Date published: 11 November 2025 | Author: Nina Rossi

Retailers using facial recognition technology (FRT) or similar tools, including video surveillance, are under increasing scrutiny. A recent decision by the Privacy Commissioner highlights what businesses must do to stay compliant and avoid penalties.

Kmart, for example, now faces findings that its notices and disclosures about FRT were not sufficient. The decision is a timely reminder that privacy compliance is not just about putting up a sign at the door.

What should retailers check?

• Assess privacy risks: Consider how many people are affected, the sensitivity of the data, and whether your business has the resources to manage compliance.
• Go beyond entry notices: A simple CCTV sign is not enough. You must explain why you are collecting personal information, what happens if someone refuses, and how they can access or correct their data.
• Display clear collection notices: Make sure notices are prominent, accessible and direct people to more detailed information.
• Obtain consent for sensitive data: Biometric information, such as facial recognition metadata, is sensitive and requires consent.
• Be transparent: Your privacy policy should clearly set out the types of personal information collected, including any additional data generated by the technology.

Taking these steps now will help retailers avoid regulatory action and build trust with customers.

You’re in control when you understand your legal position. 

Contact Rossi Law today to review your systems and ensure compliance.

Legal Disclaimer: This blog is based on a video recorded by Rossi Law. It was first drafted with AI-assistance and reviewed by Rossi Law before publication. It provides general information only and is not legal advice. Please seek advice for your specific situation.