1. I find that Kmart Australia Limited (respondent or Kmart) interfered with the privacy of the individuals whose personal information and sensitive information it collected via its facial recognition technology (FRT) system at 28 of its retail stores (relevant stores) between 22 June 2020 and 15 July 2022 (relevant period), within the meaning of s 13(1) of the Privacy Act 1988 (Cth) (Privacy Act), by:
   1. collecting the sensitive information of those individuals in circumstances where the individuals did not consent to the collection of the information and Australian Privacy Principle (APP) 3.4 did not apply in relation to the information, contrary to APP 3.3; and
   2. failing to take such steps as were reasonable in the circumstances to notify or otherwise ensure those individuals were aware about the relevant APP 5.2 matters, contrary to APP 5.1.
2. I also find that the respondent breached APP 1.3 by failing to include in its privacy policies information about the kinds of personal information that it collected and held, and how it collected and held that personal information, as required by APP 1.4(a) and APP 1.4(b).

1. I declare, under s 52(1A) of the Privacy Act, that the respondent:
   1. must not repeat or continue the acts or practices that I have found to be an interference with the privacy of individuals, as outlined at paragraph [1];
   2. must, within 30 days of the publication of the determination, make an apology available on its website (https://www.kmart.com.au/ - Kmart website) and in relevant stores for at least 30 days;
   3. must, within 30 days of the publication of the determination, publish a statement (statement) which is accessible from and prominently featured on the homepage of the Kmart website for at least 30 days, setting out:
      1. the fact that I have made a determination finding that the respondent interfered with the privacy of individuals and the date on which the determination was made;
      2. a detailed description of its use of the FRT system, including the dates of operation and stores in which it operated;
      3. how the FRT system operated, including how it collected facial images, what it did with the facial images, the fact that matches were generated, and how the respondent acted on such matches;
      4. the fact that the respondent did not seek consent for the collection of individuals' personal information and sensitive information for the purposes of operating the FRT system;
      5. a detailed description of the relevant APP 5.2 and APP 1.4 matters that the respondent omitted from its privacy policies during the relevant period; and
      6. advice to individuals about how they may contact the respondent to find out more information and how to make a complaint if they wish;
   4. must ensure that the statement is otherwise available on the Kmart website, which is accessible from the webpages relevant to the respondent's privacy policy, for a period of 12 months following publication of the statement;
   5. is to retain all personal information and sensitive information obtained or generated through the FRT system that it still holds, including any images, biometric information, personal information, and information in relation to the use of the FRT system, including any guidelines, procedures or other documents, including any produced under the 'Minimum Standards for the Use of Facial Recognition'[1], for 12 months following publication of the statement as required by declaration [3.c.];
   6. subject to declaration [3.e.] and to the extent permitted by law, destroys all personal information the subject of declaration [3.e] 12 months and one day after the respondent has taken the action required by declaration [3.e]; and
   7. is to provide written confirmation to the OAIC when it has complied with declaration [3.f].

1. This determination concerns the deployment of an FRT system to detect and prevent refund fraud in a large retail chain, Kmart. It involves an analysis of the 'permitted general situations' enumerated by the Privacy Act,[2] according to which entities are not required to obtain consent to collect sensitive information, including biometric information, when certain circumstances apply.[3] The permitted general situation relied upon by the respondent applies when an entity has reason to suspect that unlawful activity has been, is being or may be engaged in, and it reasonably believes that the collection, use or disclosure of sensitive information is necessary in order for them to take appropriate action in relation to it.[4]
2. The permitted general situations were introduced into the Privacy Act in 2012,[5] at a time when public deployment of FRT was a speculative and futuristic notion. Understanding how FRT accords with the protections contained in the Privacy Act therefore requires both a textual and purposive analysis, taking into account the objects of the Privacy Act, including the need to balance the interests of individuals in having their privacy protected, on the one hand, and the interests of entities in carrying out their functions or activities, on the other. Relevant to a technology like facial recognition, is also the public interest in protecting privacy.
3. Indeed, in 2024 the Privacy Act was amended to explicitly recognise this public interest by the Privacy and Other Legislation Amendment Act.[6] In the second reading speech to that legislation, then Attorney-General the Honourable Mark Dreyfus KC MP observed that, "[t]he right to privacy is a fundamental human right. As Sir Zelman Cowen said in his 1969 Boyer Lectures, a person without privacy is a person without dignity. We must be vigilant in ensuring that evolving technology does not erode our ability to protect information about who we are, what we do and what we believe from being misused."[7]

