The Tribunal otherwise affirms the decision under review.

...............................[SGD].......................................

TRIBUNAL GUIDANCE DECISION - PRIVACY ACT 1988 - review of determination of Privacy Commissioner that Bunnings interfered with the privacy of individuals through its use of facial recognition technology - whether personal information was collected by the facial recognition technology system - whether facial images are sensitive information - whether Bunnings breached Australian Privacy Principle 3.3 by collecting sensitive information - whether a permitted general situation exists under Australian Privacy Principle 3.4(b) - meaning of 'reasonably believes' in condition (b) in column 3 of item 1 and 2 in section 16A of the Privacy Act 1988 - whether Bunnings took reasonable steps to notify individuals of the collection of personal information in compliance with Australian Privacy Principle 5.1 - whether Bunnings took reasonable steps to implement practices, procedures and systems in compliance with Australian Privacy Principle 1.2 - whether Bunnings had in place an appropriate privacy policy in compliance with Australian Privacy Principle 1.3 - decision of the Privacy Commissioner set aside with respect to the finding that Bunnings breached Australian Privacy Principle 3.3 - Tribunal decides that Bunnings did not breach Australian Privacy Principle 3.3 because subclause 3.4 applies and a permitted general situation exists in relation to the collection of information by use of facial recognition technology - Tribunal decides that Bunnings in breach of Australian Privacy Principles 5.1, 1.2 and 1.3

Administrative Review Tribunal Act 2024 (Cth)

Australian Securities and Investments Commission Act 2001 (Cth)

Privacy Act 1988 (Cth)

Privacy Amendment (Enhancing Privacy Protection) Act 2010 (Cth)

Bunnings Group Limited and Privacy Commissioner (Guidance and Appeals Panel) [2024] ARTA 42

Clearview AI Inc v Australian Information Commissioner [2023] AATA 1069

Commissioner Initiated Investigation into Bunnings Group Limited (Privacy) [2024] AICmr 230

Facebook Inc v Australian Information Commissioner and Another [2022] FCAFC 9; (2022) 289 FCR 217

George v Rockett [1990] HCA 26; (1990) 170 CLR 104

Lithgow City Council v Jackson (2011) 244 CLR 352; [2011] HCA 36

Nationwide News Pty Ltd v Naidu and Anor; ISS Security Pty Ltd v Naidu and Anor [2007] NSWCA 377; (2007) 71 NSWLR 471

Pfizer Ireland Pharmaceuticals v Samsung Bioepis AU Pty Ltd [2017] FCAFC 193; 257 FCR 62

Provide Nominees Pty Ltd v Australian Securities and Investments Commission [2024] FCA 303

Office of the Australian Information Commissioner Australian Privacy Principles Guidelines, Privacy Act 1988

1. This is a review of a Determination by the Australian Privacy Commissioner (the Commissioner) in respect of Bunnings Group Limited (Bunnings).
2. Bunnings is a leading retailer of home improvement and outdoor living products in Australia and New Zealand and a supplier to project builders, commercial tradespeople and the housing industry. Bunnings currently has 513 locations across Australia and New Zealand and employs more than 52,000 staff.[1] During the period from 6 November 2018 to 30 November 2021 (the Relevant Period), Bunnings used facial recognition technology (FRT) in up to 62 of its stores.[2]
3. In simple terms, that FRT system operated as follows. Bunnings maintained a database (Enrolment Database) of persons assessed as posing a risk to its operations because of their violent or criminal conduct. CCTV cameras in Bunnings stores captured real time facial images of persons entering the store which were converted into a vector set (Input Vector Set) and compared with the vector sets (Enrolled Vector Sets) of certain persons (Enrolled Persons) stored on the Enrolment Database. If the FRT system produced a match between an Input Vector Set and an Enrolled Vector Set, it would trigger an alert to Bunnings' authorised team members who could then take appropriate action. Once the matching process was complete, all Input Vector Sets were deleted from the system.
4. On 29 October 2024, following a Commissioner-initiated investigation, the Commissioner made a Determination[3] (the Determination) that the use of FRT by Bunnings involved the collection of 'sensitive information' within the meaning of s 6 of the Privacy Act 1988 (Cth) (the Privacy Act) and gave rise to breaches of Australian Privacy Principles (APPs) 1.2, 1.3, 3.3 and 5.1. Having found that Bunnings interfered with the privacy of individuals, the Commissioner exercised her discretion under s 52(1A) of the Act to make a number of declarations. The Determination is the decision under review. The Tribunal has the power to review the Determination by s 96(1) of the Privacy Act.
5. Bunnings contends that the Tribunal should set aside the Determination of the Commissioner and either decide not to exercise any declaration power in s 52(1A) of the Privacy Act or declare that it would be inappropriate for any further action to be taken in the matter pursuant to s 52(1A)(e) of the Privacy Act.[4] The Commissioner contends that the Tribunal should affirm the Determination pursuant to s 105(a) of the Administrative Review Tribunal Act 2024 (Cth) (ART Act).[5]

1. The Commissioner's Determination was made after the following key events,[6] which are the subject of a Statement of Agreed Facts:[7]

(a) Between 6 November 2018 and 30 November 2021 (the Relevant Period), Bunnings operated FRT: > > > (i) in one Bunnings store, on a trial basis, for two months commencing on 6 November 2018; and > > > > (ii) in 62 Bunnings stores from January 2019 until 30 November 2021, comprising 31 stores in each of NSW and Victoria (the relevant stores). > > (b) Bunnings ceased operating the FRT system on 30 November 2021. > > (c) Neither prior to nor during the Relevant Period, did Bunnings conduct a formal written privacy impact assessment or a formal written privacy threshold assessment as described in the 'Guide to undertaking privacy impact assessments' published by the Office of the Australian Information Commissioner (OAIC). > > (d) On 1 July 2022, the Commissioner notified Bunnings of her intention to commence an investigation under s 40(2) of the Privacy Act in relation to Bunnings' use of FRT during the Relevant Period, including Bunnings' compliance with APPs 3.3, 3.5 and 5.1. > > (e) On 11 July 2022, a delegate of the Commissioner opened the investigation. The OAIC collected and reviewed initial evidence between July and December 2022. > > (f) On 16 January 2023, the delegate of the Commissioner issued a preliminary view to Bunnings seeking its comments on the proposed findings and declarations therein. Between March 2023 and October 2024, Bunnings provided further submissions and materials to the OAIC in relation to the investigation and preliminary view. > > (g) On 29 October 2024, the Commissioner made the Determination under s 52 of the Privacy Act.

1. On 25 November 2024, Bunnings applied to the Tribunal under s 96(1)(c) of the Privacy Act seeking a review of the Commissioner's Determination. On 13 December 2024, the parties lodged a joint submission supporting referral of the proceeding to the Tribunal's Guidance and Appeals Panel (GAP) in accordance with s 122(1) of the ART Act.
2. On 16 December 2024, the President of the Administrative Review Tribunal decided to refer the application for review in this proceeding to the GAP, being satisfied that:[8]

(a) the application for review raises an issue of significance to administrative decision-making - namely, the use of FRT by organisations interfacing with the public - which affects many members of the community and is a feature of some other administrative decisions falling within the Tribunal's jurisdiction; and > > (b) it is appropriate in the interests of justice that the Tribunal be constituted by the GAP for the purposes of the proceeding in relation to the application for review, particularly in the light of the matters referred to in (a) above and the desirability of the complex factual and legal issues in the proceeding being resolved by a Tribunal guidance decision made by the GAP.

3. Redactions were applied to those parts of the Privacy Commissioner's published Determination which would otherwise have disclosed non-public commercially sensitive information and personal identifying information relating to Bunnings employees.
4. The Tribunal made confidentiality orders restricting publication and disclosure of identified parts of the evidence and submissions before the Tribunal. In these reasons we have avoided referring to figures or information the subject of an order, but we have paraphrased those references where appropriate.
5. The matter was heard by the GAP panel in Melbourne on 22, 23, 24 and 27 October 2025.

1. The Privacy Act regulates the manner in which personal information is collected and used by Australian government agencies and some private sector organisations (APP entities). It sets out a number of Australian Privacy Principles that must be complied with by those entities coming within the operation of the Privacy Act.
2. The objects of the Privacy Act include promoting the protection of the privacy of individuals while recognising that the protection of the privacy of individuals is balanced with the interests of entities in carrying out their functions or activities.
3. The Privacy Act prohibits an APP entity from doing an act, or engaging in a practice, that breaches an APP. A breach of an APP in relation to personal information is an interference with the privacy of an individual under s 13(1) of the Privacy Act.
4. The Privacy Act distinguishes between 'personal information' and 'sensitive information'. While all information that comes within the definition of 'sensitive information' will also be 'personal information', 'sensitive information' is defined to include information about sensitive issues such as an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation and health, genetics or biometrics. Generally speaking, the Privacy Act affords 'sensitive information' a higher level of privacy protection than other 'personal information'.
5. The Commissioner's Determination found that in its use of FRT, Bunnings interfered with the privacy of individuals by collecting 'sensitive information' in a manner that breached APPs 1.2, 1.3, 3.3 and 5.1, which broadly deal with:

(a) the open and transparent management of personal information (APP 1); > > (b) the collection of solicited personal information (APP 3); and > > (c) the notification of the collection of personal information (APP 5).

1. It is agreed that Bunnings is an 'organisation' for the purposes of s 6C of the Privacy Act and as such it is an APP entity to which the Australian Privacy Principles (APPs) apply.
2. As such, the following issues arise in the review.

1. Whether Bunnings breached APP 3.3 by collecting 'sensitive information' about an individual in circumstances where a 'permitted general situation' did not exist.[9] This requires consideration of:

(a) Sub-issue 1: whether there was a 'collection' of personal information by Bunnings. > > (b) Sub-issue 2: if there was a 'collection', whether the collected information was 'sensitive information'. > > (c) Sub-issue 3: If there was a 'collection' of 'sensitive information', whether a permitted general situation existed pursuant to s 16A of the Privacy Act.

1. Whether Bunnings took such steps (if any) as were reasonable in the circumstances to notify individuals of the collection of personal information and otherwise to ensure that individuals were aware of matters in APP 5.2.

1. Whether Bunnings took reasonable steps in the circumstances to implement practices, procedures and systems that would ensure that Bunnings complied with the APPs in relation to its use of FRT.

1. Whether, for the purposes of APP 1.3, Bunnings had in place during the Relevant Period an APP privacy policy which contained all the information required by APP 1.4.

ISSUE 1 Sub-issue 1: whether there was a 'collection' of personal information

1. At issue is whether in the operation of its FRT system, Bunnings 'collected' personal information about individuals in the form of input facial images and vector sets in the way that term is defined in the Privacy Act.
2. In considering whether there was a relevant collection of personal information, it is necessary to understand how the FRT system operated.

1. The FRT system utilised by Bunnings during the Relevant Period was designed by Hitachi Kokusai Electric Co Ltd (Hitachi) and supplied to Bunnings by a third-party supplier. Bunnings was solely responsible for the use and operation of the FRT system, including by owning and operating the CCTV cameras and local servers that were used by the system.[10]

1. Bunnings maintained an Enrolment Database that contained unique biometric vector points (vector sets) extracted from facial features in the facial images that Bunnings held of Enrolled Persons.[11]
2. Those facial images of Enrolled Persons were generally obtained from still shots from the relevant store's CCTV system, but any image of sufficient quality could be used and on occasion facial images of people who had committed criminal offences were provided by State Police.[12]
3. The Enrolled Persons were those individuals whom Bunnings assessed to pose a risk to its operations, being individuals in one or more of the following categories:[13]

(a) individuals who had engaged in, or were reasonably suspected of engaging in, actual or threatened violence to Bunnings staff or other members of the public; > > (b) individuals who had committed, or were reasonably suspected of committing, organised retail crime, being theft or fraudulent activity that had occurred multiple times, in multiple stores, and by two or more individuals, with the intent of converting proceeds for financial gain; > > (c) individuals who had demonstrated violent, threatening or other inappropriate behaviour, resulting in Bunnings staff issuing them with a prohibition notice that formally notified them that they were prohibited from entering a Bunnings store; > > (d) individuals who had engaged in serious cases of theft; or > > (e) individuals who had committed criminal conduct, such as refund fraud.

4. The number of Enrolled Persons' images on the Enrolment Database was in the hundreds, but it varied over time.[14]
5. The Enrolment Database was held on a hard drive in a central server located at a Bunnings site in Sydney. Any changes to the Enrolment Database were made on this central server and copied to hard drives on the local servers in each Bunnings store each night so that any updates would take effect in all stores.[15]
6. Additionally, a copy of the vector sets of Enrolled Persons held in the Enrolment Database would sit in the random access memory (RAM) of the local server in each relevant store to facilitate the matching process that occurred when a person entered a Bunnings store. At all relevant times, it was not possible to regenerate a facial image from a vector set.[16]

7. The parties agree and the Tribunal finds that the matching process conducted by the FRT system involved the following steps:[17]

(a) each relevant store utilised CCTV cameras to capture real time facial images of every person entering the store whose facial features were visible; > > (b) a still image was extracted from each frame of the CCTV and sent to the local server; > > (c) the still image was analysed to find positions in the image frame that contain faces using a face-scoring method based on a Gabor filter; > > (d) each identified facial image was converted to a vector set of 20 or more features (the Input Vector Set); > > (e) the FRT system compared the Input Vector Set with the vector sets of Enrolled Persons in the Enrolment Database (Enrolled Vector Sets) by calculating distances between vector sets weighted to facial organs corresponding to each vector point of the facial features; and > > (f) if the Input Vector Set did not match any Enrolled Vector Sets, the Input Vector Set was deleted from RAM, by way of the FRT system's instruction that the non-matched Input Vector Set was not required to be stored or saved in any form of computer memory and could be overwritten.

8. 'Collects' is defined in the Privacy Act as follows:[18]

collects: an entity collects personal information only if the entity collects the personal information for inclusion in a record or generally available publication.

1. There is no dispute that the personal information of Enrolled Persons was 'collected' by Bunnings within the meaning of the Privacy Act. At issue is whether the FRT system operated by Bunnings during the Relevant Period also 'collected' the personal information of non-enrolled persons.
2. The Commissioner contends that the FRT system utilised by Bunnings entailed the 'collection' of personal information of non-enrolled persons, being the input facial images and Input Vector Sets.
3. Bunnings contends that the FRT system did not 'collect' personal information of non-enrolled persons for three reasons:

(a) the information was collected by the CCTV system, not the FRT system; > > (b) there is no collection in the ordinary sense if all that is occurring within the FRT system is that information is being momentarily analysed to determine whether to delete or collect it; and > > (c) the acts performed by the FRT system lacked the necessary purpose, because the FRT system was designed with the intention of excluding unmatched images and all vector sets from any record.

