19th September 2025 Cyber Update: Kmart's Facial Recognition Use Ruled Unlawful

The Update: Privacy Commissioner Carly Kind announced the finding yesterday, concluding that Kmart unlawfully collected biometric data from potentially hundreds of thousands of customers. Cameras at store entrances and at returns counters scanned faces and compared them against a watchlist of suspected offenders.

The regulator found Kmart failed to alert customers or obtain consent, breaching strict protections in the Privacy Act that apply to sensitive personal information. The retailer argued it could rely on an exemption in the Act covering unlawful conduct, but the Commissioner rejected this, saying the system captured people indiscriminately, offered little benefit in stopping fraud, and that less intrusive tools were available.

As part of the determination, Kmart must not reintroduce facial recognition in its stores, publish an acknowledgement of the breach, and place a formal apology prominently on its website.

“Customer and staff safety, and fraud prevention and detection, are legitimate reasons businesses might have regard to when considering the deployment of new technologies. However, these reasons are not, in and of themselves, a free pass to avoid compliance with the Privacy Act,” Privacy Commissioner Carly Kind said in the OAIC’s 18 September 2025 determination.

Kmart told the ABC it was disappointed by the outcome and is reviewing whether to appeal. “Like most other retailers, Kmart is experiencing escalating incidents of theft in stores which are often accompanied by anti-social behaviour or acts of violence against team members and customers,” the spokesperson said. They added that images were only kept when they matched known or suspected offenders and all other data was deleted, with no use for marketing.

Why it Matters: This is the second major ruling against a retailer’s use of biometric surveillance, following the OAIC’s 2024 decision against Bunnings. Together, the cases make clear that companies cannot roll out intrusive technologies without consent, transparency and proportionality.

For business, it sends a warning that the Privacy Act applies even when new technologies are used for loss prevention. For customers, it is a strong affirmation that biometric information, which is both unique and sensitive, cannot be collected behind the scenes without their knowledge.