Every person who entered

‘Between June 2020 and July 2022, Kmart deployed FRT to capture the faces of every person who entered 28 of its retail stores,’ the Office of the Australian Information Commissioner said in a release dated 18 September 2025 ¹. Kmart deployed it to tackle refund fraud, the release states ¹. Kmart stopped operating the system in July 2022, when the OAIC began investigating it, and has cooperated with the OAIC throughout the investigation, the release states ¹. On 26 August 2025 the Privacy Commissioner determined that Kmart’s use of it was unlawful, a finding Kmart has since taken to a tribunal for review.

The finding carried no penalty, and none was ever available to it in that form. A privacy determination cannot carry a fine; only a court can impose one, on the Commissioner’s application, for conduct of this period, for a serious or repeated interference. This article sets out what the law let the regulator order instead, for Kmart and for two related findings, against Bunnings and Clearview AI.

01What the law allows

Under the Privacy Act, only a court can impose a civil penalty for a privacy contravention, and only on the regulator’s own application. ‘The Australian Information Commissioner may apply to the Federal Court for a civil penalty order where an entity is alleged to have engaged in serious or repeated interferences’, the OAIC’s own description of that power reads ². A determination made after a Commissioner-initiated investigation, the kind made against Kmart, cannot itself carry that penalty.

That court route existed for conduct of this period, including Kmart’s: section 13G of the Act, the serious-or-repeated-interference provision, predates the 2024 amendments that amended it only for conduct after their commencement ³. So far as the regulator’s published statements about these three matters show, it has not applied to a court for a civil penalty over any of them ^19101113. This article draws no inference about why.

A determination can, separately, declare compensation. Section 52(1A)(d) of the Act lets the Commissioner do that after a Commissioner-initiated investigation, and none was declared in the Kmart matter. ‘The Commissioner also has power to award compensation following a determination made after an investigation conducted on the Commissioner’s own initiative,’ the OAIC’s guide states, adding that its usual practice runs the other way: ‘Rather than awarding compensation by determination, the OAIC would typically inform affected individuals to make a complaint about the act or practice if the individual believes he or she has suffered compensable loss or damage’ ⁴.

Parliament added a mid-tier civil penalty to the Act in 2024, and extended infringement notices to some breaches of the Australian Privacy Principles. Both commenced on 11 December 2024 and, under the amending schedule, apply only to conduct from that date ³. Kmart’s conduct ran to July 2022. The Bunnings determination, dated 29 October 2024, examined earlier conduct; the Clearview AI determination is dated October 2021. None of the three could have been reached by the newer powers.

02Kmart

Kmart’s determination is [2025] AICmr 155. It is dated 26 August 2025 ⁵ but was published on 18 September 2025 ¹, and its 30-day compliance windows run from the publication date, not the earlier one.

Kmart has contested the finding. It applied to the Administrative Review Tribunal for review of the determination. The OAIC’s 29 July 2026 release announcing updated guidance states that the matter ‘remains under review in the ART with hearings scheduled for early 2027’ ⁶; the trade outlet Ragtrader independently reported the review application in February 2026: ‘Kmart has also filed for a review in the Administrative Review Tribunal (ART), with that verdict yet to be handed down’ ⁷.

Ragtrader reported Kmart’s account of the system. In a statement issued in 2025 after the determination, a Kmart spokesperson said Kmart was ‘disappointed’ with it. The spokesperson said Kmart had ‘conducted a limited trial of FRT, commencing in one store, and extending to another 27 stores with high levels of refund fraud between June 2020 to July 2022’, that ‘We implemented controls to protect the privacy of our customers’, and that ‘Images were only retained if they matched an image of a person of interest reasonably suspected or known to have engaged in refund fraud. All other images were deleted, and the data was never used for marketing or any other purposes.’ ⁷ The spokesperson also said Kmart was experiencing escalating incidents of theft in stores, often accompanied by anti-social behaviour or violence against team members and customers ⁷.

What the determination required, beyond the finding itself, is specific. Under section 52(1A), it required Kmart not to repeat or continue the collection and notice practices found unlawful and, within 30 days of publication, to publish an apology on its website and in the relevant stores for at least 30 days, and publish a statement, prominent on its homepage for at least 30 days, describing the facial recognition system, saying that no consent was sought, and explaining how to complain. The declarations also required Kmart to keep that statement accessible for 12 months after publication, retain the facial recognition information for those 12 months, then destroy it, and confirm the destruction to the OAIC in writing.

On 7 October 2026 the Privacy Commissioner, Carly Kind, published a blog headed ‘Smart glasses under the microscope’ ⁸. It says that since August 2026 the OAIC has undertaken preliminary inquiries with five entities providing smart glasses hardware or software, among them Kmart, which it lists among the ‘retailers which sell smart glasses only and do not develop or operate the underlying software for the device’, and that the OAIC has opened a formal investigation into one software provider ⁸. It says the OAIC has not decided to commence an investigation into any of the other entities at this time, and that this ‘should not be read as any conclusive statement about the compliance or otherwise of the entities under scrutiny’ ⁸. It also says that ‘we have not yet identified the use of facial recognition capabilities in smart glasses devices available on the Australian market’ ⁸. Its reference to Kmart concerns smart glasses that Kmart sold. It does not mention the determination of 2025 or the in-store system described above.

Update, 22 October 2026. Ragtrader reported on 9 October 2026, before this article was published, that Kmart had stopped selling its $89 Anko smart glasses ¹⁶. Information Age had reported the day before that Kmart had stopped selling them online ¹⁷.