Whether the Information was 'Collected' by the FRT system

1. Bunnings argues that the FRT system did not 'collect' the personal information of non-enrolled persons because the CCTV and FRT are two separate systems. It contends that the correct characterisation is that the FRT system merely 'used' information collected by the CCTV system (the input facial images) to create new information within the FRT system (the Input Vector Sets). It contends that the FRT system does not involve any separate act of 'collection'.
2. The Commissioner provided expert evidence on the operation of the FRT system from Dr Karin Verspoor who provided written reports dated 21 May 2025 and 25 July 2025. During cross-examination Dr Verspoor agreed with propositions put to her to the effect that the conversion of the input facial images into the Input Vector Sets was not something done in or by the CCTV system, rather the Input Vector Sets were created by the FRT system using the data which was obtained from the CCTV system.[19] We consider that Dr Verspoor's evidence, fairly read, was given in the context of identifying which of the various components of the FRT system created the Input Vector Sets, and is not inconsistent with a conclusion that the CCTV cameras were a component of Bunnings' FRT system.
3. We do not accept the submission that the CCTV and FRT were two separate systems, nor that information was separately collected by the CCTV system rather than the FRT system. While it is possible for a CCTV system to operate independently from an FRT system, we do not consider that occurred in this case. Rather, the information provided to the Commissioner by Bunnings for the purposes of the OAIC investigation describes the FRT system as follows:[20]

The Hitachi System consisted of the following components:

• The Central Server.
• A Local Server in each Bunnings Store where the Hitachi software was installed (see list of stores in Appendix 5).
• Certain CCTV cameras (a maximum of 4 at each store in Appendix 5), within each Bunnings store which feed video images to the Hitachi System.

1. That description is also consistent with the parties' Statement of Agreed Facts, which describes the matching process conducted by the FRT system as involving 'the capture of real time facial images'.[21]
2. We find that the CCTV cameras were a necessary and integral component of the FRT system utilised by Bunnings. It follows that if there was a relevant collection of personal information, that information was collected by the FRT system.

Whether there was a collection if all that is occurring within the FRT system is that information is being momentarily analysed to determine whether to delete or collect it

1. Bunnings argues that the vector sets generated by the FRT system were never 'collected', rather they were 'created' from input facial images collected by the CCTV which were instantly deleted as part of a real-time matching process that occurred entirely in random access memory (RAM). It argues that the vector sets were never copied or stored to any hard drive or central processing unit (CPU), rather they were designed to be deleted automatically and permanently from RAM at the average rate of 4.17 milliseconds per image, or 240 images per second, without human intervention.[22]
2. While Bunnings does not posit any minimum temporal threshold for collection, it submits that the speed of the matching process, together with the extremely fleeting existence of unmatched images and both matched and unmatched vector sets, means that the correct characterisation is that the FRT system involved real-time processing of information created from the input facial images rather than 'collection'. Put another way, Bunnings argues that the natural meaning of the word 'collect' does not extend to the anterior act of deciding whether to collect.[23]
3. The Commissioner contends that the fact that the FRT system could complete the matching process for each face in milliseconds does not mean the information was not 'collected', rather the storage of the input facial images and the Input Vector Sets in the local server's RAM for the purpose of being retrieved and used to execute the matching process is sufficient for the information to have been collected by Bunnings within the meaning of the Privacy Act.
4. We do not accept Bunnings' contention that the Input Vector Sets were 'created' rather than 'collected' by Bunnings. Rather the Input Vector Sets were collected because they were generated from input facial images captured on CCTV cameras that we have found were a necessary and integral component of the FRT system.
5. There is no dispute that the facial images and Input Vector Sets were held, however momentarily, on the local server's RAM. RAM is a module attached to the main circuit board of a computer (the motherboard) where it is directly connected to the CPU through a system of wires. We accept the evidence of Dr Verspoor to the effect that RAM is the short-term memory of the computer, where data and instructions are loaded temporarily for direct access and manipulation by the CPU, and it is the primary place where data is stored during execution of a program.[24]
6. When a program is launched, the instructions comprising the program are copied from the hard drive into RAM, and any data that is needed by or created by the program is also kept in RAM until it is released or cleared. The clearing of the data can occur in several ways, such as a program instruction to free or release the memory or replace the information with other information, upon termination of the program or when power to the motherboard is turned off or withdrawn. Because RAM is a volatile memory which requires power to hold its data, data and instructions stored in RAM will be cleared when the power is turned off.[25]
7. The precise time for which the input facial images and vector sets remained in RAM before they were discarded at the completion of the matching process is in issue between the parties. Bunnings contends that the matching process took on average 4.17 milliseconds per image before the information was deleted, that figure deriving from the technical information provided by Hitachi.[26]
8. The Commissioner presented evidence from Dr Verspoor to the effect that it was possible that the information was held for much longer due to the relatively slower processing speed of the Bunnings computer compared to the Hitachi computer, and possible that the facial images could arrive in the FRT system at a faster rate than they could be processed.
9. Dr Verspoor based her analysis on the information supplied by Hitachi about the technical specifications of the system and her understanding of how computers process code, confirming that she was not given access to the Hitachi system's code or any details of further algorithms. She calculated the processing speed of the matching process by applying arithmetic to three integers: the assumed frame rate per second; the number of images per frame; and an arithmetic calculation of the average matching speed per image of 4.17 milliseconds per face calculated by working backwards from the available information that 240 images were processed per second (that number also being consistent with the information provided by Hitachi).[27]
10. The average matching speed per image of 4.17 milliseconds per face was based on testing Hitachi had done with a particular computer server and technical specifications. Dr Verspoor used additional information provided to her about the technical specifications of the server used in Bunnings' implementation of the system to make estimates about how it might impact the speed of processing. Based on a comparison of the Bunnings computer versus the Hitachi computer, she calculated that the Bunnings system could be 6% slower than the Hitachi computer, taking the average matching speed per image to 4.42 milliseconds per image.[28]
11. Dr Verspoor's evidence also sets out that as the frames coming in from the CCTV were processed sequentially, if those frames arrived in the FRT system at a greater rate than they could be immediately processed, then they would be stored in RAM for the time required for the matching process plus the time that the image spent in the queue while the program processed other images that had been captured before it. The result would be that while the matching process may only take 4.17 (or 4.42 milliseconds) on average, the overall time the image was held in RAM prior to finalising the matching process could be substantially longer.[29]
12. The calculations contained in Dr Verspoor's Supplementary Report were based on an assumption that sixteen cameras were supplying images to the FRT system in parallel as specified in the Hitachi information. As each camera supplied one frame containing 3 images per 200 milliseconds, she calculated that 240 images were being supplied to the FRT system per second. On this basis she calculated that the images might arrive in the FRT system faster than it was capable of processing them and a queue would result.
13. Dr Verspoor agreed in cross-examination that on the assumption that only four rather than sixteen CCTV cameras were supplying images in parallel, a significantly smaller number of 60 images would be coming in per second and the FRT system would be processing the images faster than they arrived and those images would therefore not be queued. (Dr Verspoor's agreement on this point was subject to the caveat that she had not been provided with the level of detailed information necessary to establish the precise relationship between the three integers and the overall time it takes to do the processing, which may not be a simple linear function as assumed by the calculation).[30]
14. Bunnings provided expert evidence on the operation of the FRT system from Mr Andrew Thomlinson-Munn, who was employed by Hitachi as a Systems Engineer and Public Safety Solutions Architect between June 2011 and November 2020. He provided written reports dated 1 April 2025 and 23 June 2025. His evidence is that while the FRT system's software allows for a maximum of 16 CCTV cameras, each Bunnings store utilised only three or four CCTV cameras as part of the FRT system.[31] This is also consistent with the information from Hitachi that was provided to the OAIC.[32]
15. We find that four CCTV cameras in each store were supplying images as part of the FRT system during the Relevant Period and the input facial images and Input Vector Sets were present on Bunnings' local server RAM for up to 4.42 milliseconds on average before the matching process was complete and both the unmatched input facial images and Input Vector Sets were deleted by a program instruction.
16. The matched data was treated slightly differently. We accept Mr Thomlinson-Munn's evidence that the matched data was present in the local server's RAM until it was decided whether or not a match existed to an image in the Enrolment Database, up to 4.42 milliseconds on average.
17. We accept that the matched Input Vector Sets were deleted from RAM immediately (within about 4 milliseconds) after the matching process was completed while the matched input facial image was copied to the hard drive. The FRT system then generated an email alert to members of Bunnings' National Investigation Team containing a statement signifying who the individual was, the facial image of that individual that was contained in the Enrolment Database, the facial image taken from the CCTV frame, a 'captured scene' image of the individual in their location in the store, the time and date of entry, the name of the camera and a 'confidence' rating.[33] Mr MacDonald[34] gave evidence that if a match followed by an alert was generated, a human would check to see if it was a match. If it was not found to be a genuine match, then it would be discarded.[35]
18. As conceded by Bunnings, there is no minimum temporal threshold for collection. We do not consider that the speed of the matching process means that the relevant information was not 'collected' by the FRT system, nor that the FRT system undertook some anterior act of deciding whether to collect before collecting. Rather, we consider that the information was collected from persons entering the relevant Bunnings stores and held on the local server's RAM, albeit momentarily, where it was used to execute a matching process comparing it to images on the Enrolled Database.
19. We find that the recording of the information in the local server's RAM was a necessary prerequisite to the matching process and the fact that the unmatched data and the matched data were treated differentially after collection does not alter the fact that a collection of both the unmatched data and the matched data took place.

Whether the Collection was for the Purpose of Inclusion in a Record

1. The Full Court of the Federal Court of Australia held in Facebook Inc v Australian Information Commissioner[36] (Facebook Inc) that the gathering of personal information will not constitute 'collection' if 'all that has happened is a bare act of collection; rather there must be a collection for inclusion in "a record or generally available publication"'.[37]
2. Bunnings contends that the acts performed by the FRT system constituted such bare acts of collection, which lacked the necessary purpose for inclusion in a record. It argues that the FRT system was designed with the intention of excluding unmatched images and all matched and unmatched vector sets from any record, and that the purposive element of the definition of 'collects' is not satisfied where there is a transient holding of information for the purpose of excluding it from RAM.[38]
3. The Commissioner contends that the matching process conducted by the FRT system involved the collection of sensitive information from both matched and unmatched individuals, citing in support of that contention the Full Court's decision in Facebook Inc which held that the definition of 'collects' means that it is possible for an entity to collect information without holding it.[39] Bunnings contends that the Full Court's decision in that regard does not assist the Tribunal, because it refers to the quite different situation where one entity collects information on behalf of another entity who then holds it.
4. We consider that Bunnings did in fact 'hold' the input facial images and Input Vector Sets on its local server's RAM for the time taken to complete the matching process. This is because the Privacy Act provides that an entity 'holds' personal information if the entity has possession or control of a record that contains the personal information.[40] We are satisfied that Bunnings had possession or control of its local server's RAM.
5. We do not accept that the input facial images were collected for the purpose of being excluded from RAM. We find that those images were collected and converted to Input Vector Sets for the specific purpose of holding that information on the local server's RAM in order to undertake a matching process with the persons on the Enrolled Database. It was only after the matching process was complete that the program function deleted the information from the local server's RAM. There is no dispute between the parties that RAM is an electronic or other device constituting a 'record' as that term is defined in the Privacy Act.

1. For the above reasons we are satisfied that Bunnings collected the personal information of both non-enrolled and Enrolled Persons for inclusion in a record. The personal information collected in relation to both groups was the input facial images captured by the CCTV cameras and the Input Vector Sets generated from the input facial images.

ISSUE 1 Sub-issue 2: whether the information collected by Bunnings is 'sensitive information' or merely 'personal information'

1. The terms 'personal information' and 'sensitive information' are each defined in the Privacy Act:[41]

personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

(a) whether the information or opinion is true or not; and

(b) whether the information or opinion is recorded in a material form or not.

...

sensitive information means:

. . .

(d) biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or

(e) biometric templates.

1. There is no dispute between the parties that both the input facial images and Input Vector Sets generated from those images are 'personal information'. Nor is it in dispute that the Input Vector Sets also constitute 'biometric templates' for the purposes of the Privacy Act.[42]
2. At issue is whether the input facial images constitute 'sensitive information', which depends in turn on whether they constitute 'biometric information' that is to be used for the purpose of automated biometric verification or biometric identification. The terms 'biometric information', 'biometric verification' and 'biometric identification' are not defined in the Privacy Act.
3. Bunnings contends that an image of a face is not 'biometric information', because the images are information 'used' for automated biometric verification or identification, but do not themselves satisfy the statutory definition of 'sensitive information'. In particular Bunnings contends that the definition turns on two concepts, firstly whether the information is 'biometric information' and secondly whether it is to be 'used' for the purpose of automated biometric verification or identification.
4. While Bunnings accepts that biometric information can encompass physiological features such as face geometry, it argues that the input facial images are merely 'biometric samples' from which biometric information is drawn or obtained and are not themselves biometric information. It acknowledges that the input facial images were to be used for the purposes of biometric identification or biometric verification but argues that characterising the input facial images as biometric information for this reason gives no work to the word 'biometric' at the beginning of subclause (d) in the definition.
5. Bunnings contends that 'biometric information' should not be construed to capture a mere image of a face without further extrapolation or extraction such as the drawing of facial imagery through a Gabor filter and the generation of a vector set.[43] It contends that the only information capable of being used for the purpose of biometric verification or biometric identification are the Input Vector Sets.
6. We do not accept those submissions. We see no logical reason for distinguishing between 'biometric samples' (a term not used in the Privacy Act) and 'biometric information' in the manner suggested by Bunnings. Nor do we accept that 'biometric information' should be construed in a manner that would restrict it to information that has undergone a further process of extrapolation or extraction such as the application of a Gabor filter, the generation of a vector set or the application of some other mathematical or statistical process.
7. In that regard we consider that the analogy drawn by Bunnings between a facial image and a fingerprint does not assist its argument. Bunnings argues that in order to derive the properties of a fingerprint, the application of various forms of technology - optical, capacitive and ultrasonic scanners - are necessary to obtain the fingerprint from the finger. We do not accept that submission, considering that fingerprints were used for the purposes of biometric identification long before the advent of such technology.
8. Further, we consider that the contention that 'biometric information' requires some kind of extrapolation or extraction of the facial images into a mathematical representation (such as a vector set) to be difficult to reconcile with the inclusion of 'biometric templates' as a discrete category of information included in the definition of 'sensitive information'.[44] In our view the term 'biometric templates' refers to 'biometric information' that has been abstracted into a mathematical representation by the application of technology that applies a mathematical or statistical analysis.
9. We have been referred to the decision of Clearview AI Inc and AIC (Clearview),[45] which relevantly found that while an image of a person's face would not be biometric information in every case, it clearly was in some contexts. The Tribunal, differently constituted, in Clearview gave examples of the relatively recent expansion of the range of biological markers which can now be used to establish identity including fingerprints, DNA, the iris and the face. The Tribunal pointed out that anyone who opens their smart phone by looking at it would be conscious that it is now possible to verify a person's identity simply by showing their face to a camera. We agree with the Tribunal's characterisation of facial images collected by an entity for the purposes of biometric identification as 'biometric information'.
10. We have also been referred to various decisions in comparable jurisdictions, including the Information and Privacy Commissioners of Alberta and British Columbia and the UK First Tier Tribunal in the General Regulatory Chamber. While those decisions grapple with similar issues to those raised in the current review, they arise in different legislative frameworks containing different statutory provisions and they do not assist us to determine the issues in the current review.
11. For these reasons we find that the input facial images captured by the CCTV component of the FRT system constitute 'biometric information' and therefore 'sensitive information' for the purposes of the Privacy Act.

