Australia · Privacy and data governance
Updated facial-recognition guidance raises the bar for retail deployment
The OAIC updated its guidance for Australian Privacy Principle entities considering facial recognition in high-volume, publicly accessible spaces such as retail shopfronts. The guidance reflects the Bunnings ART decision, treats biometric templates and information used for automated identification as sensitive information, and says each proposed deployment needs its own assessment. It is not a blanket ban or approval.
What this means
Understand the practical effect.
The OAIC updated its guidance for Australian Privacy Principle entities considering facial recognition in high-volume, publicly accessible spaces such as retail shopfronts. The guidance reflects the Bunnings ART decision, treats biometric templates and information used for automated identification as sensitive information, and says each proposed deployment needs its own assessment. It is not a blanket ban or approval.
What to do
Turn the update into action.
Do not procure or switch on facial-recognition technology until the business has documented the purpose, lawful collection pathway, necessity and proportionality, transparency, accuracy and bias controls, security, retention and ongoing governance for the specific deployment.
- Conduct and document a privacy impact assessment before deployment and revisit it when the purpose, location, watchlist, vendor or technical design changes.
- Identify whether valid consent is available or a narrow statutory exception can genuinely be established; do not treat signage alone as resolving collection lawfulness.
- Test notices, access controls, accuracy, bias, human review, security, retention and deletion across the retailer and technology provider.
- Prepare a governance record that explains why the system is necessary and proportionate and how it will be monitored, challenged, suspended and retired.
Official sources
Check the controlling material.
Practical support
Apply this update to your business.
Confirm the products, customer journeys, claims, suppliers or processes affected, then identify the evidence, ownership and timing needed for a defensible response.
Watchdog can assess the update against your circumstances and recommend the most useful next step.
Important information
Check the current position.
This update is general information, not legal advice. Laws, official guidance and proceedings can change. Check the current source and your specific facts before acting.