Facial Recognition Technology in Australia: Privacy Laws and Compliance Requirements for Businesses

Introduction

Facial recognition technology is regulated in Australia through the Privacy Act 1988 (Cth) (‘Privacy Act’) and the Australian Privacy Principles (‘APP’), rather than a law dedicated to facial recognition technology. Facial images used for automated identification or verification, and the biometric templates created from them, are sensitive information and therefore receive a higher level of privacy protection.

Businesses assessing or using facial recognition technology must consider lawful collection, consent, exceptions, notification, governance, accuracy and security. This article explains when businesses can lawfully collect biometric information through facial recognition technology and the privacy policy, notification, data security and governance steps to take before deployment.

Interactive Tool: Check If Your Facial Recognition Use Is Lawful & Compliant

When Does the Privacy Act Apply?

Biometric Information as Sensitive Information

Section 6(1) of the Privacy Act defines sensitive information to include biometric information that is to be used for automated biometric verification or biometric identification, as well as biometric templates.

This classification provides biometric information stronger privacy protection than personal information generally. The use of facial recognition technology can therefore involve the collection of sensitive information even where facial images or biometric templates are held only briefly before being deleted.

Which Businesses Are Covered?

Under Section 15 of the Privacy Act, an Australian Privacy Principle entity (APP entity) must not breach the APP. An APP entity includes an ‘organisation’ and Section 6C(1) excludes small business operators from that definition. A small business is one with an annual turnover of $3 million or less, as determined by Section 6D(1), so a private sector business is typically covered where its annual turnover exceeds $3 million.

However, the turnover threshold does not determine coverage in every case. Under Section 6D(4) of the Privacy Act, some smaller businesses are not treated as small business operators and remain covered, including:

• businesses that provide a health service and hold health information;
• businesses that trade in personal information; and
• Commonwealth contracted service providers.

For this reason, a business should not assume that it falls outside the Privacy Act merely because it is small. This assessment is relevant to businesses that collect biometric information through facial recognition technology, including:

• retailers;
• technology businesses; and
• financial services providers.

Is Consent Required to Collect Biometric Information?

The General Rule Under APP 3.3

Consent is generally required before an APP entity collects biometric information through facial recognition technology. Under Australian Privacy Principle 3.3 of the Privacy Act, sensitive information may be collected only with the individual’s consent and where the collection is reasonably necessary for the entity’s functions or activities.

Section 6(1) of the Privacy Act defines consent only as ‘express consent or implied consent’. Beyond that brief definition, the Office of the Australian Information Commissioner (OAIC)’s APP Guidelines, in Chapter B, explain that valid consent has four elements. Consent should be:

• informed before it is given;
• voluntary;
• current and specific; and
• given by a person able to understand and communicate it.

The OAIC’s guidance, Facial recognition technology: a guide to assessing the privacy risks (‘OAIC Facial Recognition Technology Guidance’), states that a notice or sign stating that facial recognition technology is being used will not, by itself, usually establish valid consent. 

The same guidance also states that implied consent should generally not be relied on when collecting biometric information, and that consent can be inferred from an opt-out mechanism only in very limited circumstances.

When Is Consent Not Required?

An APP entity may collect biometric information without consent where an exception in Australian Privacy Principle 3.4 of the Privacy Act applies.

Apart from collection required or authorised by an Australian law or a court or tribunal order, the exceptions most relevant to facial recognition technology in commercial settings are the permitted general situations in Section 16A of the Privacy Act, including:

• Serious threat: obtaining consent is unreasonable or impracticable, and the entity reasonably believes collection is necessary to lessen or prevent a serious threat to life, health or safety.
• Unlawful activity: the entity has reason to suspect unlawful activity or serious misconduct connected with its functions, and reasonably believes collection is necessary to take appropriate action.

Section 16A of the Privacy Act requires the APP entity’s belief that collection is necessary to be reasonable, not merely genuine. However, it does not list the factors relevant to that assessment. 

In Bunnings Group Limited and Privacy Commissioner (Guidance and Appeals Panel) [2026] ARTA 130 (‘Bunnings case’), the Administrative Review Tribunal (ART) assessed that belief by considering whether facial recognition technology was suitable, whether less intrusive alternatives were available, and whether the collection was proportionate to the privacy impact.

The OAIC Facial Recognition Technology Guidance now adopts the same three factors. In practice, an APP entity relying on either item should keep evidence addressing each one.

Privacy Policies & Notification Requirements

Privacy Policy Requirements Under APP 1

Australian Privacy Principle 1.2 of the Privacy Act requires an APP entity to take reasonable steps to implement practices, procedures and systems that support compliance with the APP and address privacy enquiries or complaints.

Australian Privacy Principle 1.3 of the Privacy Act also requires a clearly expressed and up-to-date privacy policy, and APP 1.4 sets out what it must contain. For facial recognition technology, the policy must identify:

• the kinds of personal information collected, including biometric information collected through facial recognition technology;
• how it is collected and held;
• its purposes;
• access and correction processes;
• complaint procedures; and
• any likely overseas disclosures and, where practicable, the relevant countries.