ISSUE 1 Sub-issue 3: whether a permitted general situation existed under s 16A of the Privacy Act

1. APP 3.3 prohibits the collection of sensitive information about an individual unless APP 3.4 applies which includes where a permitted general situation exists in relation to the collection of the information. The permitted general situations are contained in s 16A of the Privacy Act and were introduced by the Privacy Amendment (Enhancing Privacy Protection) Act 2010 (Cth) (Amending Act). Section 16A of the Privacy Act sets out permitted general situations in relation to the collection, use or disclosure of personal information. If a permitted general situation exists, Bunnings is not required to obtain consent to lawfully collect sensitive information using FRT. Bunnings submits that, to the extent it collected any sensitive information, it was entitled to rely on one of the permitted general situations in s 16A of the Privacy Act such that it has not breached APP 3.3. There will be no unlawful interference with the privacy of an individual and no breach of APP 3.3 if Bunnings comes within one of those permitted general situations. APP 3.4 is consistent with the object of the Privacy Act in s 2A(b) to recognise that the protection of the privacy of individuals is balanced with the interests of entities in carrying out their functions or activities.
2. Bunnings' primary claim is that a permitted general situation exists in relation to the collection of personal information in terms of item 2 in s 16A. Bunnings also claims to come within item 1 in s 16A of the Privacy Act. We will consider item 2 first.
3. There are two conditions at item 2 in column 3 of the table in s 16A that need to be satisfied for the permitted general situation to exist:

(a) the entity has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the entity's functions or activities has been, is being or may be engaged in; and > > (b) the entity reasonably believes that the collection, use or disclosure is necessary in order for the entity to take appropriate action in relation to the matter.

4. The focus of this case was on unlawful activity as opposed to misconduct which, from its definition in s 6(1) of the Privacy Act, appears to be directed towards misconduct of employees in the course of their duty. There was no dispute between the parties that unlawful activity in the form of retail crime committed by customers in a Bunnings store relates to Bunnings' functions or activities.

The Evidence of Unlawful Activity in Bunnings Stores

1. Bunnings provided evidence about the nature and extent of the unlawful activity in its stores. This evidence was given by four Bunnings employees, namely the National Investigations and Security Manager, the Head of Loss Prevention in Australia and New Zealand and two store managers. Much of this evidence was not challenged and some of it was reflected in the Statement of Agreed Facts.
2. The Statement of Agreed Facts included data which recorded incidents in Bunnings stores from 1 July 2021 to 31 December 2022 involving threatening or harmful situations including anti-social or threatening behaviour, physical assaults, sexual assaults or harassment and threats of physical harm, death threats, robbery and actual or physical harm.
3. At the hearing, Bunnings relied on witness statements of the two store managers, Shawn Adams and Olivia Tsiaras. They were not required for cross examination and their evidence was not challenged. We accept their evidence as set out below.
4. As Complex Manager of the Box Hill store in the period before Bunnings deployed FRT, Shawn Adams frequently dealt with theft and/or threatening behaviour towards him or his team members. This kind of threatening or abusive behaviour occurred every 2 to 3 days on average and caused team members to be visibly shaken and upset. He was, on a daily basis, extremely concerned for his team members and customers.
5. In her witness statement dated 2 April 2025, Olivia Tsiaras said that in the past year she had witnessed an increase in violent, threatening and aggressive incidents instore at Bunnings Broadmeadows. She estimated an average of approximately one such incident instore each day.
6. A further witness with respect to retail crime was Alexander MacDonald, the National Investigations and Security Manager for Bunnings. In his witness statement dated 28 February 2023, he said that in the 13 years that he has been at Bunnings, he has noticed a significant increase in threatening situations faced by his team and he believes it is currently the worst it has ever been.[46] He provided examples of some of the more serious incidents of instore crime which resulted in physical or psychological harm being inflicted on staff. During the hearing, Bunnings also played video footage of some very serious violent and threatening incidents involving weapons instore.
7. Mr MacDonald also described the financial impact of theft on Bunnings and said that Bunnings was experiencing a significant level of theft particularly in the organised retail crime category, which he explained as being theft or fraud activity with the intent to sell stolen goods for financial gain which has occurred multiple times, at multiple stores and is carried out by two or more individuals. The persons involved in organised retail crime were repeat offenders. He said that financial loss due to organised retail crime theft (repeat offending) amounted to the vast majority of total theft loss for Bunnings as projected for 2018. Mr MacDonald explained that Bunnings has had the practice of issuing a prohibition notice to persons who are no longer welcome in Bunnings stores because they pose a serious threat to the health or safety of team members or customers or they have stolen a minimum amount of stock value.[47]
8. During his employment with Bunnings, Mr MacDonald made and supervised hundreds of investigations into criminal and abusive activity committed in Bunnings stores against staff and customers. These matters included theft, break and enter, assault, indecent assault, robbery and armed robbery. He said that a high proportion of these investigations resulted in the identification of repeat offenders, organised retail criminals and persons who pose a serious risk to the safety of staff or customers.[48] Bunnings created and maintained a database of facial images of these individuals who posed a risk to their operations. It was this database of facial images (the Enrolment Database as defined in [20] of the Statement of Agreed Facts) which was later used as part of the matching process conducted by the FRT system.[49]
9. Ms Deborah Perano was Head of Loss Prevention for Bunnings Australia and New Zealand. In her statement dated 1 March 2023, she gave evidence that Bunnings has calculated that, on average across each financial year, at least 66% of theft loss is attributable to the top 10% of offenders. She considers that the 66% calculation is a conservative estimation of theft loss due to organised retail crime given that it is statistically likely that more than 10% of individuals are involved in organised retail crime.
10. Some of the financial data presented by Ms Perano was undermined on cross examination and was inconsistent with other evidence. For example, the assertion that theft loss increased prior to the introduction of FRT was not supported by the data when additional stores were taken into account. Further, Mr MacDonald accepted that Bunnings was successfully reducing the incidents of theft and stock loss before the introduction of FRT.[50]
11. Irrespective of whether the data of trends was compromised, the evidence from Bunnings' witnesses established that there was a significant level of theft and violence by repeat offenders which included organised retail crime. The evidence from Mr MacDonald and Ms Perano supports a finding that organised retail crime and repeat offending is responsible for the majority of theft loss. Further, the evidence establishes that threatening or abusive behaviour occurred in a Bunnings store every two or three days (according to Shawn Adams) or every day (according to Mr MacDonald and Olivia Tsiaras). The Statement of Agreed Facts referred to a significant number of recorded incidents of a threatening or harmful nature during the Relevant Period.
12. In addition to this lay evidence, Bunnings called expert evidence from Wouter Veugelen who is a security, technology and privacy expert with over 20 years of professional experience. The Commissioner called expert evidence from Dr Tony Zalewski who is a risk management consultant specialising in risk, security and safety. As well as providing individually authored reports, these experts provided a Joint Report in writing dated 18 July 2025 and gave oral evidence to the GAP panel in what is colloquially known as a hot tub.
13. The experts in the Joint Report agreed that there was a level of organised retail crime and serious abuse being perpetrated by repeat offenders that warranted new security controls.[51] The experts in the Joint Report agreed that there is a perception that retail crime and the level of threat to Australian retail organisations has risen over the past 10 to 15 years.[52]
14. The lay and expert evidence supports a finding that Bunnings had a very serious problem with violence and theft being committed by repeat offenders.

The Evidence Relating to Bunnings' Response to the Unlawful Activity

1. Both before and during the Relevant Period, Bunnings faced a very real and serious problem of violence and theft in its stores. Bunnings took this problem very seriously and invested significant resources to deal with security issues. Mr MacDonald supervised a national team of 33 people consisting of 16 investigators, 4 analysts, 7 organised retail crime support coordinators and 6 physical security team members. In addition, there were covert security guards engaged on a full time basis in the Bunnings stores. Mr MacDonald received safety incident reports and serious loss prevention reports from his team. He monitored trends through internal reporting of these incidents.
2. The experts in the Joint Report agreed that, prior to the Relevant Period, it was reasonable for Bunnings to want to investigate new security controls, given the incidents occurring in Bunnings stores:[53]

(a) of organised retail crime and serious abuse; and > > (b) being perpetrated by recidivist offenders.

3. With respect to the action which Mr MacDonald considered was an appropriate response to the retail crime, Mr MacDonald said:[54]

[13] Prior to the introduction of FRT, the action that I wanted Bunnings' team members to be able to take was to monitor and if necessary remove from our stores people who have previously been known to engage in theft or other violent or abusive conduct.

[14] In order to be able to take this action, I regarded it as essential to have a more effective way of identifying repeat or recidivist offenders whenever they entered a Bunnings store in order to take the appropriate action of monitoring and if necessary excluding those persons. As explained further below, I considered that the only effective way of doing this was through FRT.

1. Bunnings initially began investigating FRT in late 2017 as it was the only technology available at the time which was reported as being effective at identifying people in real time. Mr MacDonald believed that FRT would be effective for Bunnings because he was aware that FRT was already being used by counterterrorism agencies, general law enforcement agencies, airports, sports stadiums for identifying banned supporters, student identification in online exams and in smart devices for identification purposes.[55] He went on to say:

[28] As a result of this investigation, I formed the view that Bunnings should implement FRT. My rationale was that if we could identify when a known criminal or aggressive person entered the store, we could take proactive steps to monitor the individual and exclude them from the store before an incident occurred. This would prevent their offending, and the impact of this offending on team members, rather than investigating an incident after the theft or assault had taken place. Furthermore, in many cases, recidivist offenders are the subject of prohibition notices issued to them by Bunnings, so they are committing the criminal offence of trespass as soon as they enter one of our stores. As such, detection by FRT would enable us to take steps to prevent those persons entering our stores.

1. The experts in the Joint Report agreed that the purpose of Bunnings' use of FRT was to identify known recidivists entering Bunnings stores so that incidents of violence and theft could be prevented.[56]
2. Shawn Adams, the Loss Prevention Operations Manager for Bunnings in Victoria, outlined his experience with FRT and described as 'dramatic' the effect of FRT which he observed at the Box Hill store with respect to the identification and management of persons of interest (POIs):[57]

[26] As the Complex Manager, I would receive a call from the national loss prevention team to inform me shortly after a person on the enrolment database was detected as having entered the store. We would then be provided with a description of what the individual was wearing, where they were currently located, whether they had previously been issued with a prohibition notice, and most importantly advice about whether or not to approach the individual. For example, sometimes the person was a violent offender wanted by police, in which case the loss prevention team would call the police and advise us to not engage with the person.

[27] In most cases, after having received a call from the loss prevention team, I would then locate the individual and inform them that they were not welcome in the store. I estimate that 80% of the time individuals would proceed to leave as requested. If the individual escalated the situation, we called the police.

[28] In the day to day performance of my role, I felt greatly reassured by the implementation of FRT.

[29] Compared to the situation before FRT, the use of FRT provided a different experience altogether, as it provided us with an active identification system, meaning that we were no longer reliant on team members remembering the identity of POIs and nor did we feel [sic] to POIs from other areas entering our store and being able to engage in antisocial and criminal conduct.

[30] The use of FRT, in conjunction with our push-to-talk communications system (being the earpiece and accompanying handset or "walkie-talkie" through which team members communicate with each other while on shift) also meant that (in my perception as a manager) the team members felt safer and more secure. FRT ensured we were better equipped to deal with instances of potential theft or threatening behaviour and prevent any potential escalation. The feeling amongst the team was almost celebratory when FRT was introduced, as it provided us with much needed assurance and information before engaging any persons of interest.

1. Mr Adams was not cross examined and his evidence was not challenged. We accept his evidence.
2. We find that Bunnings responded to the significant level of retail crime being perpetrated by repeat offenders by implementing the FRT system so as to identify repeat offenders known to Bunnings for the purpose of monitoring them upon entry to Bunnings stores and preventing them from engaging in further theft or violence.

Item 2 in s 16A: Condition (a) - did Bunnings have reason to suspect unlawful activity?

1. Condition (a) of item 2 of s 16A in the Privacy Act requires Bunnings to have reason to suspect unlawful activity or serious misconduct. The phrase 'reason to suspect' was considered by Rofe J in Provide Nominees Pty Ltd v Australian Securities and Investments Commission.[58] Rofe J was considering whether ASIC had 'reason to suspect' that the plaintiff 'may have ... committed' a contravention of the corporations legislation pursuant to s 13 of the Australian Securities and Investments Commission Act 2001 (Cth). Her Honour said:

A "reason to suspect" in s 13 is a state of mind that falls well short of a belief or a conclusion. ASIC may have "reason to suspect" that a contravention "may have been committed" ... without ever having "form[ed] the opinion" that a contravention "has been committed" (s 16(1)(a)). It does not follow as a matter of logic that if ASIC has not formed an opinion that a serious contravention of a law has been committed, then ASIC could not have, and does not continue to have, a reason to suspect that a contravention may have been committed.