1. The respondent operates 'Kmart' retail stores across Australia. During the relevant period, the respondent operated between 214 and 303 stores,[8] 28 of which were selected to implement FRT as part of a 'pilot program'.[9] The pilot program included stores within all Australian states and territories, except for the Northern Territory and Tasmania.[10] The FRT software used by the respondent was provided by a third-party supplier (third-party supplier) and was integrated with the respondent's systems and servers (collectively, the FRT system).
2. Initially, the respondent used the FRT system in one store from 22 June 2020.[11] From 27 July 2021 to 22 December 2021, the respondent progressively deployed the FRT system in a further 27 stores.[12] [Redacted].[13]
3. On 11 July 2022, the former Australian Information Commissioner (Commissioner) commenced an investigation into the acts and practices of the respondent relating to its use of FRT under s 40(2) of the Privacy Act. In response to the Commissioner's investigation, the respondent ceased operating the FRT system on 15 July 2022.[14]
4. On 27 February 2025, a preliminary view was issued to the respondent for comment and the respondent made substantive submissions in response.[15]
5. For the purposes of s 43(4) of the Privacy Act, I am satisfied that:
   1. the acts and practices to which the investigation relates can be adequately determined in the absence of a hearing with the respondent; and
   2. there are no unusual circumstances that would warrant holding a hearing before making this determination.

1. The APPs in Schedule 1 of the Privacy Act regulate the handling of personal information by Australian government agencies and certain private sector organisations (APP entities).
2. An APP entity is prohibited from doing an act, or engaging in a practice, that breaches an APP.[16] An act or practice of an APP entity is an interference with the privacy of an individual if it breaches an APP in relation to personal information about an individual.[17]
3. I am satisfied that the respondent is an APP entity because it is a body corporate that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality of a State or Territory.[18]
4. In making this determination, I have considered the information and submissions provided by the respondent. I have also considered the Australian Privacy Principles Guidelines (APP Guidelines)[19] and the OAIC's Guide to privacy regulatory action.[20]
5. The APPs relevant to this investigation are APPs 3.3, 3.4, 5.1, 5.2, 1.3 and 1.4.

1. The FRT system was an 'on premises [sic] solution' hosted by the respondent,[21] which stored data on technology infrastructure that was owned or controlled by the respondent, save for one central server located at an Australian data centre.[22]
2. The respondent claims that it used the FRT system for the sole purpose of detecting and preventing fraudulent refunds, and to assist in identifying individuals who had previously engaged in refund fraud or theft (person(s) of interest), some of whom were violent or threatened violence towards the respondent's staff and customers.[23]
3. The respondent's staff members were trained to check for refund fraud where the individual requested a refund and one or more of the following circumstances applied (suspicious circumstances):
   1. the individual did not provide a proof of purchase, such as a receipt;
   2. [Redacted];
   3. [Redacted]; or
   4. the individual was a person of interest as defined by the respondent and set out at paragraph [26[24]] below.24
4. The operation and functionality of the respondent's FRT system during the relevant period is outlined below.

1. The FRT system used video feed from Closed Circuit Television (CCTV) cameras to capture, in real time, the facial images of all individuals who entered a relevant store and all individuals who presented at the returns service desk (Returns Counter) of a relevant store during the relevant period.[25]
2. The FRT system was used in two locations in relevant stores to collect individuals' information. According to the respondent, it generated 5 to 6 facial images (real time facial image) from the CCTV footage of every individual at the point of entry to the relevant store, and again upon each individual's attendance at the Returns Counter.[26] The best quality of those facial images (both upon entry and upon attendance at the Returns Counter) was used to generate metadata. The process of creating metadata took approximately 1 to 2 seconds to complete[27] and involved the FRT system generating 'feature vectors' for each detected face[28] which created a digital representation or 'model' of the facial image.[29] These vectors effectively defined the location of the face within certain dimensions of feature space,[30] and were unique to an individual's face.
3. The metadata extracted from the facial image of an individual who presented at the Returns Counter was automatically compared against:
   1. the metadata of individuals' facial images held on a database of the relevant store that the individual entered (History Database). The History Database stored the facial images and metadata of all individuals who had entered the relevant store and all individuals who had presented at a Returns Counter at that store. Initially, the respondent retained the metadata in the History Database for [Redacted] and from April 2022, for [Redacted]. [Redacted];[31] and
   2. the facial images and metadata of individuals who had been included on the enrolment database (Enrolment Database), which was shared amongst the relevant stores, because the respondent believed that they may engage in refund fraud across stores. [Redacted], as outlined at paragraph [[[32]](2025_155.html#_Ref2015677.

