Facial recognition CCTV used to sound like something for airports and casinos. Now it turns up in the feature lists of ordinary cameras and recorders, and it has been in the news since the Privacy Commissioner found big-name Australian retailers had breached privacy law by using it. If you run a shop, warehouse, gym or office in Perth, you may be asking two questions: could this help with our theft problem, and would we be allowed to use it?
The short answer to the second question is that the bar is high.
Why this is suddenly on every business owner’s radar
In November 2024 the Australian Privacy Commissioner found that Bunnings had breached the Privacy Act through its use of facial recognition in stores. A similar finding against Kmart followed in 2025. Bunnings took its matter to the Administrative Review Tribunal, and the Office of the Australian Information Commissioner (OAIC) says the Tribunal affirmed aspects of the original determination and confirmed there is a high bar for using this technology in Australia. The Kmart matter is still under review, with hearings scheduled for early 2027.
On 29 July 2026 the OAIC published updated guidance that reflects the Tribunal’s findings. Two points stand out. The Privacy Act is technology-neutral, so it neither bans nor specifically permits facial recognition. And each proposed use has to be assessed against the Act on its own facts, with the OAIC describing a precautionary approach as what Australian law requires.
Ordinary CCTV and facial recognition are not the same thing
A standard camera records what happens in front of it. That footage can still be personal information when people in it can be identified, which is why the rules on what your cameras can record in WA matter for every system. Facial recognition goes a step further. It turns a face into a biometric template and compares it against other faces, often in seconds.
The OAIC treats biometric templates and biometric information, including facial images used for automated verification or identification, as sensitive information. Sensitive information generally gets a higher level of protection under the Act, so the move from recording a face to matching a face is a real legal shift and not just a software upgrade.
It also helps to separate face detection from face recognition. A camera that alerts you when a person or a face appears is doing something different from a system that works out who that person is. When you are comparing security camera systems for a business, ask exactly which function is included and whether it is switched on.
Five questions to answer before you switch it on
What problem are you actually trying to solve?
Repeat shoplifting by a small group, staff safety at closing time and after-hours break-ins all call for different responses. The OAIC expects businesses to genuinely consider less privacy-intrusive options, and it points to measures such as good quality CCTV coverage, security guards, staff training and closer engagement with police.
Is it proportionate?
Facial recognition usually scans everyone who walks past the camera, not just the few people you are concerned about. Weigh the benefit against that wider impact. A serious, repeated safety risk is a very different starting point from minor or occasional problems.
Do you have valid consent, or a clear exception?
Sensitive information generally needs valid consent unless a narrow exception applies. The OAIC calls the exceptions a high bar. A sign at the door will not normally amount to consent on its own.
Will people genuinely be told?
Telling people that “video surveillance is in use” is not enough. The guidance expects notices to identify that facial recognition is operating, where it is used and why. Your privacy policy needs to say the same thing.
Have you assessed the privacy risk in writing?
The OAIC says businesses considering facial recognition should complete a privacy impact assessment at the outset. That means looking at accuracy and bias, how templates are secured, who can see them, and when they are destroyed.
Does the small business threshold take you out of this?
Not automatically. The OAIC describes a small business as one with an annual turnover of $3 million or less, and many of those are outside the Privacy Act. But turnover counts all income from all sources, and some businesses are covered whatever they earn. The list includes health service providers, businesses trading in personal information, and businesses related to one the Act already covers.
Being outside the Act would not settle how your customers and staff feel about it either. If you are close to the line or part of a group, get legal advice before you rely on the exemption.
What to ask your security installer
A good installer should be able to answer these in plain language:
- Does this camera, recorder or software include any face matching function, and is it enabled by default?
- Where are images and any templates stored, and is that onsite or with a cloud provider?
- Who can access them, and is that access logged?
- How long is footage kept, and can the retention period be changed?
- What can the system do without any face matching at all?
That last question often settles it. Well placed cameras, clear coverage of entries and exits, and sensible recording settings solve many of the problems that lead people to look at facial recognition in the first place. The same thinking applies at the door. If you are looking at face or fingerprint readers for staff, read our comparison of biometric access and key cards first, since a card based access control system may give you the audit trail you need without collecting biometric information.
This article is general information and not legal advice. For your own situation, check the current OAIC guidance or speak with a privacy lawyer.
Frequently asked questions
Does every CCTV system count as facial recognition?
No. A standard system records video and does not create biometric templates to match faces. The footage can still be personal information if people can be identified, so normal privacy and surveillance rules still matter.
Is a sign at the entrance enough?
Usually not. A sign can help with telling people what is happening, but the OAIC says signage alone will not normally amount to consent, and general wording about CCTV does not properly explain that facial recognition is in use.
Our camera has a face recognition setting. Can we leave it off?
Yes, many systems let you run without it. Ask your installer to confirm that the function is disabled, that no face library or templates are being kept, and to note the settings for your records.
Do fingerprint or face readers for staff doors raise the same issues?
They can. The OAIC treats biometric information used for automated verification as sensitive information as well, so consider consent, security and whether a card or fob would do the job.
Why is the Kmart case still in the news?
Kmart’s matter remains under review at the Administrative Review Tribunal, with hearings scheduled for early 2027. Businesses should keep an eye on the outcome and on any further OAIC guidance.
Get a clear answer on what your cameras are doing
Not sure whether your current system includes face matching, or looking for a practical way to protect your Perth business without it? Talk to VG Techs and we will walk through your site, your risks and your options in plain language. Call 0472 652 026 or email admin@vgtechs.com.au, Monday to Friday, 8am to 6pm. Security Licence No. 71264, WA Security Provider 7126, Master Cabler A045514.