"Kmart broke privacy laws by using facial recognition technology, commissioner finds", 18 September 2025

Retail giant Kmart broke privacy laws by using facial recognition technology (FRT) on its customers, the privacy commissioner has found.

Over the two years until July 2022, Kmart captured the facial data of "tens or hundreds of thousands" of customers at store entrances and return counters, in an attempt to tackle refund fraud.

Facial recognition technology maps a person's unique facial features and compares them against a database of other faces.

Major retailers and public venues say the technology can be helpful in detecting repeat offenders and preventing crime. [...]

Kmart told the ABC in a statement it was disappointed with the Privacy Commissioner's determination and is reviewing its options for appeal.

"Like most other retailers, Kmart is experiencing escalating incidents of theft in stores which are often accompanied by anti-social behaviour or acts of violence against team members and customers," a company spokesperson said. 

Kmart said images were only retained "if they matched an image of a person of interest reasonably suspected or known to have engaged in refund fraud.

"All other images were deleted, and the data was never used for marketing or any other purposes.

"Kmart remains committed to finding tools to reduce crime in our stores, so we deliver on team member and customer safety."