[76] T1.1.A1 - Appendix to T1.1: Answers to the questions in the OAIC notice p.2.

[77] R2.1 - Attachment to R2: Letter from the respondent to the OAIC dated 7 October 2022 p.3.

[79] Privacy Act s 16A.

[80] R1.1 - Attachment to R1: Letter from the respondent to the OAIC dated 8 August 2022 p.2; R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.3.

[81] R2.1 - Attachment to R2: Letter from the respondent to the OAIC dated 7 October 2022 p.2.

[83] R3.2 - Respondent's spreadsheet of financial information for relevant years.

[84] R2.1.A.1 - Appendix 1 to R2: Answers to the questions in the OAIC notice p.10.

[85] R2.1.A.1 - Appendix 1 to R2: Answers to the questions in the OAIC notice p.10; R3.1 - Letter from the respondent to the OAIC dated 10 April 2025 p.3.

[86] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.5.

[87] See Nationwide News Pty Ltd v Naidu & Anor; ISS Security Pty Ltd v Naidu & Anor [2007] NSWCA 377 at 234, citing Hamilton v Whitehead [1988] HCA 65; (1988) 166 CLR 121; Director General, Department of Education and Training v MT [2006] NSWCA 270; and North Sydney Council v Roman [2007] NSWCA 27.

[88] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.2; R4.2 - Witness Statement - Respondent's General Manager Central Operations and Safety dated 30 April 2025 p.1.

[90] George v Rockett [1990] HCA 26; (1990) 170 CLR 104 at 112, 116; see also Seven Network v Australian Competition and Consumer Commission [2004] FCAFC 267; (2004) 140 FCR 170 at 182.

[91] R1.1 - Attachment to R1: Letter from the respondent to the OAIC dated 5 August 2022 p.2.

[92] Explanatory Memorandum - Privacy Amendment (Enhancing Privacy Protection) Bill 2012 (Cth) p.67.

[94] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.6.

[95] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.6.

[96] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.6; R4.2 - Witness Statement - Respondent's General Manager Central Operations and Safety dated 30 April 2025 pp.3-4.

[98] APP Guidelines [B.116]; Mulholland v Australian Electoral Commissioner [2004] HCA 41 [39] (Gleeson CJ).

[99] R2.1 - Attachment to R2: Letter from the respondent to the OAIC dated 7 October 2022 p.2; R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.3.

[100] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.10.

[101] R2.1 - Attachment to R2: Letter from the respondent to the OAIC dated 7 October 2022 p.2; R1.1.A1 - Appendix 1 to R1.1: Answers to the questions in the OAIC notice p.15.

[102] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.14.

[103] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.14; R4.2 - Witness Statement - Respondent's General Manager Central Operations and Safety dated 30 April 2025 p.1.

[104] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 pp.14-15; R4.2 - Witness Statement - Respondent's General Manager Central Operations and Safety dated 30 April 2025 pp.3-7.

[105] R2.1.A1 - Appendix 1 to R2.1 - Answers to the questions in the OAIC notice p.10.

[106] R2.1.A1 - Appendix 1 to R2.1 - Answers to the questions in the OAIC notice p.10.

[107] R2.1.A1 - Appendix 1 to R2.1 - Answers to the questions in the OAIC notice p.10.

[108] R1.1.A7.1 - Appendix 7.1 to R1.1: ShrinK 365: FRT Guide dated November 2021 pp.12-13; R1.1.A7.2 - Appendix 7.2 to R1.1: ShrinK 365: FRT National Office Guide dated April 2022 p.6.

