Landmark ruling by Australian regulator sets guardrails for commercial use of facial recognition tech

Australia’s OAIC ruled that Bunnings unlawfully deployed in-store facial recognition across 63 stores (2018–2021) without notification or consent, ordering the retailer to halt the program, delete collected biometric data, and publicly disclose its mishandling within 30 days and complaint process; the regulator emphasized proportionality/necessity and consent requirements under the Privacy Act, while Bunnings defended the system as a safety measure targeting repeat violent offenders and said data was not used for marketing; the piece also notes parallel scrutiny in the U.S., including an FTC order against Rite Aid and congressional questions to Kroger.