Notification Requirements Under APP 5

Australian Privacy Principle 5.1 of the Privacy Act requires reasonable steps to notify individuals at or before collection, or as soon as practicable afterwards.

In the Bunnings case, the Tribunal held that a notice must positively state that facial recognition technology is being used and explain its purpose, and that a general reference to video surveillance is not sufficient. The duty also applies even where a captured face is not matched or is held only briefly.

Upcoming Automated Decision-Making Transparency Requirements

From 10 December 2026, new APP 1.7 to APP 1.9, inserted by the Privacy and Other Legislation Amendment Act 2024 (Cth) (‘Privacy and Other Legislation Amendment Act’), will also require a privacy policy to explain where a computer program uses personal information to make, or substantially and directly assist in making, decisions that could reasonably be expected to significantly affect individuals’ rights or interests.

The OAIC Facial Recognition Technology Guidance indicates this may be relevant where facial recognition technology is used to restrict access to premises or essential goods and services.

What Data Accuracy and Security Requirements Apply to Facial Recognition Technology?

Beyond collection and notification, APP entities using facial recognition technology must manage three related obligations: the accuracy of personal information, the security of biometric information, and its retention and deletion.

Australian Privacy Principle 10.1 of the Privacy Act requires an APP entity to take reasonable steps to ensure that the personal information it collects is accurate, up-to-date and complete. Similarly, Australian Privacy Principle 10.2 applies the same standard, plus relevance, to information used or disclosed, having regard to the purpose of that use or disclosure.

These obligations are particularly important because a facial recognition match is only as reliable as the captured image, the reference database and the matching algorithm. Weaknesses in any of them can lead to:

• false positives;
• false negatives;
• bias; and
• discrimination.

Because a false match may lead staff to treat an innocent person as a suspect, the OAIC Facial Recognition Technology Guidance identifies the following as reasonable steps that may be needed to meet APP 10:

• testing accuracy;
• checking the quality of reference databases; and
• using human verification before acting on a positive match.

Turning to security, Australian Privacy Principle 11.1 of the Privacy Act requires reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. Since 11 December 2024, APP 11.3 has also confirmed that these reasonable steps include technical and organisational measures.

These safeguards are especially important for facial recognition technology because, unlike a password, a person’s face cannot be changed if their biometric information is compromised.

Relevant measures may include technical safeguards, such as encryption and restricted access to facial images and biometric templates, and organisational safeguards, such as staff training and clear rules on who may review and act on match results.

Finally, Australian Privacy Principle 11.2 of the Privacy Act addresses retention by requiring reasonable steps to destroy or de-identify information once it is no longer needed for any purpose for which it may be used or disclosed under the APPs, unless retention is required by or under an Australian law or a court or tribunal order.

For facial recognition technology, a business should therefore set clear retention periods for facial images, biometric templates and reference database entries, and should not keep images of people who are not matched for longer than the comparison requires.

Are Privacy Impact Assessments Mandatory for Businesses Using Facial Recognition Technology?

Australian Privacy Principle 1.2 of the Privacy Act requires reasonable privacy practices, procedures and systems, but does not, by itself, require an APP entity to complete a Privacy Impact Assessment.

By contrast, Australian Government agencies face a separate, mandatory requirement. Under Section 12(1) of the Privacy (Australian Government Agencies – Governance) APP Code 2017 (Cth) (‘APP Code’), an agency must conduct a Privacy Impact Assessment for all high privacy risk projects. However, this requirement does not apply to private sector businesses.

Nevertheless, the OAIC strongly recommends a formal, structured and documented Privacy Impact Assessment before an APP entity deploys facial recognition technology. The assessment identifies privacy risks and recommends steps to manage, reduce or remove them. The OAIC also treats a Privacy Impact Assessment as a reasonable step that may support compliance with Australian Privacy Principle 1.2 of the Privacy Act.

What the Bunnings Facial Recognition Decision Means for Businesses

Establishing the Permitted General Situation Exception

In the Bunnings case, the ART accepted that Bunnings could rely on the permitted general situation exception in item 2 of Section 16A of the Privacy Act. In particular, evidence showed repeated violence, threats, organised retail crime and serious theft connected with Bunnings’ stores.

On that evidence, the ART found that Bunnings had reason to suspect unlawful activity and reasonably believed facial recognition technology was necessary to identify and monitor repeat offenders. Its assessment considered:

• the system’s effectiveness;
• the available alternatives; and
• proportionality.

Human review of alerts also reduced the risk of acting on false positive matches. The short retention period and immediate deletion of unmatched information further limited the privacy impact, which supported the finding that the collection was proportionate. The Tribunal also found that the serious-threat situation in item 1 of Section 16A of the Privacy Act applied.

Breaches of Transparency & Governance Obligations

Despite accepting the exception, the Tribunal found that Bunnings breached APP 1.2, APP 1.3 and APP 5.1 of the Privacy Act. Bunnings had not established sufficient documented practices and systems from the outset, including a formal, structured privacy risk assessment. Its privacy policies also failed to address facial recognition technology, the sensitive information collected or how that information was handled.