[109] R4.2 - Witness Statement - Respondent's General Manager Central Operations and Safety dated 30 April 2025 p.2.

[110] R2.1.A3 - Appendix 3 to R2.1: Incident reports and refunds prevented.

[111] R2.1.A3 - Appendix 3 to R2.1: Incident reports and refunds prevented.

[112] R1.1.A3 - Appendix 3 to R1.1: List of FRT stores; R1.1.A1 - Appendix 1 to R.1.1: Answers to the questions in the OAIC notice p.15.

[113] R2.1 - Attachment to R2: Letter from the respondent to the OAIC dated 7 October 2022 p.2 [7]. R1.1.A1 - Appendix 1 to R1.1: Answers to the questions in the OAIC notice p.15.

[114] R2.1.A3 - Appendix 3 to R2.1: Incident reports and refunds prevented.

[115] R2.1.A.1 - Appendix 1 to R2.1: Answers to the questions in the OAIC notice p.10; R3.1 - Letter from the respondent to the OAIC dated 10 April 2025 p.3. As discussed in paragraph [62], the respondent provided figures that refunds without proof of purchase amounted to [Redacted] in the 2020 financial year.

[116] R4.2 - Witness Statement - Respondent's General Manager Central Operations and Safety dated 30 April 2025 p.6; R2.1.A.1 - Appendix 1 to R2.1: Answers to the questions in the OAIC notice p.10; R3.1 -Letter from the respondent to the OAIC dated 10 April 2025 p.3.

[117] R4.2 - Witness Statement - Respondent's General Manager Central Operations and Safety dated 30 April 2025 p.6.

[118] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.16.

[119] R2.1 - Attachment to R2: Letter from the respondent to the OAIC dated 7 October 2022 p.2.

[120] R2.1 - Attachment to R2: Letter from the respondent to the OAIC dated 7 October 2022 p.2.

[121] R4.2 - Witness Statement - Respondent's General Manager Central Operations and Safety dated 30 April 2025, pp.3-4.

[122] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.18; R4.2 - Witness Statement - Respondent's General Manager Central Operations and Safety dated 30 April 2025 p.4.

[123] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.18; R4.2 - Witness Statement - Respondent's General Manager Central Operations and Safety dated 30 April 2025 pp.4-5.

[124] See for example, Australian Bureau of Statistics, Occupation 452236 Retail Loss Prevention Officer, accessed 22 August 2025.

[125] R3.1 - Letter from the respondent to the OAIC dated 10 April 2025 pp.2-3.

[126] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.18; R2.1.A1 Appendix 1 to R2.1: Answers to the questions in the OAIC notice pp. 12-13.

[127] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.18.

[128] Competition and Consumer Act 2010 (Cth) sch 2 ('Australian Consumer Law').

[129] Kmart Returns Policy: https://www.kmart.com.au/returns-policy/?srsltid=AfmBOoox_cGicKekxWE_9dapxoA-xOiesTQF0v9KlCehxWyCmG_CtuCg, accessed 21 August 2025.

[130] Kmart Returns Policy: https://www.kmart.com.au/returns-policy/?srsltid=AfmBOoox_cGicKekxWE_9dapxoA-xOiesTQF0v9KlCehxWyCmG_CtuCg, accessed 21 August 2025.

[131] R4.2 - Witness Statement - Respondent's General Manager Central Operations and Safety dated 30 April 2025 p.2.

[132] R4.2 - Witness Statement - Respondent's General Manager Central Operations and Safety dated 30 April 2025 p.7.

[133] For example, Preventing workplace violence and aggression guide | Safe Work Australia, Appendix A - Industry hazards and control measures, see 'Retail and hospitality' pp.19-20.

[134] R4.2 - Witness Statement - Respondent's General Manager Central Operations and Safety dated 30 April 2025 p.7.

[135] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 p.20.

[136] R1.1.A10 - Appendix 10 to R1.1: Wesfarmers Minimum Standards for the use of FRT dated 3 September 2020 p.2.

