Petition Bunnings

This petition is now live – the first letter (below) was sent to frt@bunnings.com.au on Sunday 22nd February 2026 on behalf of the signatories (55 signatories at that time).

If you’d like to edit the message, just copy relevant text from this page, edit as you wish and send directly to frt@bunnings.com.au.

Each week collected signatures will be sent to Bunnings until a substantive response is received and relevant material is published.
Only Christian name plus first letter of family name, and State, will be provided to Bunnings.

No identifying data collected by this form (email/IP addresses) will be stored, shared, sold or used in ANY way, other than to contact you if you have chosen to be informed of a substantive response from Bunnings (checkbox to opt in at bottom of the form).

The letter reads:

To the Facial Recognition Technology / Privacy Officer,

Please accept this email as a formal petition submitted by former customers and members of the public who object to the deployment of facial recognition technology (FRT), biometric template generation, automated number plate recognition (ANPR), and expanded surveillance analytics within Bunnings retail premises and associated carparks.

This petition is made in good faith and seeks transparency, proportionality, accountability, and lawful governance in the use of surveillance technologies.

Petition: Objection to Biometric Surveillance and Invasive Data Collection

The signatories assert the following:

• Biometric information is sensitive information within the meaning of the Privacy Act 1988 (Cth). Systems that extract, convert, and store facial geometry into biometric templates involve the collection of uniquely identifying data.

• The collection of sensitive information requires consent unless a clearly defined statutory exception applies. Customers entering a retail premises under ordinary implied licence do not reasonably expect that their facial characteristics will be extracted, transformed into biometric identifiers, indexed in searchable databases, or compared against watchlists.

• Transparency, proportionality, and necessity are fundamental to responsible data governance. When surveillance moves beyond passive recording and into automated identification, persistent biometric indexing, and real-time matching, the privacy implications materially change.

• Members of the public have a legitimate expectation that entry into a hardware retail store for the purpose of purchasing goods will not result in the creation of a permanent or semi-permanent biometric record.

• The expansion of automated identification systems within everyday retail environments shifts the balance between commercial security interests and individual privacy rights.

Proportionate Use of Standard CCTV

The signatories acknowledge that conventional CCTV systems, operating for general security and safety purposes, are widely used in retail environments. Standard CCTV recording—without automated facial recognition, biometric template extraction, or live identification—may serve legitimate loss-prevention and safety functions.

Where a criminal offence is suspected and recorded on such systems, footage may be provided to law enforcement authorities in accordance with applicable law. In those circumstances, it is properly the role of police, acting under lawful authority, to investigate the incident and to identify individuals or vehicles involved.

This conventional model – recording footage, retaining it for a limited and defined period, and disclosing it to police if a crime occurs – represents a proportionate balance between security and privacy. It differs materially from systems that proactively extract biometric identifiers from all customers upon entry or conduct automated watchlist matching absent any specific incident.

Accordingly, this petition does not oppose the lawful use of standard CCTV for post-incident evidentiary purposes. It opposes routine, pre-emptive biometric processing of customers who are not suspected of wrongdoing.

Objections of the Signatories

The signatories:

• Object to the collection, storage, indexing, profiling, and sharing of biometric identifiers derived from their facial images;

• Object to the creation or maintenance of biometric watchlists absent explicit, informed consent or clearly identified lawful authority;

• Object to the routine scanning of all customers as a condition of entry to retail premises;

• Object to any linkage of surveillance-derived data with customer databases, banning registers, loyalty systems, or cross-retailer industry watchlists without transparent disclosure and lawful basis.

Implied Licence and Reasonable Expectations

Entry into retail premises is ordinarily granted under implied licence for lawful purposes consistent with reasonable expectations.

The signatories contend that undisclosed extraction and retention of biometric identifiers exceeds the scope of that reasonable expectation. Where sensitive biometric processing occurs without clear notification, lawful basis, and proportionate safeguards, the legitimacy of that processing is properly questioned.

Procedural Fairness, Natural Justice, and Automated Determinations

The petitioners further raise concerns regarding the procedural fairness implications of biometric watchlists and automated identification systems.

While Bunnings is not a court and does not exercise judicial power, systems that:

• Label individuals as suspected wrongdoers,

• Enrol individuals onto internal watchlists,

• Trigger exclusion from premises,

• Circulate identifying information internally or across retail networks,

• Create persistent biometric-linked records,

may operate in a manner resembling de facto adjudication without transparency or review.

