Kmart’s Facial Recognition Trial – Failing the Proportionality Test on Facial Recognition 

The success of Bunnings’ appeal to the ART (covered in our blog post here), has been taken by many retailers as a green flag for the use of Facial Recognition Technology to identify unwanted shoppers.   

It’s worth noting the OAIC’s Kmart Determination, handed down on 26 August 2025, which has not been appealed.  

Key Takeaways: 

• Although similar to the much-publicised Bunnings decision, Kmart’s business case for FRT was found to be weak on the evidence (a small proportion of overall fraud detected, no real assessment of alternatives), whereas Bunnings could point to a more concrete safety rationale tied to a defined cohort of previously violent or banned individuals. 

• In order to use FRT without getting consent of individuals in retail settings, organisations will need to justify their use with genuine evidence that less privacy intrusive alternatives were considered and with compelling evidence of FRT’s effectiveness at addressing specific safety and security concerns.  

• Opinions and experiences of staff and management are probably not sufficient in justifying use of privacy invasive technology. Evidence of genuine evaluation of alternatives and privacy impact assessments are needed. 

Difference Between the Kmart and Bunnings FRT 

Kmart trialled an FRT system in 28 stores for about two years. It was designed to catch refund fraud, people trying to return items they hadn’t actually bought, with safety cited as an afterthought. In contrast, the Bunnings use case was focused on the safety and security threat to staff and other shoppers posed by violent or unruly individuals.  

In its basic operations, there was a lot of similarity in the two cases. The Kmart trial used CCTV cameras both at store entrances and at the returns counter to capture facial images of everyone who walked in and compared it against two databases. 

There was a “History Database” that temporarily held the face data of everyone who entered a store, and also an “Enrolment Database” of people Kmart had flagged as suspected fraudsters, sometimes including people who had been threatening towards staff. If a customer’s face matched someone in the Enrolment Database, staff at the returns counter would get an alert. 

Kmart stopped using the system in July 2022, shortly after the Commissioner opened an investigation. 

Exception to Consent Requirement 

As with the Bunnings case, the key issue was whether the store could rely on an exception in APP 3.4 which allows for the collection of sensitive information without consent if a permitted general situation (PGS) exists.  The general situation in question was the same one that Bunnings relied on – unlawful activity or misconduct of a serious nature. In both cases, the store said they reasonably believed that the use of FRT was necessary in order to take appropriate action.  

Proportionality is the Key 

Kmart couldn’t convince the Commissioner that they had a reasonable belief that FRT was proportional.  

On the burden side, it was good to see the Commissioner recognise that use of this technology does come with real risk of harm to innocent people. We have seen examples in recent months of false positives and the embarrassment, humiliation and hassle imposed when that happens. 

In terms of the proportionality calculation, we are in tricky territory in assessing the Commissioner’s judgments on the various factors regarding fraudulent returns because the juicy detail was redacted from the published Determination.  

Presumably the rationale was that neither the OAIC nor Kmart wanted to be providing handy tips to fraudsters.  

The exact dollar figures and prevented fraud incidents that FRT might have delivered Kmart and the type of fraudulent tactics that the system was good at catching vs not so good at catching is therefore a bit of a mystery. 

Notably the Commissioner didn’t believe evidence from the ‘compelling lived experience of its senior management’ was enough:  

“There is no evidence, for example, of project planning documents or a privacy impact assessment having been conducted prior to the implementation of the FRT pilot program, that demonstrates the respondent considered other, less privacy intrusive, options to minimise the risk of refund fraud and the basis upon which alternatives were considered to be ineffective or not viable.” 

The Commissioner argued, similar to the Bunnings case, that: 

The system wasn’t very effective. Kmart’s own figures showed the FRT system only caught a small number of fraud incidents, worth a fairly modest amount of money compared to the scale of Kmart’s business.  

There were less invasive alternatives Kmart hadn’t properly explored. The Commissioner pointed out several options Kmart could have tried instead, such as (pretty obviously) requiring proof of purchase for refunds, relocating returns counters closer to store entrances, and using more staff trained to spot suspicious behaviour.  

Notably, Kmart eventually did tighten its returns policy in 2024, requiring proof of purchase. The Commissioner found no evidence Kmart had seriously assessed these options before rolling out FRT. 

The privacy impact didn’t justify the benefit. Kmart scanned the faces of potentially tens of thousands of people, in order to catch a comparatively small number of fraudulent returns.  

There wasn’t enough notification: The entry signage was vague, it didn’t explain the purpose of the collection and what to do if someone didn’t want their face scanned. Some stores had no signage at all for months after FRT was already running. Kmart’s internal guide even instructed staff not to tell customers about the technology if asked. Kmart’s privacy policy didn’t mention FRT at all until November 2021, well after the system had already been operating in multiple stores. 

The Commissioner also found Kmart’s privacy policies failed to properly disclose what kinds of personal information it was collecting and how. 

A Distinction on the Facts 

We can only speculate about why there was no appeal in this case, but it does seem likely there were some bigger factors weighing against FRT as proportionate in the Kmart case. 

The two factors that spring to mind are that obvious alternatives like requiring a receipt for any returns hadn’t been adopted yet, and that the primary purpose of the system was fraudulent returns rather than dealing with violent individuals and threats to staff as in the Bunnings case.  

While the circumstances of both this and the Bunnings case are quite specific to large-scale retail, both Determinations provide useful insights on the attitude of the regulator for organisations dealing with large numbers of people. The key message is that FRT does come with potential risk of harm to innocent people and it isn’t something you should do without a really good reason.