[137] R2.1.A4.1 - Appendix 4.1 to R2.1: FRT compliance plan checklist dated September 2021; R2.1.A4.2 - Appendix 4.2 to R2.1: FRT compliance plan checklist dated October 2021; R2.1.A4.3 - Appendix 4.3 to R2.1: FRT compliance plan checklist dated November 2021; R2.1.A4.4 - Appendix 4.4 to R2.1: FRT compliance plan checklist dated March 2022; R2.1.A4.5 - Appendix 4.5 to R2.1: FRT compliance plan checklist dated June 2022.

[138] R2.1.A4.1 - R2.1.A4.5 - Appendices to R2.1: 'FRT compliance plan checklist' for September 2021, October 2021, November 2021, March 2022 and June 2022 pp.1-2.

[139] R2.1.A4.1 - R2.1.A4.5 - Appendices to R2.1: 'FRT compliance plan checklist' for September 2021, October 2021, November 2021, March 2022 and June 2022 pp.1-2.

[140] R2.1.A4.1 - R2.1.A4.5 - Appendices to R2.1: 'FRT compliance plan checklist' for September 2021, October 2021, November 2021, March 2022 and June 2022 pp.1-2.

[141] Privacy Act 1988 (Cth) s 2A(1).

[142] R4.1 - Respondent's submissions in response to the preliminary view dated 30 April 2025 pp.19-20.

[143] Australian Human Rights Commission, Human Rights and Technology - Discussion paper, December 2019.

[144] Wesfarmers Annual Report 2020 p.7.

[145] R4.2 - Witness Statement - Respondent's General Manager Central Operations and Safety dated 30 April 2025 p.5.

[146] See paragraph [102].

[148] Explanatory Memorandum - Privacy Amendment (Enhancing Privacy Protection) Bill 2012 (Cth) [79].

[149] Explanatory Memorandum - Privacy Amendment (Enhancing Privacy Protection) Bill 2012 (Cth) [79].

[150] R2.1 - Attachment to R2: Letter from the respondent to the OAIC dated 7 October 2022 p.3.

[151] R1.1.A.1 - Appendix 1 to R1.1: Answers to the questions in the OAIC notice p.15.

[152] R1.1.A.1 - Appendix 1 to R1.1: Answers to the questions in the OAIC notice p.13.

[155] R2.1.A1 - Appendix 1 to R2.1: Answers to the question in the OAIC notice p.2.

[156] Wesfarmers Annual Report 2021 p.9.

[157] Wesfarmers Annual Report 2022 p.9.

[158] R2.1.A1 - Appendix 1 to R2.1: Answers to the question in the OAIC notice p.2.

[159] R1.1.A1 - Appendix 1 to R1.1: Answers to the questions in the OAIC notice pp.13 and 16.

[160] R1.1.A9 - Appendix 9 to R1.1: Location and position of respondent's conditions of entry store signage; R1.1.A8 - Appendix 8 to R1.1: Respondent's conditions of entry store signage p.1.

[161] R2.1.A1 - Appendix 1 to R2.1: Answers to the questions in the OAIC notice p.6.

[162] R2.1.A1 - Appendix 1 to R2.1: Answers to the questions in the OAIC notice p.13.

[163] R2.1.A1 - Appendix 1 to R2.1: Answers to the questions in the OAIC notice p.13; R2.1.A4.1 - Appendix 4.1 to R2.1: FRT compliance plan checklist dated September 2021.

[164] R2.1.A4.1 - Appendix 4.1 to R2.1: FRT compliance plan checklist dated September 2021 pp.7-8, item 3b; R2.1.A4.2 - Appendix 4.2 to R2.1: FRT compliance plan checklist dated October 2021 pp.7-8, item 3b; R2.1.A4.3 - Appendix 4.3 to R2.1: FRT compliance plan checklist dated November 2021 pp.7-8, item 3b.

[165] R2.1.A4.1 - Appendix 4.1 to R2.1: FRT compliance plan checklist dated September 2021 pp.7-8, item 3b.

[166] R2.1.A4.1 - Appendix 4.1 to R2.1: FRT compliance plan checklist dated September 2021 pp.7-8, item 3b.

[167] R2.1.A4.2 - Appendix 4.2 to R2.1: FRT compliance plan checklist dated October 2021 pp.7-8, item 3b.

[168] R2.1.A4.4 - Appendix 4.4 to R2.1: FRT compliance plan checklist dated March 2022 pp.7-8, item 3b.