1. The above passage illustrates the relatively low bar needed to satisfy the first condition in item 2 of s 16A of the Privacy Act. Bunnings does not need to establish that it believed that unlawful activity 'has been, is being or may be engaged in' but rather that it had a 'reason to suspect' such activity. However, we note that the distinction between a belief and a reason to suspect is not of importance in this case because the evidence supports a finding that there was in fact unlawful activity. The uncontroverted evidence called by Bunnings from its employees about their experience of retail crime in its stores satisfies condition (a) with respect to item 2 of the permitted general situations in s 16A of the Privacy Act. Not surprisingly, the Privacy Commissioner in the decision under review was satisfied in relation to condition (a). In the proceedings before the GAP, the Commissioner accepted that condition (a) was satisfied and said:[59]

Before and during the Relevant Period, Bunnings had reason to suspect theft, refund fraud, actual or threatened violence and other forms of abusive or threatening behaviour sufficient to give rise to a criminal offence were occurring in its stores.

1. We accept that condition (a) in column 3 of item 2 in the table of s 16A in the Privacy Act is satisfied by the evidence of unlawful activity at Bunnings stores. The evidence rises above the relatively low threshold of providing a reason to suspect unlawful activity. We agree with the findings of the Privacy Commissioner in the Determination as follows:

[111] ... I am satisfied that theft, organised retail crime and refund fraud constituted unlawful activities that related to the respondent's functions and activities in respect of loss prevention. I am also satisfied that actual or threatened violence and other forms of abusive or harassing behaviour that was sufficient to give rise to a criminal offence amounted to unlawful activities related to the respondent's functions and activities to prevent, minimise and address conduct that poses a risk to the health and safety of all individuals in its stores. In addition, unlawful activity in the form of trespass arose when a prohibited person entered the respondent's stores ...

[112] The material provided by the respondent evidences the fact that unlawful activity of this kind had occurred in its stores (to varying degrees) and that the respondent could reasonably suspect that such activity was occurring and would continue to occur. This is evident from the existence of its BNI Team and the fact that the respondent routinely reported on and had other strategies in place to detect, prevent and address stock loss and instore incidents.

Item 2 in s 16A: Condition (b) - did Bunnings 'reasonably believe'?

1. Condition (b) in column 3 of item 2 in the table in s 16A of the Privacy Act provides that the entity reasonably believes that the collection, use or disclosure (of personal information) is necessary in order for the entity to take appropriate action in relation to the matter. It is helpful to consider the separate elements of condition (b) as follows: the entity - reasonably believes - that the collection, use or disclosure - is necessary in order for the entity - to take appropriate action in relation to the matter. However, it is important to consider the two conditions together because the reference to 'the matter' in condition (b) is a reference to the unlawful activity or serious misconduct in condition (a). This means that the 'appropriate action' taken by Bunnings will need to be 'appropriate' in relation to the unlawful activity or serious misconduct. In turn, this will inform the reasonableness of the belief which Bunnings is required to have as to whether the collection is necessary. The concepts are interlinked which means that the reference to unlawful activity in condition (a) must be considered in the context of condition (b) and the reference to 'necessary' and 'appropriate action' in condition (b) must be considered in the context of condition (a).
2. We will separately consider each element of condition (b) before considering it as a whole.

1. The entity is Bunnings which, as a body corporate, forms its beliefs through its senior management staff.[60] In this case, the position and responsibilities of Mr MacDonald,[61] as National Investigations and Security Manager for Bunnings, indicate that he was the 'mind and will' of Bunnings for the purposes of the management of its security issues. It was Mr MacDonald who recommended the use of FRT and oversaw its implementation and operation during the relevant period.

1. The requisite belief must be reasonably held. This imports a notion of objectivity into the consideration of the belief. There must be a reasonable basis for the belief, and not merely a genuine or subjective belief.
2. In George v Rockett,[62] the High Court said with respect to a similar phrase 'reason to believe' as follows:

The objective circumstances sufficient to show a reason to believe something need to point more clearly to the subject matter of the belief, but that is not to say that the objective circumstances must establish on the balance of probabilities that the subject matter in fact occurred or exists: the assent of belief is given on more slender evidence than proof. Belief is an inclination of the mind towards assenting to, rather than rejecting, a proposition and the grounds which can reasonably induce that inclination of the mind may, depending on the circumstances, leave something to surmise or conjecture.

1. In Pfizer Ireland Pharmaceuticals v Samsung Bioepis AU Pty Ltd,[63] Allsop CJ considered the meaning of the words 'reasonably believes' and said:

The relevant question posed by the rule is whether the applicant reasonably believes that it may have the right to obtain relief. It is not whether one scientific view is more or less persuasive than another. In the field of science, expert views may differ about important scientific aspects that can be seen to bear upon a question. If the applicant has a belief that is founded on considerations or views reasonably open (even if contested as incorrect by others) that may well found a conclusion that the applicant has a relevant reasonable belief. On the other hand, if in the application it can be shown that the belief of the applicant appears to be based on considerations or views that are unreasonable, untenable, irrational or baseless, it would be difficult to conclude that the applicant has a reasonable belief. Much will depend on the evidence and the nature of the question in issue.

1. It is not necessary for Bunnings to establish that the collection of sensitive information is necessary in order for it to take appropriate action in relation to the matter; rather, what is required is that, on the balance of probabilities, Bunnings holds a reasonable belief to that effect. This requires consideration of the objective facts and circumstances, as they existed during the Relevant Period, and whether such facts and circumstances were sufficient to induce the belief in a reasonable person.[64]

1. We have found earlier in these reasons that Bunnings' use of FRT involved the collection and use of both personal and sensitive information. By operation of the FRT system, Bunnings collected facial images of as many people as possible who came into the Bunnings stores. Those facial images were converted to an Input Vector Set and then compared to vector sets of Enrolled Persons in the Enrolment Database. Unmatched facial images and vector sets were immediately (after about 4 milliseconds) discarded by the FRT system. If the FRT system produced a match, an alert was generated by email.
2. Leaving aside the technicalities, the FRT system allowed Bunnings to vet the vast majority of store customers against their record of 'problem' customers.

1. There was disagreement between the parties as to the meaning of 'necessary'. The Commissioner contended it means 'essential', rather than 'appropriate and adapted'. The High Court in Lithgow City Council v Jackson[65] said that the word 'necessary' is protean and context-dependent. 'Necessary' is not defined in the Privacy Act but the APP Guidelines define it for the purposes of the permitted general situations as something more than merely helpful, desirable or convenient, but not essential or indispensable. We accept that definition.

1. The phrase 'appropriate action in relation to the matter' requires consideration of the response to the unlawful activity and whether the response was appropriate. Using a sledgehammer to crack a nut is considered inappropriate because it is a disproportionate and excessive response which goes beyond what is needed to solve a problem. This well-known idiom illustrates that the appropriateness of the response will depend on the size or complexity of the problem. In the idiom, cracking a nut is not a large or complex problem and therefore the use of a sledgehammer to address the problem is not necessary and has potentially serious and far-reaching consequences, not only because the nut itself is likely to be destroyed but also because there may be consequences that reach beyond the nut itself.
2. Returning to the terms of condition (b), 'the matter' is a reference to the problem in condition (a) of the unlawful activity. As we have previously said, there is no dispute in relation to the qualification in condition (a) that the unlawful activity relates to the function or activities of Bunnings, but a contested issue of construction remains as to the scope of the matter in response to which Bunnings is taking action.
3. Bunnings contends that the scope of the unlawful conduct should be confined to the problem of the repeat offending including repeated acts of theft, violence or abuse because this was the problem it was attempting to address by introducing FRT. Having confined the problem to repeat offending, Bunnings says that it was an appropriate response to use FRT to identify, monitor and remove Enrolled Persons from its stores because those persons were, based on their past conduct, considered likely to offend again.
4. The Commissioner contends for a broader scope and says that the matter or problem is the unlawful activity in Bunnings stores that relate to its functions or activities. The Commissioner relies on the wording of condition (a) which contains no other qualifications and contends that the unlawful activity should not be confined to repeat offending in the way contended for by Bunnings. The Commissioner contends that using FRT is not appropriate action for numerous reasons including that it is not designed to and does not in fact address the broader issue of unlawful conduct more generally.
5. We reject the Commissioner's contention for a broader scope of unlawful activity not confined to the problem of repeat offending. We find that the unlawful activity in condition (a) is the conduct that Bunnings had reason to suspect exists and in respect of which it wished to respond. It is Bunnings' suspicion in condition (a) and its belief in condition (b) that must be considered. If Bunnings can establish that its suspicion and belief related to a particular kind of unlawful activity then the question of the satisfaction of the conditions in (a) and (b) will be determined on that basis. In that regard, we have made a factual finding that the problem to which Bunnings directed their response was the problem of retail crime by repeat offenders engaged in theft, violence or abuse. It is not a question of giving the unlawful activity a broad scope as a matter of statutory interpretation, but rather it is a factual question as to what the relevant unlawful activity is.
6. The Commissioner's concerns about this approach are unwarranted because Bunnings will still need to establish that its response to the issue of repeat offenders was appropriate which includes a consideration as to whether it was a proportionate response, ie that the use of FRT to surveil every person entering a Bunnings store was proportionate to the benefit of dealing with the problem of the repeat offenders.
7. Ultimately, the question as to whether condition (b) is satisfied depends upon Bunnings establishing the requisite reasonable belief. As discussed earlier in these reasons, the consideration of reasonable belief involves what Bunnings subjectively believed being assessed against what a reasonable person would believe taking into account all the objective facts and circumstances. It is Bunning's belief as to what action was appropriate to take that is relevant. The starting point is to consider the evidence as to what Bunnings believed was appropriate action and then to consider whether the objective facts and circumstances were sufficient to induce that belief in a reasonable person.

1. The first question in terms of condition (b) is whether Bunnings held a belief (reasonable or not) that using FRT was necessary in order to take appropriate action. Bunnings' belief was expressed through the evidence of Mr MacDonald.
2. Mr MacDonald gave evidence in his written statement that, prior to the introduction of FRT, he wanted Bunnings to be able to monitor and if necessary remove from Bunnings stores people who had previously been known to engage in theft or other violent or abusive conduct.[66] Mr MacDonald considered it to be of the utmost importance to take all available action to be able to reduce or prevent violence towards his team members as well as theft.[67] In order to be able to take this action, Mr MacDonald regarded it as essential to have a more effective way of identifying repeat or recidivist offenders whenever they entered a Bunnings store in order to take the appropriate action of monitoring and if necessary excluding those persons. Mr MacDonald considered that the only effective way of doing this was through FRT.[68]
3. Under cross examination, Mr MacDonald confirmed that he wanted to take all possible steps to try to reduce theft and incidents in stores[69] and that he thought it necessary to adopt FRT.[70] He said that before implementing FRT, Bunnings' security system was not adequate or totally effective and that there were other available measures that were more effective than what was in place.[71] He described FRT as the first line of defence.[72] He did not believe that Bunnings could have taken any appropriate actions other than FRT in order to proactively prevent acts of theft or acts of violence and aggression.[73] He accepted that there were limits on the effectiveness of FRT. He accepted that the vast majority of security incidents were perpetrated by persons not on the Enrolment Database.[74] He accepted that even amongst those on the database, FRT was ineffective when someone wore a facemask or covered their face. Whilst accepting these limitations, Mr MacDonald steadfastly maintained that FRT was necessary to combat repeat offenders who represented a significant proportion of theft and other unlawful activity.[75]
4. Mr MacDonald's significant experience with respect to retail security was not challenged. We accept his evidence as to the belief that Bunnings held about the appropriate action needed to deal with the level of retail crime in Bunnings stores. He believed that FRT and the associated process of identifying, monitoring and potentially removing people from its stores was necessary in order to take appropriate action in response to retail crime by repeat offenders. His belief was genuinely motivated by a desire to protect Bunnings staff and customers from abusive, aggressive or violent conduct and to prevent or reduce the level of retail crime more generally in Bunnings stores.

1. Relevant to the reasonableness of Bunnings' belief is the nature of the crime being committed and the impact of that crime on Bunnings and its staff and customers. We consider that it was reasonable for Bunnings to take action in response to violence and abuse because of the significant impact it had on staff and customers. With respect to theft, it was reasonable to take action because it was criminal activity that significantly affected the profits of Bunnings. We have found that there was a serious problem with retail crime in Bunnings stores and that a significant component of that crime was committed by repeat offenders. The nature of the unlawful activity and its impact will inform the appropriate action to be taken in response. In this regard, the APP Guidelines address the term 'appropriate action' in the context of the permitted general situation at issue:[76]

Whether action is 'appropriate' will depend on the nature of the suspected unlawful activity or misconduct and the nature of the action that the APP entity proposes to take. Appropriate action may include investigating an unlawful activity or serious misconduct and reporting these matters to the police or another relevant person or authority. For example, if an entity reasonably believes that it cannot effectively investigate serious misconduct without collecting, using or disclosing personal information, this permitted general situation may apply.

1. The experts in the Joint Report agreed that, prior to the Relevant Period, it was reasonable for Bunnings to want to investigate new security controls targeting recidivist offenders, given the incidents occurring in Bunnings stores being perpetrated by recidivist offenders.[77] Dr Zalewski said in his oral evidence that he could not disagree with Mr Veugelen's conclusion that it was reasonable for Bunnings to believe that it was necessary to introduce security controls with the objective of preventing known repeat offenders from engaging in theft and serious physical or violent abuse. Dr Zalewski said:[78]

It's reasonable ... something had to be done, I would think, from the perspective of safety for all staff; something had to be done.

1. Bunnings understood the limitations of FRT and that it could not resolve wider issues of first time offending and that, even with respect to repeat offenders, it could not prevent all repeat offences. Nevertheless, Bunnings believed that there were real benefits in what FRT could and did achieve. The reasonableness of that belief is a matter for the Tribunal to determine based on the objective facts and circumstances. The opinions of the experts will be relevant to the reasonableness of the belief. The benefits of the FRT system will need to be weighed against the privacy intrusions inherent in the FRT system.
2. As to whether Bunnings' belief was reasonable, it is helpful to consider the following three relevant factors:

(a) whether the collection of sensitive information using FRT was a suitable and effective response to the problem of repeat offenders (Suitability); > > (b) whether less privacy-intrusive alternatives were available to address that problem (Alternatives); and > > (c) whether the collection of sensitive information using FRT was proportionate, which involves balancing the privacy impacts resulting from the collection of sensitive information against the benefits gained by using FRT to collect sensitive information (Proportionality).

