Cybersecurity Policy Report, Use of Facial Recognition Tech Will Be Assessed Case-by-Case, Australian Regulator Says, (Sep 23, 2025)

By Tony Foley

Australian Privacy Commissioner Carly Kind issued comments last week on the consequences of a decision by the Office of the Australian Information Commissioner (OAIC) sanctioning retailer Kmart Australia Ltd. over its use of facial recognition technology (FRT) to address issues of retail fraud.

OAIC decision. In a Sept. 18 ruling, OAIC found that Kmart breached Australians’ privacy by collecting their personal and sensitive information through an FRT system. Between June 2020 and July 2022, Kmart employed FRT to capture the face of every person who entered 28 of its retail stores and all individuals at refund counters in an attempt to identify people committing retail fraud. OAIC found that Kmart did not notify shoppers or seek their consent to use FRT to collect their biometric information, which is sensitive personal information subject to added restrictions under the Privacy Act 1988.

Specifically, the OAIC found that the collection and use of such information must be proportionate and transparent, requiring notification and the consent of individuals absent a statutory exception. In this case, Kmart alleged that it was entitled to an exception for “permitted general situations,” which allow organizations to collect, use, and disclose sensitive information in certain situations, including when necessary to address unlawful activity or serious misconduct. OAIC disagreed, finding that the collection of biometric data of all customers entering 28 locations, when only a small portion may have been involved in or suspected of fraud, was a disproportionate interference with privacy.

Commissioner Kind’s comments. In a blog post published the same day as the decision, Commissioner Kind acknowledged that it might appear that decisions in the Kmart case and a similar case against another retailer regarding the use of FRT amounted to a ban on FRT but called any such suggestion incorrect, noting that the Privacy Act is technology neutral.

“My decision that Kmart’s use of FRT for refund fraud detection was disproportionate in the circumstances provides further guidance on how the regulator will approach this assessment and the matters we will take into account when deciding whether use of FRT is permissible in the circumstances,” Commissioner Kind said. “As Privacy Commissioner, I will consider each use of FRT that my office investigates on a case-by-case basis, taking into account the specific contextual factors at play.”

Commissioner Kind discussed the issues she considered in both cases, as well as other unique questions that may arise that will require consideration under the Privacy Act, like determining individuals’ expectations of privacy in a public space, whether a specific destination is a place to which people must go as part of daily life, and whether FRT is being used when other, less intrusive alternatives are available.

“In the absence of parliamentary intervention to specifically authorize the use of FRT systems without consent, these are the kinds of considerations I will continue to bring to my application of the Privacy Act to these emerging technologies,” she said.

News: LitigationEnforcement DataPrivacy InternationalLegislation