[169] R1.1.A7.1 - Appendix 7.1 to R1.1: ShrinK 365: FRT Guide dated November 2021 p.14.

[170] R1.1.A3 - Appendix 3 to R1.1: List of FRT stores.

[171] R1.1.A3 - Appendix 3 to R1.1: List of FRT stores.

[172] R1.1.A7.1 - Appendix 7.1 to R1.1: ShrinK 365: FRT Guide dated November 2021 p.14; R1.1.A7.2 - Appendix 7.2 to R1.1: ShrinK 365: FRT National Office Guide dated April 2022 p.18.

[173] R2.1.A1 - Appendix 1 to R2.1: Answers to the questions in the OAIC notice p.5.

[174] R1.1.A8 - Appendix 8 to R1.1: Respondent's conditions of entry store signage p.2; R1.1.A1 - Appendix 1 to R1.1: Answers to the questions in the OAIC notice p.13.

[175] R3.1 - Letter from the respondent to the OAIC dated 10 April 2025 pp.4-6.

[176] R1.1.A1 - Appendix 1 to R1.1: Answers to the questions in the OAIC notice pp.12 and 16.

[177] R1.1.A1 - Appendix 1 to R1.1: Answers to the questions in the OAIC notice p.12.

[178] R1.1.A11.1 - Appendix 11.1 to R1.1: Respondent's privacy policy dated 2018 - November 2021.

[179] R1.1.A11.2 - Appendix 11.2 to R1.1: Respondent's privacy policy dated November 2021 - May 2022.

[180] R1.1.A11.3 - Appendix 11.3 to R1.1: Respondent's privacy policy dated May 2022 - 15 July 2022.

[181] R1.1.A11.1 - Appendix 11.1 to R1.1: Respondent's privacy policy dated 2018 - November 2021.

[182] R1.1.A11.1 - Appendix 11.1 to R1.1: Respondent's privacy policy dated 2018 - November 2021 p.3.

[183] R1.1.A11.2 - Appendix 11.2 to R1.1: Respondent's privacy policy dated November 2021 - May 2022 pp.2 and 4; R1.1.A11.3 - Appendix 11.3 to R1.1: Respondent's privacy policy dated May 2022 - 15 July 2022 pp.2 and 3.

[184] R1.1.A11.2 - Appendix 11.2 to R1.1: Respondent's privacy policy dated November 2021 - May 2022 p.4; R1.1.A11.3 - Appendix 11.3 to R1.1: Respondent's privacy policy dated May 2022 - 15 July 2022 p.3.

[185] R1.1.A3 - Appendix 3 to R1.1: List of FRT stores.

[186] The figure of 17 months is based on the period of June 2020 to November 2021. That is, the respondent commenced operating the FRT system in its first store in June 2020, and privacy policy 1 ceased effect as of November 2021.

[187] R1.1.A3 - Appendix 3 to R1.1: List of FRT stores.

[188] 'ABR' and Civil Aviation Safety Authority (Privacy) [2022] AICmr53 (24 June 2022), [63].

[189] 'ABR' and Civil Aviation Safety Authority (Privacy) [2022] AICmr53 (24 June 2022), [107].

[190] R1.1.A11.1 - Appendix 11.1 to R1.1: Respondent's privacy policy dated 2018 - November 2021; R1.1.A11.2 - Appendix 11.2 to R1.1: Respondent's privacy policy dated November 2021 - May 2022; R1.1.A11.3 - Appendix 11.3 to R1.1: Respondent's privacy policy dated May 2022 - 15 July 2022.

[191] R1.1.A11.1 - Appendix 11.1 to R1.1: Respondent's privacy policy dated 2018 - November 2021 p.3.

[192] R1.1.A11.2 - Appendix 11.2 to R1.1: Respondent's privacy policy dated November 2021 - May 2022 p.2; R1.1.A11.3 - Appendix 11.3 to R1.1: Respondent's privacy policy dated May 2022 - 15 July 2022 p.2.

[193] R1.1.A11.2 - Appendix 11.2 to R1.1: Respondent's privacy policy dated November 2021 - May 2022 p.2; R1.1.A11.3 - Appendix 11.3 to R1.1: Respondent's privacy policy dated May 2022 - 15 July 2022 p.2.