A watchdog has ruled the retail giant breached privacy laws when it used CCTV to capture the face of every person who entered 63 stores in NSW and Victoria in the three years to November 2021.
Bunnings says it will fight the decision by the Office of the Australian Information Commissioner in the Administrative Review Tribunal.
The company trialled the technology to tackle crime and violence against staff in its stores, managing director Mike Schneider said.
"Our use of FRT was never about convenience or saving money but was all about safeguarding our business and protecting our team, customers and suppliers from violent, aggressive behaviour," Mr Schneider said.
About 70 per cent of incidents were caused by "the same group of people", the company said.
"FRT provided the fastest and most accurate way of identifying these individuals and quickly removing them from our stores."
CCTV footage released by Bunnings showed staff being threatened with guns and knives, punched in the face and knocked to the ground by alleged offenders.
The technology's potential to protect against crime and violent behaviour needed to be weighed against the public's right to privacy, Privacy Commissioner Carly Kind said.
Bunnings will appeal against a privacy ruling, managing director Mike Schneider says. (Supplied by Bunnings/AAP PHOTOS)
"Individuals who entered the relevant Bunnings stores at the time would not have been aware that facial recognition technology was in use and especially that their sensitive information was being collected, even if briefly," she said.
The determination found Bunnings had taken customers' private information without consent, failed to take steps to notify them and had left gaps in its privacy policy.
Commissioner Kind said the technology was an intrusive option that interfered with all customers' privacy, not just high-risk individuals.
The Privacy Act classifies individual facial images and other biometric information as sensitive information with a high level of privacy protection.
The watchdog said it would not pursue civil penalties over the breaches and noted Bunnings' cooperation during the more than two-year investigation.
"Facial recognition technology, and the surveillance it enables, has emerged as one of the most ethically challenging new technologies in recent years," Commissioner Kind said.
The commissioner has released a privacy guide for companies considering using facial recognition tech.
Bunnings says attacks by shoppers against its staff have been increasing. (Dave Hunt/AAP PHOTOS)
The Australian Retailers Association has defended Bunnings and called for a review of the decision and for more consultation with retailers and authorities.
"Workers and shoppers are facing aggravated abuse and assault all too often," chief industry affairs officer Fleur Brown said.
"No one should be fearing for their safety in a retail setting."
Consumer advocate CHOICE said the use of facial recognition technology had only grown in the years since the commissioner's review began.
"While the decision from the Office of the Information Commissioner is a strong step in the right direction, there is still more to be done," CHOICE's campaigns and policy advisor Rafi Alam said.
"CHOICE is continuing to call for a specific, fit-for-purpose law to hold businesses accountable as soon as they breach customer privacy."