The principles of natural justice — including the right to know adverse material and the opportunity to respond — are foundational within Australian legal tradition. Where automated systems generate determinations that materially affect a person’s reputation, access, or treatment, the absence of notice, reasons, or accessible review mechanisms raises legitimate fairness concerns.

Facial recognition systems are probabilistic technologies. False matches and erroneous enrolments are known risks. Where probabilistic outputs are operationalised as exclusion decisions or watchlist classifications, reputational harm may arise even absent public publication.

A retailer’s right to control entry is a property right. However, when exclusion decisions are systematised through biometric profiling, persistent databases, and automated matching, the decision moves beyond spontaneous property management and becomes part of a structured identification regime.

It is this systemic, data-driven function — not the existence of property rights — that gives rise to procedural fairness and accountability concerns.

Privacy Impact Assessment (PIA) Disclosure Required

Given the sensitivity and scale of biometric processing, the signatories require confirmation as to whether a Privacy Impact Assessment (PIA) was conducted prior to the deployment of facial recognition, biometric template systems, ANPR, or related analytics.

Specifically, please confirm:

1. Whether a PIA was undertaken prior to implementation;
2. The date and scope of that assessment;
3. Whether stakeholder consultation occurred;
4. Whether personal information flows were mapped;
5. What privacy risks were identified;
6. What mitigation strategies were adopted;
7. Whether the PIA has been reviewed following deployment or system expansion.

If no PIA was conducted, please state that expressly.

The absence of a documented privacy impact assessment in circumstances involving sensitive biometric processing would raise serious questions regarding necessity, proportionality, governance, and community expectations.

A PIA is not a formality; it is a risk management instrument. Failure to conduct or update such an assessment may be relevant to questions of foreseeability of harm and exposure to liability.

Third-Party Vendors, Analytics Providers, and Intelligence Integrations

The signatories further request clarity as to whether any third-party technology providers, analytics platforms, or intelligence systems are involved in the operation of Bunnings’ facial recognition or surveillance infrastructure.

Specifically, we request confirmation as to:

• Whether external vendors design, host, maintain, or operate biometric template databases;

• Whether surveillance-derived data is processed through third-party analytics platforms;

• Whether any external intelligence or data-enrichment tools are integrated into watchlist or identification systems;

• Whether any data is cross-referenced against datasets beyond Bunnings’ own internal records;

• Whether vendor personnel have administrative or remote access to biometric systems.

Where third-party providers are involved, please identify:

• The categories of service provided;

• Whether data leaves Australia;

• Whether biometric templates are accessible to vendors;

• The contractual safeguards governing access, retention, and deletion.

Given the sensitivity of biometric information, transparency regarding vendor involvement is essential to ensuring accountability and proportionality.

Requests to Bunnings Group Limited

The signatories respectfully call upon Bunnings to:

• Publicly disclose all stores utilising facial recognition or biometric template systems;

• Publish clear information describing what data is collected, how it is stored, how long it is retained, and with whom (with specificity) it is shared;

• Confirm whether biometric templates are created, retained, or cross-matched against watchlists;

• Clarify whether automated decision-making influences banning or exclusion decisions;

• Publish review and correction mechanisms available to affected individuals;

• Provide disclosure of any Privacy Impact Assessment undertaken;
• Suspend biometric template creation pending transparent review;

• Provide a meaningful opt-out mechanism for customers who object to biometric processing;

• Publish governance safeguards and oversight mechanisms relating to any automated identification systems.

Reservation of Rights and Petition Process

The signatories reserve all rights arising from or connected with the collection, creation, storage, use, profiling, disclosure, retention, or security of personal information, including biometric information and biometric templates, whether such conduct is asserted to be authorised, permitted, consent-based, or otherwise justified.

Nothing in this petition is to be taken as acceptance that the existence of a statutory power, policy, or internal governance mechanism extinguishes or overrides the privacy interests, civil rights, equitable rights, or other legal protections available to individuals.

This petition will remain open and continue collecting signatures until the matters identified above are substantially addressed and publicly clarified so that members of the public are fully informed as to the scope, operation, and governance of any biometric or automated identification systems.

Signatories will be compiled on a rolling basis. Updated signature schedules will be provided to Bunnings periodically in CSV spreadsheet format.

We await your substantive written response.

This petition is submitted in the interests of transparency, proportionality, accountability, and respect for the privacy of customers.

Regards,
[Admin Name]
On behalf of the Petition Signatories
Email: petition@thecommonwealthofaustralia.com.au

Signatories as collected to date.

 

 

Last Updated 7 months ago

Views: 495