1. It is self evident that to have an effective matching process the FRT system needed to be able to survey the facial features of persons entering Bunnings stores so as to match them with the known offenders on the Enrolment Database. We consider that the collection of sensitive information by the FRT system was effective for that limited technical purpose, but the wider and more relevant question is whether the matching process achieved by the use of FRT was effective in dealing with repeat offenders who engaged in violence and theft.
2. The Commissioner contends that Bunnings did not systematically measure the effectiveness of the FRT system during the Relevant Period and that Bunnings relied on often highly generalised and anecdotal evidence of the frequency of incidents in its stores. We accept that for Bunnings to establish a reasonable belief, it requires probative evidence to support its contention about the effectiveness of FRT to combat repeat offending. However, we remind ourselves of the words from the High Court in George v Rockett quoted earlier in these reasons which included that:[79]

... the assent of belief is given on more slender evidence than proof. Belief is an inclination of the mind towards assenting to, rather than rejecting, a proposition and the grounds which can reasonably induce that inclination of the mind may, depending on the circumstances, leave something to surmise or conjecture.

1. The FRT system installed by Bunnings was designed to identify known offenders and to alert staff at Bunnings of their presence in a store for the purpose of preventing repeat incidents of violence and theft. The experts in the Joint Report agreed that challenging an individual who has not yet engaged in theft is generally less likely to result in confrontation or violence than challenging an individual who is already handling stolen goods.[80] This is a clear benefit of the FRT system because it provides a proactive measure as opposed to a reactive one.
2. The process of identification was not entirely effective because it would not work if the facial features of a person entering the store were obscured by, for example, a face mask or balaclava or obscured by another person. Nevertheless, the process of matching a person entering a store with a person in the database of known offenders generated a significant number (in the high hundreds) of alerts during the Relevant Period and the experience of the staff at Bunnings was that the FRT system was very effective.
3. Mr MacDonald explained in his witness statement that it is in the nature of an effective prevention system that it is difficult to give examples of the success of the system other than to describe situations in which matched individuals were removed from stores without incident. He provided 11 examples of this in his statement including the following four examples:

(a) On 19 March 2019, a person was identified through a facial recognition alert at Bunnings Hoxton Park. A team member sought to assist this person who then left the store without incident. The person had a long history of offending against Bunnings dating back to 2011. > > (b) On 20 May 2019, a person was identified through a facial recognition alert at Bunnings Bayswater. A team member sought to assist this person who then left the store without incident. The person was a well-known recidivist offender and had previously assaulted team and security guards by pushing them out of the way and making threats during the commission of robberies within Bunnings. > > (c) On 7 November 2020, a person was identified through a facial recognition alert at Bunnings Lidcombe. The store leadership was immediately contacted after the alert was raised and the attempted purchase of stock to the value of $3899 using a fraudulent account was declined. > > (d) On 21 May 2021, a person was identified through a facial recognition alert at Bunnings Hoppers Crossing. Police were notified. The store was contacted and told not to approach the person. The person had a long history of offending against Bunnings previously being involved with a siege with police and climbing onto the roof of Bunnings Nunawading in 2014 following a burglary. The person was apprehended by police and subsequently charged and convicted of committing 20 burglaries in Bunnings stores.

4. Mr MacDonald was involved in the implementation of educational programs at Bunnings that dealt with how to de-escalate threatening situations, steps to take if a team member is the subject of a threatening situation, reporting of incidents and steps to provide care and support to the team following an incident. Through his participation and feedback in these sessions, he was impressed with how comforted the Bunnings staff felt by having FRT in operation. He said that it made them feel safer and more secure in the workplace.[81]
5. Shawn Adams described in his witness statement how the use of FRT meant that Bunnings staff felt safer and more secure:

[30] ... FRT ensured we were far better equipped to deal with instances of potential theft or threatening behaviour and prevent any potential escalation. The feeling amongst the team was almost celebratory when FRT was introduced, as it provided us with much needed assurance and information before engaging with any persons of interest.

1. Olivia Tsiaras said in her witness statement that the FRT system made her feel safer and more comfortable at work because she believed it would help prevent incidents of violent, threatening or intimidating behaviour. She gave evidence about the team members at Bunnings Broadmeadows who said that they would feel safer if the FRT system was still in place.
2. We find that Bunnings staff had good reason to feel safer because, as stated by Mr MacDonald, the FRT system was effective:

[50] My evidence of the effectiveness of FRT is primarily based upon my lived experience performing my role before and after implementation of FRT. On that basis, I say that FRT was extremely effective in assisting me and my team to keep our employees and customers safe, to keep violent people and ORC offenders out of stores, to reduce incidents of assault, and to reduce stock loss and theft.

1. The Commissioner relies upon data and empirical evidence to challenge the effectiveness of FRT. The data in the Statement of Agreed Facts and in Ms Perano's statement shows that only a very small percentage of alleged offenders were Enrolled Persons and that only a very small percentage of incidents were committed by Enrolled Persons. The Commissioner contends, therefore, that Bunnings could only rely on the FRT system to take action in respect of unlawful activity or serious threat situations on a relatively small number of occasions and in respect of a relatively small number of individuals. Further, there is no guarantee that repeat incidents would have been avoided by the use of FRT because it is ineffective if the facial features of a person entering the store were obscured by, for example, a face mask or balaclava or obscured by another person.
2. Nevertheless, we consider that these relatively small percentages should not diminish the significance of the benefit of potentially avoiding serious incidents through the use of FRT. Bunnings has provided examples of the success of the FRT system by describing situations in which matched individuals were removed from stores without incident. The number of matched individuals is not insignificant. Mr MacDonald said:

[49] From my experience managing the teams which relied on the technology on a day-to-day basis, FRT was invaluable in our efforts to prevent and/or reduce crime. We had over [number redacted] positive matches during the period that FRT was in use and the vast majority of those cases we were able to take appropriate action by removing the matched individuals from stores or monitoring that individual closely using a combination of CCTV and instore team members.

1. Further, there is the evidence from Mr MacDonald and Ms Perano that repeat offenders committing theft and violence were responsible for significant instore criminal offending. The collection of sensitive information by use of the FRT system was effective because it was designed to identify known offenders who were part of the cohort responsible for significant retail crime in Bunnings stores.
2. The evidence from Bunnings' lay witnesses in relation to the effectiveness of FRT is supported by the expert evidence from Dr Daniel Bunting. He specialises in statistical analysis and modelling. He provided a report for Bunnings dated 1 March 2023. He was not required for cross examination and his opinions were not directly challenged.
3. First, Dr Bunting benchmarked Bunnings theft numbers relative to the theft numbers for the industry at large using Australia New Zealand Retail Crime reports for 2019 and 2022. Bunnings was 46% worse than the industry benchmark in the report for 2019 but by 2022 Bunnings had improved to be 6% better than the industry benchmark. Dr Bunting concluded that between 2019 (when FRT had only just been introduced and its impact could be assumed to be low) and 2022, Bunnings significantly reduced instore theft which was against the trend and sentiment in the industry.
4. Dr Bunting then compared theft in those Bunnings stores which had FRT with the theft in Bunnings stores without FRT during the Relevant Period. He opined that the introduction of FRT in November 2018 significantly reduced the level of theft in Bunnings stores. Using statistical tools to estimate the impact of FRT on theft, he found that FRT was effective, reducing theft by around 13%.
5. Dr Bunting further opined that his assessment of the data provided by Bunnings demonstrated that there were significantly fewer serious incidents (robbery, burglary, assault and harassment) in the Relevant Period in stores that did have FRT than in stores that did not have FRT. Relying on the data from the Relevant Period, he said that there is a significant difference between incidents in stores that never had FRT and those which did have FRT.
6. Dr Bunting expressly qualified his opinions because of various limitations, but no contrary expert opinion was provided and his opinions were not challenged under cross examination. Further, Dr Bunting's opinions are consistent with and provide support for Bunnings' evidence from its lay witnesses about the effectiveness of FRT.
7. We accept that the FRT system did generate some false positive matches but they were manually reviewed by a member of the Bunnings National Investigations team.[82] Mr MacDonald gave evidence that Bunnings' previous process for detection and prevention of repeat offending in its stores (being a manual alert and identification system involving team members receiving security alerts and remembering the details and images of persons suspected of committing offences) also resulted in false identifications.[83]
8. Mr MacDonald gave evidence that if a match followed by an alert was generated, a human would check to see if it was a match. If it was not found to be a genuine match, then it would be discarded. Mr MacDonald accepted in cross examination that there was a risk that false positive matches would be generated, but he thought it was adequately mitigated by the human intervention before any action was taken.[84]
9. In re-examination, Mr MacDonald clarified that the automated FRT system did generate some false positive matches but, upon receiving the alert, a human would check the match and recognise it as a false positive match and therefore take no action.[85] He gave evidence that he was aware of the literature concerning the risk of false positives being skewed in respect of non-white and non-male subjects, but that he saw every alert and false positive that came through and it was not his experience that there were a high number of false positives for any non-white population or racial group. Rather he observed that the false positives resulted from the quality of the enrolment image.[86] Mr MacDonald went further and said that he was not aware of any instance where a false positive was acted on incorrectly.[87]
10. We find that this human intervention added to the effectiveness of the FRT system and adequately mitigated the risk of acting on a false positive.
11. Bunnings contended that the implementation of FRT caused a reduction in incidents of theft and violence in its stores. It is difficult to test cause and effect on an empirical basis but as a matter of logic one would assume that the implementation of FRT would do so and the expert evidence of Dr Bunting together with the evidence from Bunnings lay witnesses suggest that it did. Moreover, the impact of FRT and its suitability should not just be measured on an empirical basis but should be considered by reference to the wider benefits felt by staff.
12. Bunnings' reasonable belief is supported by the fact that there were a significant number of matches and alerts sent during the Relevant Period. Further, it is noteworthy that as more offenders become known to Bunnings they would be added to the Enrolment Database. This dynamic nature means that the FRT system will become more effective over time.
13. We find that collecting sensitive information by the use of FRT in conjunction with the other security controls was effective and suitable to identify known offenders and if necessary to monitor them so as to reduce the likelihood of them engaging in theft or violent or threatening behaviour.

1. Prior to the introduction of FRT in November 2018, Bunnings had systems in place for detection and prevention of crime in stores which included CCTV, covert security guards, prohibition notices and a system of security alerts so that Bunnings team members and covert loss prevention officers could keep a lookout for offenders depicted in these alerts.[88] Mr MacDonald considered that this manual identification and alert system was and still is an unsatisfactory and ineffective way of proactively identifying known offenders when they enter a Bunnings store.[89]
2. Before, during and after the use of FRT, Bunnings had in place what Mr MacDonald described as standard security measures which he considered provided an adequate level of protection against opportunistic theft, but did not provide an adequate level of protection against organised retail crime.[90] He considered that the prior measures in place were somewhat effective but that there were measures that were more effective than what was in place.[91] When it was put in cross examination that there were alternatives to FRT, Mr MacDonald said that he did not believe that Bunnings could have taken appropriate actions to proactively prevent acts of theft or acts of violence and aggression.[92] Mr MacDonald said in his statement that Bunnings did consider alternatives, in particular, those directed towards threat and theft incidents that had been implemented elsewhere with limited success.[93] After giving due consideration to those alternatives, Bunnings commenced a trial of the FRT system in one of its stores. Ultimately, Mr MacDonald considered that the use of FRT was the only effective way of identifying repeat offenders in order to take action of monitoring and if necessary excluding those persons.[94]
3. Mr MacDonald's evidence about the effectiveness of available alternatives was supported by Mr Veugelen who considered relevant alternate security controls for identifying repeat offenders at chapter 6.5 of his report. He considered relying on instore staff to identify known repeat offenders, CCTV cameras and live human monitoring, covert security guards, non-covert security guards and various antitheft devices, and concluded that there were no alternate security controls available to Bunnings which were also likely to effectively and consistently identify repeat or recidivist offenders whenever they entered Bunnings stores, such that Bunnings staff were afforded an opportunity to take appropriate action and prevent theft and serious physical or verbal abuse from occurring. Dr Zalewski disagreed and said that there were alternatives which if used in conjunction with FRT would be an enhancement to the existing system, but that FRT on its own was not the total answer.[95] Mr Veugelen agreed that the best security environment would employ a number of alternative controls, some of which he noted Bunnings was already utilising, but considered that FRT was an effective control complementing what Bunnings already had in place.[96]
4. We prefer Mr Veugelen's opinion. In terms of efficiently identifying known offenders, we find that there was no comparable alternative to the FRT system which we note was used in conjunction with what Mr MacDonald described as standard security measures.[97] FRT is far more effective than a human monitoring CCTV images and trying to match persons entering the store to facial photographs held by Bunnings. We accept Mr Veugelen's opinion in his report that FRT becomes significantly more effective in large crowds, with people coming and going, over long periods of time, and where there is a large list of known faces to detect.[98] In his oral evidence he said that the number of repeat offenders recorded by Bunnings was in the hundreds and that if staff at Bunnings stores needed to memorise all those photos of these individuals, it is highly unlikely that they would be able to effectively and consistently identify those persons as they enter stores and be able to respond to them.[99]
5. While the Privacy Commissioner's Determination frames this matter in terms of the use of FRT in retail settings,[100] we consider that the security environment in which Bunnings operates is significantly different from that of most other retailers. Bunnings faces unique challenges when attempting to prevent theft and threatening situations because of the size of its stores, with multiple entry and exit points together with the fact that a customer can drive their vehicle into the store. Further, many of the products on sale at a Bunnings store can be used as a weapon, such as an axe, a screwdriver or a drill, and are readily accessed by persons in those stores. Bunnings necessarily treats the safety of its staff and customers very seriously. The introduction of FRT and its inherent collection of sensitive information was a genuine attempt by Bunnings to improve staff and customer safety. Consideration was given to alternatives which were investigated, but Bunnings reasonably decided that those alternatives without FRT did not provide adequate protection against repeat offenders. We conclude for the purpose of assessing whether Bunnings held a reasonable belief with respect to the use of FRT that there was no effective alternative. The reason why FRT was effective was because it could survey the facial features of nearly every person who entered a Bunnings store. Less privacy-intrusive alternatives could not achieve the same outcome in terms of dealing with repeat offenders. No other security control could identify repeat offenders in the way that FRT did for the purposes of monitoring them and preventing further offending.

