Kmart looking to appeal watchdog’s privacy breach ruling over retailer’s use of facial recognition technology

Kmart will look to fight a finding it broke privacy laws by using facial recognition cameras on customers, which the retailer says is needed to curb increasing theft and violence in its stores.

Kmart placed the technology — which used CCTV to check everyone entering the stores against a database of banned customers — at entrances and return counters in 28 stores across the country to detect refund fraud for two years until July 2022.

In a decision on Thursday, Federal Privacy Commissioner Carly Kind found the chain did not notify shoppers or seek consent to use the technology to collect their biometric information, “which is sensitive personal information and enjoys higher protections under the Privacy Act”.

It comes as major retailers push for stronger laws to curb soaring levels of crime and violence faced by their workers.

According to the latest figures from the Australian Bureau of Statistics, theft spiked to a 21-year high last year, with police recording 268,666 incidents at retail locations.

Kmart and hardware giant Bunnings — both owned by WA conglomerate Wesfarmers — have been under investigation by the Office of the Australian Information Commissioner since July 2022 over the use of facial recognition technology and whether it was consistent with privacy laws.

Both chains paused the use of the technology when the investigation started.

The national Privacy Commissioner last November found Bunnings breached privacy rules by trialling facial recognition at some of its stores.

Commissioner Kind said at the time Bunnings collected individuals’ sensitive information without consent, failed to take reasonable steps to notify individuals that their personal information was being collected and did not include required information in its privacy policy.

Bunnings is seeking a review by the Administrative Review Tribunal.

Following the decision in November, Bunnings managing director Mike Schneider said the technology should be an important tool in combating the rising incidence of theft and violent and aggressive behaviour across the retail sector.

Wesfarmers boss Rob Scott last month demanded the Victorian government introduce tougher penalties to stem retail losses running at “hundreds of millions of dollars a year”.

The company has already advocating for retailers to be able to selectively use facial recognition technology to identify known offenders in their stores.

On Thursday, Kmart said it was reviewing its options to appeal the decision.

A Kmart spokeswoman said like most retailers, it was experiencing escalating incidents of theft in stores, which were often accompanied by anti-social behaviour or acts of violence against team members and customers.

She noted the use of the facial recognition technology was only used for a limited trial to specifically tackle “a growing problem of refund fraud in stores”.

Controls to protect consumer privacy were implemented, she said.

“Images were only retained if they matched an image of a person of interest reasonably suspected or known to have engaged in refund fraud. All other images were deleted, and the data was never used for marketing or any other purposes.”

Between August 2024 to March 2025, refund-related customer threatening incidents at Kmart rose by 85 per cent, while customer threatening incidents unrelated to refund requests increased by 28 per cent over the same period, the company spokeswoman said.