fewer than 500 customers, and that the FRT system was available only to six “specially trained Bunnings team members … in a centralised location”. It said no customer biometric data was uploaded to the cloud or third-party services.

Bunnings managing director Michael Schneider said stores that participated in the trial had at least 10 per cent fewer violent incidents.

“We believe that customer privacy was not at risk. The electronic data of the vast majority of people was processed and deleted in 0.00417 seconds – less than the blink of an eye,” he said. “We never used data for marketing purposes or to track customer behaviour.”

Bunnings managing director Michael Schneider.

The Wesfarmers-owned company released graphic footage to media outlets of violent incidents in its stores, saying abuse, threats and assaults increased by 50 per cent in Bunnings stores in the past year alone.

“CCTV and FRT have become a part of everyday life, at airports, railway stations, banks, concerts, sports venues and in cities,” Schneider said. “There’s no doubt that privacy concerns need to be balanced, but the technology is critical to reducing retail crime and harm to our team and customers.”

However, the privacy commissioner found that Bunnings breached the nation’s privacy laws by failing to appropriately inform customers about its use of facial recognition technology.

Bunnings was ordered not to repeat or continue the acts and practices that led to the interference with individuals’ privacy.

Bunnings had conditions-of-entry posters in place, including the use of CCTV, when it started using the technology. However, the hardware giant said it started specifically referring to its use of FRT technology on entry signs and its privacy policy during the trial itself.

“Individuals who entered the relevant Bunnings stores at the time would not have been aware that facial recognition technology was in use and especially that their sensitive information was being collected, even if briefly,” commissioner Carly Kind said.

“Because facial recognition technology is a high-privacy-risk technology, it is not justifiable for entities to use it merely because it is available, convenient or desirable. Rather, businesses will need to ... satisfy themselves that it is reasonably necessary to collect this information in order to carry out their functions and activities.”

Now, the company says it intends to roll out the technology to all of its stores if successful in its appeal. It did not disclose the provider behind the technology, citing commercial-in-confidence.

Privacy Commissioner Carly Kind.Credit: Michael Quelch

“Yes, we are,” a Bunnings spokesman said when asked whether it would be keen to continue the use of FRT and roll it out to all stores.

“However, the next step will be seeking a review of the privacy commissioner’s determination, before the Administrative Review Tribunal.”

The privacy commissioner’s determination, and any subsequent ruling by the tribunal, could influence how businesses deploy facial recognition technology in the future.

The chief executive of the Australian Chamber of Commerce and Industry, Andrew McKellar, said the commissioner’s ruling would be confusing for businesses.

“The actions of Bunnings point to genuine risk mitigation efforts that have been undone by a technicality,” he said.

“Businesses looking to protect their staff could rightly be confused by the decision. We look forward to a tribunal review outcome which enables clarity for business.”

Get news and reviews on technology, gadgets and gaming in our Technology newsletter every Friday. Sign up here.