A three year long investigation by the Privacy Commissioner has confirmed what CHOICE suspected
Kmart’s facial recognition technology broke the law, commissioner rules
A three year long investigation by the Privacy Commissioner has confirmed what CHOICE suspected
Last updated: 18 Sep 2025
Retail giant Kmart has been found to have breached the Privacy Act with its facial recognition program, three years after a CHOICE expose revealed the invasive technology was in use across Australia.
In 2022, CHOICE reported that Kmart, along with Bunnings and The Good Guys were capturing the biometric data, or unique facial features known as a ‘face print’, of customers entering their stores.Â
Our investigation prompted the Office of the Australian Information Commissioner (OAIC) to launch a probe into whether privacy laws had been breached with the Facial Recognition Technology (FRT).
In 2024, Privacy Commissioner Carly Kind found that Bunnings had breached the law and today an announcement was made that Kmart had done so too.Â
Kmart sought to justify its use of FRT in stores between June 2020 and July 2022 as a measure to prevent refund fraud. However, the Commissioner said Kmart did not seek customer consent to collect biometric information and its collection was not proportional, as there were other means available to address refund fraud.Â
“I do not consider that the respondent (Kmart) could have reasonably believed that the benefits of the FRT system in addressing refund fraud proportionately outweighed the impact on individuals’ privacy,” Kind says.Â
No penaltyÂ
OAIC did not seek a financial penalty against Kmart in this case, similar to the case with Bunnings last year.Â
In a statement a Kmart spokesperson says they are “disappointed” with the ruling and are reviewing options to appeal the determination.Â
“Like most other retailers, Kmart is experiencing escalating incidents of theft in stores which are often accompanied by anti-social behaviour or acts of violence against team members and customers,” the spokesperson says.Â
Commissioner Kind says that despite the two rulings against Bunnings and now Kmart, FRT was not ‘banned’ in Australia.Â
“The human rights to safety and privacy are not mutually exclusive; rather, both must be preserved, upheld and promoted. Customer and staff safety, and fraud prevention and detection, are legitimate reasons businesses might have regard to when considering the deployment of new technologies. However, these reasons are not, in and of themselves, a free pass to avoid compliance with the Privacy Act,” she stated.
Related
We compare the privacy policies of Australia's most popular car brands to see how they track and monitor drivers.
A new report looks at the time it takes for Australians to manage their privacy.
These devices collect a lot of dirt – they also clean. Here’s what they could have on you and how you can protect your privacy.