1. Whether the collection of sensitive information by use of the FRT system was proportionate involves balancing the privacy impacts resulting from the collection of the sensitive information against the benefits by the use of the FRT system. This brings to mind the previously mentioned idiom of a nut being cracked by a sledgehammer.
2. The Commissioner downplays the benefits of FRT and highlights its limitations. We accept, as did Bunnings, that FRT is ineffective with respect to instore retail crime committed by persons not on the Enrolment Database. It can only have a potential impact on repeat offenders on that database, but even amongst that limited cohort it will not be effective if the facial features of a person entering the store were obscured by, for example, a face mask or balaclava or obscured by another person.
3. Bunnings accepts that FRT only has benefits with respect to repeat offenders on the Enrolment Database but says that those benefits are nevertheless very significant because these known offenders are responsible for much of the retail crime being committed in Bunnings stores. Under the heading of Suitability earlier in these reasons, we have set out the benefits of FRT in coming to the conclusion that it was suitable and effective.
4. With respect to privacy impacts, the Commissioner, quite appropriately, places very significant weight on the fact that by using FRT Bunnings collects the sensitive information of almost every person who enters their stores. In the decision under review the Privacy Commissioner said that the use of the FRT system 'involved the wholesale and indiscriminate collection of personal information that also constituted sensitive information'. We accept that this represents a serious intrusion of privacy, but we note that the Privacy Act allows for sensitive information to be collected (and hence privacy to be intruded upon) if it can be justified pursuant to the permitted general situations in s 16A of the Privacy Act. The weighing up of these competing factors lies at the heart of this matter.
5. In terms of assessing whether Bunnings held a reasonable belief with respect to the use of FRT, it is relevant that Mr MacDonald recommended the Hitachi FRT system in part due to its 'privacy by design approach'. He explained:

[33] ... I understood this to mean that the Hitachi system did not store any data of non-matched individuals because the system permanently deleted such data almost immediately after the individual's image was captured at the entry point and the system had run the match. I derived this understanding and belief from instructions I was given by Hitachi personnel who tested the system. This was an important factor in my recommendation of the system and I believed (and still believe) that it protects the privacy of non-matched individuals.

1. The understanding of Mr MacDonald is broadly correct because the Input Vector Set (derived from the facial image on CCTV) is deleted within about 4 milliseconds. Despite being deleted almost instantly, we have found earlier in these reasons that the FRT system nevertheless collected sensitive information for inclusion in a record. The speed within which the Input Vector Sets were deleted did not mean that they were not collected for inclusion in a record for the purposes of APP 3.3. However, there are features of the operation of the FRT system which we consider are relevant to the issue of Bunnings' reasonable belief.
2. The data consisting of the Input Vector Sets was loaded into the random access memory (RAM) on the local server at the relevant store and retained for only about 4 milliseconds. The comparison of an Input Vector Set to the Enrolled Vector Sets (ie the matching process) took place in the RAM within that short time frame. Andrew Thomlinson-Munn, in his witness statement of 1 April 2025 as corrected by his statement of 23 June 2025, explained the process further:[101]

[18] After the matching process had completed, the Input Vector Set was discarded immediately. This occurred by the system giving an instruction that the Input Vector Set was not required to be stored or saved in any form of computer memory and could be overwritten. Input Vector Sets were not copied to or stored on a hard drive.

[19] Based on my involvement in the design of the FRT system, I say that the system is not designed to store or retain the Input Vector Sets to enable them to be retrieved after the matching process has been completed. Instead, the Input Vector Sets are continuously discarded. For this reason, the FRT system involves practically the least handling of an Input Vector Set that could occur in order for the matching process to function.

[20] If an Input Vector Set was matched against an Enrolled Vector Set, the still facial image that was used to create the matched Input Vector Set was copied to a hard drive connected to the local server in the Bunnings store where the match occurred. An alert email was also sent to a Bunnings team member to enable the team member to direct Bunnings' response.

1. It is relevant that the matching process occurs in RAM and not on the hard drive. RAM is the short-term memory of the computer where data and instructions are loaded temporarily. RAM is known as volatile memory. Data stored in RAM will be cleared upon instruction (in this case within about 4 milliseconds) or when the power is turned off.[102] We note that the definition of 'collects' in the Privacy Act requires that there is collection 'for inclusion in a record'. In this case, the record is in the RAM, but the record only exists momentarily.
2. The evidence from the Commissioner does not suggest that the information held temporarily in the RAM on the local server was vulnerable to cyber-attack or being on-sold to third parties. The parties agree that it was not possible to regenerate a facial image from a vector set during any part of the Relevant Period.[103] The FRT system was designed so that after the matching process was complete, the information was deleted and there was no means of retrieving the information from the RAM.[104] The permanent deletion of sensitive information from the RAM was an important factor for Mr MacDonald when deciding to install the FRT system. It was reasonable for Mr MacDonald to take that into account. Another positive feature of the FRT system is that it only needed to hold the sensitive information for about 4 milliseconds before deleting it - the shorter the period for which it was held, the less likely it was that there would be misuse.
3. Mr Veugelen considered there to be a low probability that a cyber threat actor could compromise the FRT system and gain access to the Input Vector Sets held momentarily by the system. He said that compromising the FRT system would involve numerous steps which would be extremely difficult, even for highly sophisticated threat actors.[105] He noted that Bunnings also took reasonable steps to limit access to the FRT system to six persons across the entire Bunnings organisation.[106] Mr Veugelen's opinion of there being a low risk of a successful cyber-attack was not challenged and we note that counsel for the Commissioner in closing said that whilst there is always a risk of misuse when information is collected, he did not submit that the risk was particularly acute in this case as to constitute concrete harm.[107]
4. In all the circumstances, we find that the risk of misuse of sensitive information on the FRT system was negligible and that Bunnings took reasonable steps to minimise that risk. Further, we find that the advanced technology in the FRT system limited the impact on privacy so as not to be disproportionate when considered against the benefits of providing a safer environment for staff and customers in Bunnings stores.

1. Whilst we have considered the differing views of the parties and the evidence presented by them in relation to suitability, alternatives and proportionality, the relevant question for the Tribunal is not whether one view is more or less persuasive than another.[108] Rather, the question for the Tribunal relates to whether Bunnings reasonably believed that the collection of sensitive information through the use of FRT was necessary in order for Bunnings to take appropriate action in relation to instore violence and theft by repeat offenders. If Bunnings' belief is founded on considerations or views reasonably open (even if contested as incorrect by others), that may well found a conclusion that it has a relevant reasonable belief.[109]
2. In our view, the objective evidence demonstrates that it was reasonably open to Bunnings to believe that it had a problem with respect to repeat offenders that needed to be addressed. Given that FRT enabled Bunnings to identify persons who have previously offended in a way that no other security control could, it was reasonably open to Bunnings to implement an FRT system for the purpose of identifying and monitoring those persons so as to reduce further offending and provide protection to its staff and customers. Retail crime in the nature of violence and theft is a very serious issue for Bunnings and it was entitled to take action in response. We recognise and respect the view that this involves a significant intrusion into the privacy of individuals, but the effect of the technology in the FRT system minimised the intrusion by ensuring that the sensitive information was only momentarily held and that it was thereafter permanently deleted and unable to be accessed. Further, the wording of the legislation clearly places an emphasis on whether Bunnings reasonably believes that the collection of personal information was necessary in the circumstances. We have reached the view that Bunnings held the belief that using FRT was necessary and we find that this was a reasonable belief to have based on the objective circumstances.

Item 1 in s 16A: condition (a) and (b)

1. There is a significant overlap with respect to the evidence needed to satisfy item 2 and item 1 in s 16A of the Privacy Act. Both parties considered it unnecessary to separately analyse how item 1 should apply to the facts. Rather, they treated their contentions on item 1 as hinging largely upon their contentions made in respect of item 2.[110] We accept that our analysis of the evidence and respective contentions in relation to item 2 apply equally to item 1. It is therefore not necessary to repeat that analysis. Further, we note that because we have found that there is a permitted general situation under item 2, it is not necessary for us to consider whether there is a permitted general situation under item 1. In any event we make some brief comments as follows in relation to item 1.
2. Condition (a) in column 3 of item 1 in s 16A of the Privacy Act was not in dispute between the parties. It was agreed that it was unreasonable or impracticable to obtain individuals' consent to the collection, use or disclosure of their personal information. We find that condition (a) is satisfied.
3. Condition (b) requires Bunnings to establish that it reasonably believed that the collection of personal information through the FRT system was necessary to lessen or prevent a serious threat to life, health or safety of an individual, or to public health or safety. We find that the evidence of retail crime considered above in relation to item 2 in s 16A of the Privacy Act establishes that there was a serious threat of that nature. The fact that customers and staff were subjected to violence or intimidation establishes that there was a serious threat to their safety. The Commissioner agrees that a serious threat situation arose in respect of incidents in Bunnings stores involving:[111]

(a) weapons, including knives, tools, syringes and firearms; > > (b) acts of physical violence or aggression that could cause serious physical or psychological harm; or > > (c) death threats or other threats of violence that could cause serious psychological harm or, to the extent they could be reasonably carried out, the risk of serious physical harm.

4. Mr MacDonald and the two store managers gave evidence of the serious threat to the safety of Bunnings staff and customers because of the prevalence of retail crime.
5. The subjective belief that the collection of personal information was necessary to lessen or prevent a serious threat is established through the evidence of Mr MacDonald. The evidence of Mr MacDonald's subjective belief in relation to item 2 is relevant to and satisfies the subjective belief element in item 1. Mr MacDonald believed that the implementation of FRT would prevent offending by those repeat offenders known to Bunnings. He believed that FRT was necessary to prevent serious threats to safety posed by Enrolled Persons because the FRT system could effectively identify, monitor and, if necessary, remove repeat offenders from Bunnings stores when used as part of a comprehensive security system.[112]
6. Bunnings' belief was reasonable because it is supported by the objective facts and circumstances set out earlier in these reasons in relation to item 2 in s 16A of the Privacy Act. When FRT was being used, Bunnings staff felt safer and more secure because the FRT system was effective in reducing retail crime.
7. We find that the permitted general situation in item 1 exists for the purposes of s 16A of the Privacy Act.

Conclusion as to Whether a Permitted General Situation Existed

1. We have found that there was no breach by Bunnings of APP 3.3 because APP 3.4 applies and a permitted general situation exists in relation to the collection of personal information by the FRT system during the Relevant Period. The use of FRT by Bunnings during the Relevant Period was not contrary to APP 3.3.
2. We now turn to consider the other Australian Privacy Principles which apply because Bunnings collected personal and sensitive information from individuals entering their stores.

ISSUE 2: Australian Privacy Principle 5.1 (APP 5.1)

1. Having found that there has been a 'collection' of sensitive information of matched and non-matched individuals using the FRT system, it is necessary to consider whether APP 5.1 was contravened. APP 5.1 is concerned with whether Bunnings took steps, as were reasonable in the circumstances, to notify individuals of the collection of personal information and otherwise ensure that individuals were aware of the matters contained in APP 5.2.
2. APP 5.1 provides that:

5.1 At or before the time or, if that is not practicable, as soon as practicable after, an APP entity collects personal information about an individual, the entity must take such steps (if any) as are reasonable in the circumstances:

(a) to notify the individual of such matters referred to in subclause 5.2 as are reasonable in the circumstances; or

(b) to otherwise ensure that the individual is aware of any such matters.

1. APP 5.2 identifies the matters for the purposes of APP 5.1 as follows:

(a) the identity and contact details of the APP entity;

(b) if:

(i) the APP entity collects the personal information from someone other than the individual; or

(ii) the individual may not be aware that the APP entity has collected the personal information;

the fact that the entity so collects, or has collected, the information and the circumstances of that collection;

(c) if the collection of the personal information is required or authorised by or under an Australian law or a court/tribunal order - the fact that the collection is so required or authorised (including the name of the Australian law, or details of the court/tribunal order, that requires or authorises the collection);

(d) the purposes for which the APP entity collects the personal information;

(e) the main consequences (if any) for the individual if all or some of the personal information is not collected by the APP entity;

(f) any other APP entity, body or person, or the types of any other APP entities, bodies or persons, to which the APP entity usually discloses personal information of the kind collected by the entity;

(g) that the APP privacy policy of the APP entity contains information about how the individual may access the personal information about the individual that is held by the entity and seek the correction of such information;

(h) that the APP privacy policy of the APP entity contains information about how the individual may complain about a breach of the Australian Privacy Principles, or a registered APP code (if any) that binds the entity, and how the entity will deal with such a complaint;

(i) whether the APP entity is likely to disclose the personal information to overseas recipients;

(j) if the APP entity is likely to disclose the personal information to overseas recipients - the countries in which such recipients are likely to be located if it is practicable to specify those countries in the notification or to otherwise make the individual aware of them.

1. Bunnings submits that even in circumstances where there was a 'collection' of sensitive information of non-matched individuals through the use of the FRT system, APP 5.1 was not contravened and it took the steps that were reasonable in the circumstances to notify individuals of the matters referred to in subclause 5.2, or otherwise ensure that the individuals were aware of any such matters.[113]
2. Bunnings relies on various notices that were displayed during the relevant period. In the Statement of Agreed Facts between the parties, the parties agree as to the content of the notices for the relevant periods as follows:[114]

(a) The first entry notice which was displayed between 6 November 2018 and 4 May 2021, relevantly stated:

We reserve the right to inspect all bags or vehicles on exit.

(b) A privacy poster was displayed at various places in relevant stores from March 2020, and relevantly stated:

At Bunnings, there is a reason we collect data from our customers. We want you to ensure you have the best experience possible, every time you shop with us, whether in-store online.

So what data are we talking about? Usually this includes your name, delivery address or contact details. It could also include any information we collect when you visit our stores, website or app. These details help us complete a transaction with you, make our advertising more relevant and tailor your shopping experience. In some cases, we may also share the information with our parent company Wesfarmers and its other businesses.

What we won't do with your data is use it to fill your inbox with irrelevant or unwanted spam or sell your data to anyone else. That's a promise.

Now here's the official bit. Keeping your personal information safe and secure is our priority.

You also have rights. So if you want to access your data or provide feedback on how we're using your personal information please email us at [email address].

Need more information about how we collect, use, store or disclose personal information, or like to read our privacy policy? Visit [website].

