‘Customer privacy was not at risk’: Bunnings responds after breaching privacy with facial recognition tool

Bunnings has insisted it will fight a ruling that it breached Australians’ privacy with its trial of facial recognition technology (FRT).

In a statement published on Tuesday, privacy commissioner, Carly Kind, found that Bunnings breached Australians’ privacy by “collecting their personal and sensitive information” through FRT, and claimed that the system, via CCTV, likely captured the faces of hundreds of thousands of customers who 63 Bunnings stores in Victoria and New South Wales between November 2018 and November 2021.

While she said FRT can help protect against issues like crime and violent behaviour, “any possible benefits need to be weighed against the impact on privacy rights”.

“Facial recognition technology may have been an efficient and cost effective option available to Bunnings at the time in its well-intentioned efforts to address unlawful activity, which included incidents of violence and aggression. However, just because a technology may be helpful or convenient, does not mean its use is justifiable,” Kind said.

“In this instance, deploying facial recognition technology was the most intrusive option, disproportionately interfering with the privacy of everyone who entered its stores, not just high-risk individuals.”

It’s claimed that Bunnings collected sensitive information without consent, failed to take reasonable steps to notify individuals that their personal information was being collected, and did not include required information in its privacy policy.

“Individuals who entered the relevant Bunnings stores at the time would not have been aware that facial recognition technology was in use and especially that their sensitive information was being collected, even if briefly,” Kind continued.

“We can’t change our face. The Privacy Act recognises this, classing our facial image and other biometric information as sensitive information, which has a high level of privacy protection, including that consent is generally required for it to be collected.”

In a statement given to Mumbrella, Bunnings said it will seek a review of the ruling, claiming that issues like crime and violent behaviour was the “very reason” it introduced FRT.

“Our use of FRT was never about convenience or saving money but was all about safeguarding our business and protecting our team, customers, and suppliers from violent, aggressive behaviour, criminal conduct and preventing them from being physically or mentally harmed by these individuals,” the statement reads.

“It was not used in isolation but in combination with various other security measures and tools to deliver a safer store environment.”

Bunnings also argued that its FRT trial between 2018-2021 was a success and not only created a safer environment for customers and team members, but resulted in a “significant reduction” in theft.

“We believe that customer privacy was not at risk. The electronic data was never used for marketing purposes or to track customer behaviour,” the statement continues.

“Unless matched against a specific database of people known to, or banned from stores for abusive, violent behaviour or criminal conduct, the electronic data of the vast majority of people was processed and deleted in 0.00417 seconds – less than the blink of an eye.

“We are deeply disappointed with the Commissioner’s determination, given the significant amount of information shared which illustrated the risks to our team and customers from anti-social behaviour. Everyone deserves to feel safe at work. No one should have to come to work and face verbal abuse, threats, physical violence or have weapons pulled on them.”

While Bunnings seeks a review, it has agreed to pause the use of FRT in its stores in the meantime.

Related Content

News Roy Morgan Most Trusted Brand Award winners revealed

Mumbrellacast New Mumbrellacast: Seven upfronts – was it a win?; The problem with major brands not owning their mistakes