FRT has higher protections under the Privacy Act as it collects “sensitive information”. Laws require the use of FRT to be necessary and proportionate, and for consent to be sought from individuals.

What did the Privacy Commission find?

She also concluded that the FRT system to prevent fraud was of “limited utility” and the breadth of use — which impacted thousands of individuals not suspected of return fraud — was a “disproportionate interference with privacy”.

“I do not consider that the respondent [Kmart] could have reasonably believed that the benefits of the FRT system in addressing refund fraud proportionately outweighed the impact on individuals’ privacy,” she stated.

Kmart ‘disappointed’ by the findings

“Like most other retailers, Kmart is experiencing escalating incidents of theft in stores which are often accompanied by anti-social behaviour or acts of violence against team members and customers. ”

They said “refund-related customer threatening incidents” had increased by 85 per cent from August 2024 to March 2025, which they added amounted to a “heightened risk of the refund task for team members”.

Kmart case differs ‘considerably’ from previous Bunnings finding

In October 2024, Bunnings was found to have breached privacy laws through its use of FRT in 62 stores.