(c) The second entry notice, which replaced the first entry notice, was implemented between 5 May 2021 and 30 November 2021, and was displayed with the privacy poster described above and relevantly stated:

Video surveillance, which may include facial recognition, is utilised.

We reserve the right to inspect all bags and vehicles on exit.

Was it reasonable in the circumstances for Bunnings to take steps to notify or otherwise ensure individuals were aware of APP 5.2 matters?

1. APP 5.1 imposes an obligation on an entity to take such steps, if any, as are reasonable in the circumstances to notify individuals or ensure awareness of the APP 5.2 matters.
2. Bunnings raises various matters which it says are relevant in considering what steps were reasonable for it to take in the circumstances.[115]

1. Bunnings again relies on Mr Thomlinson-Munn's evidence that all Input Vector Sets - both matched and non-matched - were discarded by the FRT system immediately after the matching process has completed. Where the FRT matched an Input Vector Set to an image on the Enrolled Persons Database, only the still facial image was copied to the hard drive while the Input Vector Set was immediately deleted.[116] Mr Thomlinson-Mann also stated that the vector sets utilised for the matching process were subject to a hashing process to convert the biometric vector points from an input facial image into a non-reversible 'hash', which is a numerical representation of those vector points generated by applying a mathematical algorithm to the input data.[117]
2. As previously noted, we have found that four CCTV cameras in each store were supplying images to the Bunnings system during the relevant period and the input facial images and Input Vector Sets were present on Bunnings' local server RAM for about 4 milliseconds before the matching process was complete, and both the unmatched input facial images and Input Vector Sets were deleted by a program instruction. We have also found that the input facial images captured by the CCTV component of the FRT system constitute 'biometric information' and therefore 'sensitive information' for the purposes of the Privacy Act. However, in considering what steps Bunnings should have taken in the circumstances, the short period of time that the data was held needs to be balanced against the fact that there was still a collection of individuals' 'personal information' and 'sensitive information'.
3. Further, as discussed earlier in these reasons, the FRT returned a number of false positives where the input facial image was converted to a vector set and erroneously matched to data in the Enrolled Persons Database. The Statement of Agreed Facts record those false positives as follows:[118]

According to Bunnings' quarterly reviews in the 2022 financial year, the following number of false positives were detected:

(a) quarter 1: 16 false positives (there were 0 positive matches identified in this review)

(b) quarter 2: 0 false positives (this review also indicates that there were 0 sites with facial recognition in use, as FRT ceased operating in November 2021)

(c) quarter 3: 0 false positives (this review also indicates that there were 0 sites with facial recognition in use, as FRT ceased operating in November 2021)

1. However, we accepted that a human would check to see if it was a match. If it was not a genuine match, then it would be discarded. While we accept that the rate of false positives was not high and a human would intervene to mitigate any error, there remains some potential for false positive results and that is a circumstance which weighs in favour of the need for notice.
2. Bunnings also submits that there was very little risk of cyber threat, relying on the expert report of Mr Veugelen who sets out the steps that would be required to carry out a cyber threat to the system and concludes that:[119]

Based on the above, in my experience, it would be reasonable for Bunnings to have determined that:

(a) The probability of the system being compromised or subject to unauthorised access was low; and

(b) The probability of the system having any adverse privacy impacts on non-enrolled individuals was low.

1. As previously found, we accept on the evidence before us that the risk of cyber threat was low and therefore this is not a matter which weighs heavily in the consideration of the circumstances.

Size and Nature of Relevant Stores and Impracticability

1. Bunnings submits that the unique characteristics of its stores make it impracticable to physically display the notices outside Bunnings stores. It submits that it would be impracticable to ensure all individuals had read the notice, given the volume and diversity of entrants into a Bunnings store at any point in time, and that the Bunnings stores include multiple entry points by both pedestrians and vehicles. It submits that Bunnings is readily distinguishable from an online retailer, which can easily implement mechanisms to compel individuals to read and accept notices as a condition of browsing a website.[120]
2. We accept that Bunnings stores differ somewhat from more typical retail environments in that they have multiple entries for both vehicles and pedestrians. We do not accept the submission that these differences make it impracticable for Bunnings to use appropriate signage at or immediately prior to the point of entry to notify individuals entering its stores that it was using FRT, and display materials that would readily be seen by individuals physically entering the store at the entry points. Indeed, Bunnings was already using similar signage to notify individuals about other APP 5.2 matters.

1. Bunnings refers to 'Roy Morgan' market research to establish that the usual demographic of the customers visiting Bunnings retail stores predominantly belong to a demographic segment representing 'the core of middle Australia motivated by security, reliability and providing better opportunities for their family'. Bunnings submits that consumers of that demographic 'are more likely to actively read, consume and understand such a notice where the notice is in large font, written in plain English, and contains the salient information, as opposed to a long list of interrelated matters'. Bunnings submits that the focus on salient information is consistent with the approach in the consumer law context, which recognises that significance should be attributed to the dominant message presented by a communication, and that consumers might give only 'perfunctory' attention to a communication to absorb only its general thrust or dominant message.[121]
2. Bunnings also submitted that the salient information about which individuals should have been informed differs between Enrolled Persons and individuals not enrolled on the Enrolled Persons Database. Bunnings submitted that it was not 'reasonable in all the circumstances' for the purposes of compliance with APP 5.1 to require Bunnings to inform all customers by signage that FRT was in use to detect the presence of Enrolled Persons, because to include such information by prominent signage at the front of each store, in order to communicate a message to that cohort, was not practicable or proportionate, and would have been needlessly disruptive and inflammatory given that the FRT system did not collect the sensitive information of the vast majority of entrants. Given that we have found that Bunnings collected the information of all persons including Enrolled Persons, the distinction between Enrolled Persons and individuals not enrolled no longer applies.
3. In summary, Bunnings submits that, while the manner and precise details of notification developed over time, it complied with APP 5.1 throughout the Relevant Period and conveyed salient information sufficient to inform individuals of the use of surveillance technology (as distinct from FRT) in Bunnings stores.
4. We consider it reasonable in the circumstances of this case for Bunnings to have taken steps to notify or ensure individuals were aware of, at the very least, the matters in APP 5.2(b), (d) and (e) because the collection of sensitive information represents a serious intrusion of privacy. On that basis, we consider that the salient information required to be communicated should have included Bunnings' use of FRT and we do not accept that it was impracticable for Bunnings' to notify persons entering its stores by simply stating that FRT was in use. For the following reasons, having considered the notices which were placed by Bunnings, we are not satisfied that the notices relied on by Bunnings were sufficient to comply with APP 5.1.

1. As noted above the first entry notice stated that 'video surveillance is utilised'. Bunnings submits that a consumer would reasonably infer that video surveillance was utilised in a retail setting and information created by that system and associated technologies was in place for the purpose of monitoring and investigating potential unlawful conduct. Bunnings submits that it was unnecessary to state expressly that the FRT system was in use to compare facial vector sets against a database of enrolled individuals, or that it was intended for the specific purpose of dealing with threatening and violent situations and retail crime. It is argued that a notification in those terms would have undermined the efficacy of the system.[122]
2. We reject the submission that the generalised notification of the video surveillance would lead to an inference that an FRT system was being utilised. As noted by the Privacy Commissioner in the Determination, FRT was a relatively novel technology in a retail setting at the time it was implemented by Bunnings.[123]
3. In our view, the first entry notice did not comply with APP 5.1 because it failed to notify individuals that Bunnings was collecting individuals' sensitive information through an FRT system, the purpose for which that collection occurred or the main consequences of not collecting the information through the FRT system. We find that the first entry notice was insufficient to meet Bunnings' obligations under APP 5.1.

1. Bunnings submits that the privacy poster directed individuals who wanted more information, access to their personal information, to provide any complaints or feedback or to access Bunnings' privacy policy, to contact Bunnings or visit its website. It submits that it would have been unreasonable, and impracticable, for in-store notices to have included more detailed minutiae of the video surveillance system in place in busy stores with high foot traffic.[124]
2. We find that the privacy poster was insufficient to meet Bunnings obligations under APP 5.1. It described the purpose for which the personal information was collected as being to help Bunnings complete a transaction, make its advertising more relevant and tailor an individuals' shopping experience. It made no reference to Bunnings' use of the FRT system and there is no evidence that the privacy policies to which consumers were referred by the privacy poster made any reference to the use of the FRT system.

1. The second entry notice stated that 'video surveillance, which may include facial recognition, is utilised'. Bunnings submits that the second entry notice was sufficient to comply with APP 5.1, because it informed all individuals of the possibility of the use of facial recognition technology in conjunction with video surveillance, being additional salient information not contained in the first entry notice, the privacy poster and privacy policies. Bunnings submits that the use of the word 'may' was consistent with the progressive rollout of FRT throughout the Bunnings stores.
2. In our view, the second entry notice still does not meet the obligations in APP 5.1. The use of the word 'may' did not positively convey that Bunnings was collecting individuals' sensitive information through an FRT system and more importantly, the notice still fails to inform individuals about the purpose for which collection occurred or the main consequences of not collecting the information as is required by APP 5.2.
3. Bunnings submits that, while the manner and precise details of notification developed over time, overall, it complied with APP 5.1 throughout the relevant period. We note that APP 5.1 requires an entity to comply at or before the time or, if that is not practicable, as soon as practicable after. While we accept that this does not impose an immediate obligation, having considered the notices even in their totality, we do not accept that they conveyed salient information sufficient to inform individuals of the use of surveillance technology in Bunnings stores.
4. In conclusion, we find that Bunnings failed to comply with APP 5.1 during the Relevant Period.

ISSUE 3: Australian Privacy Principle 1.2 (APP 1.2)

1. The Commissioner submits that Bunnings failed to comply with APP 1.2 because Bunnings failed to take reasonable steps in the circumstances to implement practices, procedures and systems that would ensure that Bunnings complied with the APPs in relation to its use of FRT.
2. APP 1.2 provides:

1.2 An APP entity must take such steps as are reasonable in the circumstances to implement practices, procedures and systems relating to the entity's functions or activities that:

(a) will ensure that the entity complies with the Australian Privacy Principles and a registered APP code (if any) that binds the entity; and

(b) will enable the entity to deal with inquiries or complaints from individuals about the entity's compliance with the Australian Privacy Principles or such a code.

1. In the Statement of Agreed Facts, the parties agree that neither prior to nor during the Relevant Period, did Bunnings conduct a formal written privacy impact assessment, or a formal written privacy threshold assessment as described in the 'Guide to undertaking privacy impact assessments' published by the OAIC.[125]
2. However, Bunnings submits that a series of other steps taken during the relevant period were sufficient to demonstrate their compliance with APP 1.2.
3. Bunnings relies primarily on the statement of Mr MacDonald dated 28 February 2023. Mr MacDonald includes material that indicates that in deciding whether to use the FRT system, the privacy implications to be fully explored.125 Mr MacDonald also stated that he recommended the Hitachi FRT system because it protected the privacy of non-matched individuals.126
4. Bunnings also submits that it is relevant that Mr MacDonald sought and obtained legal advice specifically in relation to privacy. The Commissioner initially submitted that as Bunnings had not provided evidence as to the questions asked, or the legal advice given, if any; or how Bunnings is said to have relied upon that advice in its operation of the FRT system; the Tribunal should not take that factor into consideration. The parties made submissions at the hearing regarding legal privilege and the waiving of that privilege, but it was ultimately conceded by Bunnings that it did not rely on the contents of the legal advice, but rather it relied only Mr MacDonald's evidence that he sought and obtained legal advice in relation to privacy.[126]
5. Mr MacDonald states that prior to the installation of any FRT systems in Bunnings stores, all Bunnings team members who were to use the FRT system received training from Hitachi on the use of FRT.[127] Training was also provided to new team members who were given access to the FRT system, of which there were only two during the Relevant Period.[128] He states that an alert system was in place alongside the FRT system which was limited to a total of six people for any one alert, which ensured that any personal information was contained and was distributed to Bunnings team members on a need-to-know basis. The only team members who were permitted to enrol individuals on the enrolment database, and who were given physical and password access to the FRT system, were the limited group who received alerts.[129]
6. Mr Thomlinson-Munn also stated that an officer of Hitachi was procured to train the third-party company engaged to install the FRT system in Bunnings stores.[130]
7. Bunnings also refers to steps it took throughout the Relevant Period, including in relation to updating pre-existing security measures and the development by Wesfarmers (Bunnings' parent entity) of an approved minimum standard. It is agreed between the parties that on 3 September 2020, Wesfarmers had in place the 'Minimum Standards for the Use of Facial Recognition' (Minimum Standards). The stated purpose of the Minimum Standards was to 'ensure that the Wesfarmers group of companies: is compliant with applicable laws and regulations'.[131] Bunnings submitted that consistent with the Minimum Standards, they began undertaking periodic reviews of the FRT system in the 2022 financial year, and documenting positive matches generated by the FRT system.[132]
8. The Commissioner submits that Bunnings failed to conduct a thorough and documented assessment of the privacy implications of the FRT system or have a formal written privacy impact assessment or privacy threshold assessment as described in the 'Guide to undertaking privacy impact assessments' published by the OAIC. The Commissioner submits that Bunnings did not prepare a risk assessment with respect to the use of the FRT system in relevant stores, either before or during the Relevant Period. The Commissioner also submits that from November 2018 to September 2020, Bunnings did not have in effect any Minimum Standards or any like policy. The Commissioner acknowledges that the Minimum Standards were put in place on 3 September 2020, however the Minimum Standards required that alerts were to undergo 'a meaningful review by at least two team members' prior to any action being undertaken, and Bunnings did not have any documents demonstrating how the review process mandated by the Minimum Standards was undertaken. The Commissioner also submits that Bunnings failed to comply with the Minimum Standards because Bunnings did not develop or maintain any documentary guidelines on the use of the FRT system during the Relevant Period or document any Use Assessment(s) in relation to the FRT system as was required by the Minimum Standards.[133]
9. The Commissioner also refers to the records in relation to positive matches. Those records were set out in an Excel spreadsheet. Of the 910 positive match entries contained in the spreadsheet, 100 stated 'positive hit' without providing any further detail, and 317 entries contained no information whatsoever.[134] The Commissioner submits that approximately 45% of the data did not comply with the Minimum Standards.[135]
10. The Commissioner also raises that Bunnings did not comply with the following requirements of the Minimum Standards:[136]
    • Bunnings did not document the training provided to relevant staff members;[137] and
    • the use of FRT was not 'limited to the minimum extent reasonably required to mitigate' organised retail crime and threatening situations.[138]
11. We find that the evidence does not establish that Bunnings took such steps as are reasonable in the circumstances to implement practices, procedures and systems relating to its functions or activities that would ensure that it complied with the APPs or deal with inquiries or complaints from individuals about compliance with the APPs.
12. We accept from the evidence of Mr MacDonald that some enquiries were made regarding privacy implications, including seeking legal advice, and that steps were taken in relation to some training and minimising those with access to the FRT system. We accept that Minimum Standards were subsequently developed, however that was a significant time after the implementation of the system. Considering the steps taken by Bunnings in totality, we find that Bunnings fell short of implementation of practices, procedures and systems relating to Bunnings' functions or activities that would have ensured that they complied with the Australian Privacy Principles. Even accepting that Minimum Standards were later put in place and steps were taken to review security along the way, there was a lack of reasonable policies and procedures governing the use of the FRT system from the outset.
13. Again, in light of the fact that the collection of sensitive information represents a serious intrusion of privacy, we consider that it would have been reasonable in the circumstances for Bunnings to conduct a formal, structured and documented risk assessment of the FRT system from the outset of the Relevant Period which considered the privacy implications. Instead, the steps taken amounted to random enquiries and actions which do not amount to an implementation of practices, procedures and systems relating to Bunnings' functions or activities that would have ensured that they complied with the Australian Privacy Principles.
14. For these reasons we find that Bunnings was in breach of the obligations under APP 1.2.

