Facts
Between June 2020 and July 2022 Kmart Australia ran a facial recognition system in 28 of its stores to detect refund fraud. Cameras captured the faces of everyone who entered those stores and everyone who came to a returns counter. The images were turned into biometric templates and checked against a database of people suspected of fraudulent returns; a match alerted staff, who were to review it manually before deciding on the refund. Shoppers were neither told nor asked for consent. Kmart says it kept only images matching a person of interest and deleted the rest. It switched the system off in July 2022, when the OAIC opened its investigation.
What was the legal question in Commissioner Initiated Investigation into Kmart Australia Limited (Privacy)?
Facial images and the templates derived from them are biometric, and therefore sensitive, information under the Privacy Act 1988, and may be collected only with consent unless an exception applies (APP 3.3). Kmart did not dispute that it lacked consent. It relied instead on a 'permitted general situation' under section 16A: collection the entity reasonably believes necessary to take appropriate action against suspected unlawful activity or serious misconduct. The Commissioner also had to decide whether Kmart had given adequate notice of the collection (APP 5) and whether its privacy policy described the kinds of information it collected and how (APP 1.3 and 1.4).
What did the Office of the Australian Information Commissioner (OAIC) decide?
Privacy Commissioner Carly Kind accepted that refund fraud could be unlawful activity and that Kmart genuinely believed action was needed, but held that it could not reasonably have believed the system was necessary. Less intrusive options, such as proof-of-purchase requirements, store layout changes and staff training, had not been properly considered. The system was of limited use, and the fraud it detected was small set against the intrusion on tens of thousands of shoppers suspected of nothing. She found breaches of APP 3.3, APP 5.1 and APP 1.3. Kmart must not repeat the conduct, must publish an apology and a detailed statement within 30 days, and must destroy the retained data after 12 months and a day.
Why does Commissioner Initiated Investigation into Kmart Australia Limited (Privacy) matter?
This is the OAIC's second determination on retail facial recognition, after Bunnings in October 2024. The Commissioner said the two cases differ considerably and that neither bans the technology: safety and fraud prevention are legitimate aims, but they do not excuse compliance with the Privacy Act. Commentators note her reminder that consent exceptions set a high bar. The determination weighs the value of fraud prevented against the scale of indiscriminate collection. Kmart's application is reported to be pending before the Administrative Review Tribunal, which in February 2026 held that Bunnings' use fell within the exception.
Related stages
The determination is dated 26 August 2025 and was announced by the OAIC on 18 September 2025. Kmart said it was disappointed and was reviewing its options for appeal. Ragtrader reported on 5 February 2026 that Kmart had applied to the Administrative Review Tribunal and that the review was undecided; no official record of the application or of a Tribunal decision was found for this entry. The October 2024 Bunnings determination and the Tribunal's decision of 4 February 2026 are covered in a separate entry.