03Bunnings, then Clearview AI

The Privacy Commissioner’s determination against Bunnings was dated 29 October 2024 ¹⁵ and published on 19 November 2024 ⁹. It found that Bunnings had collected sensitive information without consent ⁹, a breach of Australian Privacy Principle 3.3 ¹⁰. On 4 February 2026 the Administrative Review Tribunal’s Guidance and Appeals Panel ¹⁰¹¹ departed from that finding. The OAIC’s own statement on the decision states that ‘the Tribunal departed from the Privacy Commissioner’s ultimate finding that Bunnings had contravened APP 3.3’, and that the Tribunal ‘was satisfied that Bunnings was entitled to rely on exemptions to the requirement to obtain consent, for the limited purpose of combatting retail crime and protecting their staff and customers from violence, abuse and intimidation within their stores’ ¹⁰.

Two other findings against Bunnings were affirmed: ‘The Tribunal affirmed the Privacy Commissioner’s finding that Bunnings contravened Australian Privacy Principles (APP) 1 (open and transparent management of personal information) and 5 (notification of the collection of personal information) when rolling out FRT in its stores’, the same statement records ¹⁰. The OAIC adds that the decision ‘reaffirmed a range of key interpretive positions taken by the OAIC’ ¹⁰. On 5 March 2026 the Privacy Commissioner said: ‘I have not filed an appeal of this decision’ ¹¹.

Bunnings says on its website that it has not used facial recognition technology since its trial in 63 stores in Victoria and New South Wales ended in November 2021, and that it is preparing to introduce the technology across its Australian store network in a phased approach, completing a privacy impact assessment before it does, and that it is developing privacy safeguards, customer information and signage before the technology is introduced ¹². THE RORT asked Bunnings on 2 October 2026 when that introduction would begin and how Bunnings would notify customers in its stores. Bunnings replied the same day. Its reply, in full apart from the greeting and sign-off, reads: ‘Thanks for your email and interest in our use of FRT.’ ‘We don’t have any further information on timings to share at this time - all information on our website is up to date so you are welcome to draw from this in your article.’ ‘Very happy to keep you in the loop however as this work progresses?’ (The email has a dash where this article prints a hyphen.) The reply gives no date for the introduction.

Clearview AI was found in breach, and nearly three years later the Privacy Commissioner said further action was not warranted. The determination, dated 14 October 2021, found Clearview AI in breach of the Privacy Act; the OAIC said in August 2024 that it and its declarations still stand. The OAIC’s statement says that, after the Administrative Appeals Tribunal found that Clearview AI had breached certain of the Australian Privacy Principles, Clearview AI withdrew from the proceedings in August 2023 ¹³. On 21 August 2024 the Privacy Commissioner said: ‘I have given extensive consideration to the question of whether the OAIC should invest further resources in scrutinising the actions of Clearview AI, a company that has already been investigated by the OAIC and which has found itself the subject of regulatory investigations in at least three jurisdictions around the world as well as a class action in the United States. Considering all the relevant factors, I am not satisfied that further action is warranted in the particular case of Clearview AI at this time.’ The statement adds that the determination against Clearview AI still stands ¹³.

04The state’s own facial recognition

Retail facial recognition of shoppers is not the only kind in view: THE SURVEILLANCE RORT’s ‘The order that replaces the warrant’ reports that a NSW bill as introduced would enrol NSW driver-licence photos in the National Driver Licence Facial Recognition Solution (that article’s updates say the bill has since passed the NSW Parliament and was assented on 1 October 2026, with commencement unconfirmed), a different mechanism, run by government rather than by a retailer.

05What none of it reached

So far as the regulator’s published statements show, none of the three findings has reached a court on a penalty application. Kmart’s determination, now under review, the findings against Bunnings the Tribunal affirmed, and Clearview AI’s determination are the outcomes on this record ^16101113.

The 2024 powers do not change that account of these three matters. They reach only conduct from 11 December 2024, so the conduct each determination examined, all of it earlier, could not have been reached by them ³. This article makes no claim about whether the OAIC has used those newer powers anywhere else.

Right of reply: offered by email on 2 October 2026 to the Office of the Australian Information Commissioner, to Kmart and to Bunnings, with a response requested by 5pm AEDT on Thursday 8 October 2026. THE RORT sent Kmart’s question, which concerned its application for review of the determination, to the media address of its parent company, Wesfarmers, because it could find no media address published for Kmart itself. The OAIC’s questions on these matters included whether an application to the Federal Court under section 13G of the Privacy Act was considered in the Kmart or Bunnings matters. No response was received from the Office of the Australian Information Commissioner by the deadline, 5pm AEDT on Thursday 8 October 2026. No response was received from Kmart by the deadline, 5pm AEDT on Thursday 8 October 2026. Bunnings replied on 2 October 2026; its reply is reported in the section on Bunnings above. Bunnings also responded on 8 October 2026, on background. The statements this article makes about Clearview AI were offered to it by email on 9 October 2026, with a response requested by 5pm AEDT on Friday 16 October 2026. That email reached Clearview AI on 10 October 2026, because of a delay on THE RORT’s own mail server. No response was received from Clearview AI by the deadline, 5pm AEDT on Friday 16 October 2026. This article states no reason why no court application appears to have been made.

A finding is not a fine.

If it’s a rort, we cover it.