ISSUE 4: Australian Privacy Principle 1.3 (APP 1.3)

1.3 An APP entity must have a clearly expressed and up to date policy (the APP privacy policy) about the management of personal information by the entity.

2. APP 1.4 provides the information which the privacy policy must contain:

1.4 Without limiting subclause 1.3, the APP privacy policy of the APP entity must contain the following information:

(a) the kinds of personal information that the entity collects and holds;

(b) how the entity collects and holds personal information;

(c) the purposes for which the entity collects, holds, uses and discloses personal information;

(d) how an individual may access personal information about the individual that is held by the entity and seek the correction of such information;

(e) how an individual may complain about a breach of the Australian Privacy Principles, or a registered APP code (if any) that binds the entity, and how the entity will deal with such a complaint;

(f) whether the entity is likely to disclose personal information to overseas recipients;

(g) if the entity is likely to disclose personal information to overseas recipients - the countries in which such recipients are likely to be located if it is practicable to specify those countries in the policy.

1. The Commissioner submits that Bunnings had privacy policies during the relevant period, but none of them referred to FRT. Rather, they related to images from video surveillance and other cameras in the stores.[139]
2. Bunnings submits that in respect of matched individuals, it would have been unreasonable and inappropriate for an APP entity to be required to make statements in its privacy policy which would give people suspected of being criminals, notice of the collection of their personal information by use of a system, the purpose of which is to prevent and mitigate criminal conduct.[140]
3. We disagree with that submission. We agree with the submissions of the Commissioner that advance notification of the FRT system's operation to persons who may be considering criminal behaviour is a deterrent and a way to both prevent and mitigate criminal conduct.
4. We find that Bunnings failed to include in its privacy policies information about the kinds of personal information that it collected and held, and how it collected and held that personal information, as required by APP 1.4(a) and 1.4(b). On that basis, Bunnings did not have an APP privacy policy which contained all the information required by APP 1.4.
5. Accordingly, Bunnings did not have a clearly expressed and up to date policy about the management of personal information and on that basis was in breach of APP 1.3.

1. This case illustrates the tension between competing objects in the Privacy Act to promote the protection of the privacy of individuals whilst recognising that the protection of privacy is to be balanced with the interests of entities carrying out their functions or activities.
2. We have found that during the Relevant Period, Bunnings was entitled to use FRT for the limited purpose of combatting very significant retail crime and protecting their staff and customers from violence, abuse and intimidation within its stores. Important factors in our decision included, first, the extent of retail crime being faced by Bunnings staff and customers and, second, the technological features of the FRT system which minimised the intrusion on privacy by permanently deleting collected sensitive information and by limiting its susceptibility to cyber-attack. The advanced technology in the FRT system limited the impact on privacy so as not to be disproportionate when considered against the benefits of providing a safer environment for staff and customers in Bunnings stores.
3. We have also found that, whilst using FRT during the Relevant Period, Bunnings did not comply with obligations relating to notification in APP 5.1 and management of personal information in APP1.2 and 1.3. If personal information is to be collected by FRT, Bunnings and other APP entities must take reasonable steps to provide notification that personal information is being collected and to implement appropriate practices, procedures and systems.

1. The decision of the Tribunal is to set aside the Determination by the Privacy Commissioner in relation to the finding that Bunnings breached APP 3.3 and to substitute a decision that Bunnings did not breach APP 3.3 because subclause 3.4 applies and a permitted general situation existed in relation to the collection of information by Bunnings during the Relevant Period.
2. The Tribunal otherwise affirms the decision under review by finding that Bunnings acted in breach of APP 1.2, 1.3 and 5.1.

1. I certify that the preceding 239 (two-hundred-and-thirty-nine) paragraphs are a true copy of the reasons for the decision herein of Deputy President P Britten-Jones, Senior Member A Murphy and Senior Member T Simon

...............[SGD]...................................................

[1] Parties' Statement of Agreed Facts (SOAF) at [5].

[2] Applicant's Written Outline of Opening Submissions at [1].

[3] Commissioner Initiated Investigation into Bunnings Group Limited (Privacy) [2024] AICmr 230 (the Determination).

[4] Applicant's Written Outline of Opening Submissions at [6]; Applicant's Written Outline of Closing Submissions at [12].

[5] Respondent's Written Outline of Opening Submissions at [200].

[8] Bunnings Group Limited and Privacy Commissioner (Guidance and Appeals Panel) [2024] ARTA 42 (17 December 2024).

[9] Privacy Act 1988 (Cth) (Privacy Act) APP 3.4(b), read with s 16A(1), items 1 and 2.

[18] Privacy Act s 6(1).

[19] Transcript (24 October 2025) at 289:30-5.

[20] Bunnings Group Limited, 'Appendix 1 Answers to the questions in the OAIC Notice' (5 August 2022) (Bunnings' Answers): T-Documents at 12.

[22] Applicant's Written Outline of Opening Submissions at [76].

[23] Transcript (27 October 2025) at 311:30-2.

[24] Supplementary Report of Dr Karin Verspoor dated 25 July 2025 at 2-3.

[25] Supplementary Report of Dr Karin Verspoor dated 25 July 2025 at 2-3.

[26] Hitachi Vantara Australia Pty Ltd, 'Response to Notice to Give Information and Produce Documents' (5 October 2022) (Hitachi Response): T-Documents at 4723.

[27] Transcript (23 October 2025) at 290-5; Hitachi Response: T-Documents at 4723.

[28] Transcript (23 October 2025) at 291-5.

[29] Supplementary Report of Dr Karin Verspoor dated 25 July 2025 at 4-5.

[30] Transcript (23 October 2025) at 291-8.

[31] Witness Statement of Andrew Thomlinson-Munn dated 1 April 2025; Reply Statement of Andrew Thomlinson-Munn dated 20 June 2025.

[32] Bunnings' Answers: T-Documents at 12.

[33] Reply Statement of Andrew Thomlinson-Munn dated 20 June 2025 at [23]; SOAF at [23], [36].

[34] Alexander MacDonald, the National Investigations and Security Manager for Bunnings.

[35] Transcript (23 October 2025) at 138:42-7.

[36] [2022] FCAFC 9; (2022) 289 FCR 217 (Facebook Inc).

[38] Transcript (27 October 2025) at 312:1-3.

[40] Privacy Act s 6(1).

[41] Privacy Act s 6(1).

[42] Applicant's Written Outline of Opening Submissions at [67], [69]; Respondent's Written Outline of Opening Submissions at [74].

[43] Applicant's Written Outline of Opening Submissions at [85]-[89].

[44] Definition of 'sensitive information' at subclause (e).

[45] Clearview AI Inc v Australian Information Commissioner [2023] AATA 1069 at [125]- [126].

[46] Witness Statement of Alexander MacDonald dated 28 February 2023 at [8].

[47] Witness Statement of Alexander MacDonald dated 28 February 2023 at [12].

[48] Witness Statement of Alexander MacDonald dated 28 February 2023 at [6].

[50] Transcript (23 October 2025) at 117:12.

[51] Joint Report by Experts dated 18 July 2025 at [5.1.5]-[5.1.6].

[52] Joint Report by Experts dated 18 July 2025 at [5.1.3].

[53] Joint Report by Experts dated 18 July 2025 at [5.1.5]-[5.1.6].

[54] Witness Statement of Alexander MacDonald dated 28 February 2023 at [13]-[14].

[55] Witness Statement of Alexander MacDonald dated 28 February 2023 at [26]-[27].

[56] Joint Report by Experts dated 18 July 2025 at [5.1.9].

[57] Witness Statement of Shawn Adams dated 27 February 2023 at [25].

[58] [2024] FCA 303 at [43].

[59] Respondent's Written Outline of Closing Submissions at [20].

[60] Nationwide News Pty Ltd v Naidu and Anor; ISS Security Pty Ltd v Naidu and Anor [2007] NSWCA 377; (2007) 71 NSWLR 471 at [228]- [234].

[61] Witness Statement of Alexander MacDonald dated 28 February 2023 at [4]-[7].

[62] [1990] HCA 26; (1990) 170 CLR 104 (George v Rockett) at 116.

[63] [2017] FCAFC 193; 257 FCR 62 (Pfizer Ireland Pharmaceuticals v Samsung Bioepis AU Pty Ltd) at [69].

[65] (2011) 244 CLR 352; [2011] HCA 36 at [50].

[66] Witness Statement of Alexander MacDonald dated 28 February 2023 at [13].

[67] Witness Statement of Alexander MacDonald dated 28 February 2023 at [11].

[68] Witness Statement of Alexander MacDonald dated 28 February 2023 at [14].

[69] Transcript (23 October 2025) at 124:36-125:5.

[70] Transcript (23 October 2025) at 125:7.

[71] Transcript (23 October 2025) at 116:5-29.

[72] Transcript (23 October 2025) at 130:8.

[73] Transcript (23 October 2025) at 125:14-17.

[74] Transcript (23 October 2025) at 127:15-20.

[75] Transcript (23 October 2025) at 125:28-34.

[77] Joint Report by Experts dated 18 July 2025 at [5.1.6].

[78] Transcript (24 October 2025) at 185:26-32.

[80] Joint Report by Experts dated 18 July 2025 at [5.1.8].

[81] Witness Statement of Alexander MacDonald dated 28 February 2023 at [56].

[83] Witness Statement of Alexander MacDonald dated 28 February 2023 at [21].

[84] Transcript (23 October 2025) at 138:42-7.

[85] Transcript (23 October 2025) at 141:16-8.

[86] Transcript (23 October 2025) at 142:25-37.

[87] Transcript (23 October 2025) at 142:17-9.

[88] Witness Statement of Alexander MacDonald dated 28 February 2023 at [18]-[19].

[89] Witness Statement of Alexander MacDonald dated 28 February 2023 at [23].

[90] Witness Statement of Alexander MacDonald dated 20 June 2025 at [7]-[8].

[91] Transcript (23 October 2025) at 116:4-25.

[92] Transcript (23 October 2025) at 125:14-8.

[93] Witness Statement of Alexander MacDonald dated 28 February 2023 at [30]-[32].

[94] Witness Statement of Alexander MacDonald dated 28 February 2023 at [14].

[95] Transcript (24 October 2025) at 189:37-190:19.

[96] Transcript (24 October 2025) at 190:25-35.

[97] Witness Statement of Alexander MacDonald dated 20 June 2025 at [7]-[16].

[98] Report of Wouter Veugelen dated 2 April 2025 at [6.4.12(c)].

[99] Transcript (24 October 2025) at 190:30-5.

[101] In his witness statement of 23 June 2025, Mr Thomlinson-Munn corrected an error in his first statement of 1 April 2025 so as to clarify that all Input Vector Sets - matched and non-matched - are discarded by the FRT system immediately after the matching process is completed.

[102] Report of Dr Karin Verspoor dated 25 July 2025 at [II(1)(a)(ii)]. See also [II(1)(c)].

[104] Witness Statement of Andrew Thomlinson-Munn dated 1 April 2025 at [19].

[105] Report of Wouter Veugelen dated 2 April 2025 at [6.7.7]-[6.7.10].

[106] Report of Wouter Veugelen dated 2 April 2025 at [6.7.9], referring to Witness Statement of Alexander MacDonald dated 28 February 2023 at [41].

[107] Transcript (27 October 2025) at 359-60.

[108] Pfizer Ireland Pharmaceuticals v Samsung Bioepis AU Pty Ltd at [69].

[109] Pfizer Ireland Pharmaceuticals v Samsung Bioepis AU Pty Ltd at [69].

[110] Respondent's Written Outline of Closing Submissions dated 27 October 2025 at [37]-[38].

[111] Respondent's Written Outline of Opening Submissions dated 10 October 2025 at [167].

[112] Witness Statement of Alexander MacDonald dated 28 February 2023 at [14], [17], [28]; Witness Statement of Alexander MacDonald dated 20 June 2025 at [13]-[15].

[113] Applicant's Statement of Facts, Issues and Contentions (Applicant's SFIC) at [128].

[115] Applicant's Written Outline of Opening Submissions at [159]-[180].

[116] Witness Statement of Andrew Thomlinson-Munn dated 1 April 2025 at [19].

[117] Witness Statement of Andrew Thomlinson-Munn dated 1 April 2025 at [13].

[119] Report of Wouter Veugelen dated 2 April 2025 at [6.7.10].

[126] Transcript (23 October 2025) at 110:24-30.

[127] Witness Statement of Alexander MacDonald dated 28 February 2023 at [40].

[128] Witness Statement of Alexander MacDonald dated 28 February 2023 at [43].

[129] Witness Statement of Alexander MacDonald dated 28 February 2023 at [44].

[130] Witness of Andrew Thomlinson-Munn dated 1 April 2025 at [10], [12].

[133] Respondent's Statement of Facts, Issues and Contentions (Respondent's SFIC) at [161]-[162].

[134] The Determination at [252(c)].

[137] The Determination at [252(c)].

[139] The Determination at [270]-[271].