Bunnings’ notices referred first to video surveillance and later stated that surveillance “may include facial recognition”. The ART held that none of these notices met APP 5.1 because they did not specifically and positively tell people that facial recognition technology was collecting their sensitive information, or why.

One entry notice also failed to address the matters listed in APP 5.2. Ultimately, a lawful basis for collection did not remove Bunnings’ separate transparency and governance obligations.

How the Kmart Facial Recognition Case Differs from Bunnings

The 2025 Privacy Commissioner Determination on Refund Fraud

By contrast, in Commissioner Initiated Investigation into Kmart Australia Limited (Privacy) [2025] AICmr 155 (‘Kmart determination’), the Privacy Commissioner (‘Commissioner’) found on 26 August 2025 that

Kmart Australia Limited breached the Privacy Act by using facial recognition technology to address refund fraud. Between June 2020 and July 2022, Kmart captured the faces of people entering 28 stores and individuals attending return counters.

The Commissioner found that Kmart had not obtained consent or established that the permitted general situation in item 2 of Section 16A of the Privacy Act applied. The Commissioner also identified several concerns with the technology’s use, including:

• less intrusive methods were available;
• the technology had limited usefulness; and
• collecting biometric information from many people not suspected of refund fraud was disproportionate to the purpose.

Review Status of the Kmart Determination

The Kmart determination remains under review by the ART. Its procedural position therefore differs from the Bunnings case, which the Tribunal decided on 4 February 2026 and which the Privacy Commissioner did not appeal.

At this stage, the Kmart determination has not produced a final Tribunal decision, with hearings reportedly listed for early 2027. Its review is expected to provide further consideration of facial recognition technology used for fraud prevention.

Facial Recognition Technology Compliance Checklist for Businesses

Drawing these obligations together, a business should ordinarily work through the following steps before deploying facial recognition technology:

1. Determine whether the Privacy Act applies. Establish whether the business is an APP entity, without assuming that a small business falls outside the Privacy Act, and whether the proposed collection involves biometric information that is sensitive information.
2. Identify the lawful collection pathway. Collection generally requires valid consent and reasonable necessity under Australian Privacy Principle 3.3 of the Privacy Act, unless an exception under Australian Privacy Principle 3.4 applies.
3. Assess necessity and privacy risks. Consider the purpose of the system, whether less intrusive alternatives are available and whether the collection is proportionate to the privacy impact. Then carry out a Privacy Impact Assessment, document it and record the resulting risk controls. The assessment should cover:
   • the system’s purpose;
   • proposed collection;
   • retention;
   • access controls;
   • accuracy; and
   • deletion processes.
4. Review third-party technology providers. Businesses using third-party providers remain responsible for compliance with the Privacy Act, as a business ‘holds’ personal information where it has possession or control of the record containing it, and may wish to consult Click Legal’s corporate and commercial lawyers for technology vendor arrangements. The OAIC Facial Recognition Technology Guidance recommends vendor checks including:
   • privacy, information security and data breach documents;
   • past security incidents and data-handling practices; and
   • contractual audit, review, retention and deletion obligations.
5. Prepare privacy policies and notices. Update the privacy policy under Australian Privacy Principle 1.3 and prepare clear notices under Australian Privacy Principle 5 that positively state that facial recognition technology is being used and explain its purpose.
6. Implement accuracy, security and retention controls. Address Australian Privacy Principles 10 and 11 by ensuring false matches receive human review before any action is taken, restricting access to facial images and templates, and setting procedures to delete or de-identify biometric information once it is no longer needed. Document these handling procedures.
7. Establish ongoing compliance reviews. Review the assessment and its risk controls whenever the facial recognition system or its information-handling methods change. Ongoing privacy officer services for facial recognition technology governance and compliance can help maintain those controls. Reviews should check:
   • whether collection remains necessary and proportionate;
   • whether notices accurately describe facial recognition technology;
   • whether the system remains accurate and false matches receive human review; and
   • whether biometric information is deleted or de-identified when no longer needed.

Conclusion

APP entities can use facial recognition technology only where the circumstances support a lawful collection pathway and the deployment complies with the Privacy Act and the APP. On 31 August 2026, the Attorney-General’s Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026. It proposes a requirement that the handling of personal information be fair and reasonable in the circumstances, along with changes to consent and notification requirements. However, the Bill has not been passed, may change, and does not alter the current obligations described in this article.

Overall, the Bunnings case shows that an exception to consent does not remove separate transparency, governance, accuracy and security obligations, while the Kmart determination remains under review.

With those separate duties in mind, businesses considering facial recognition technology should seek advice before deployment or expansion. Contact Click Legal’s privacy officer services for Privacy Impact Assessments and regulatory compliance to discuss the proposed use, Privacy Impact Assessment, collection pathway, privacy notices and vendor arrangements with lawyers experienced in financial services, technology and regulatory compliance.

Frequently Asked Questions