Face recognition for Australian organisations: privacy questions
Biometric templates used for identification can be sensitive information under Australia's Privacy Act. Organisations should assess applicable Australian Privacy Principles, collection grounds, notices and governance before deployment. FaceTagr provides on-device recognition and hosting choice, but those capabilities do not establish compliance. The Bunnings decision was fact-specific and is not general permission for consent-free facial recognition.
Last reviewed: 18 October 2026 · FaceTagr team
What should your privacy review cover?
| Area | What to establish |
|---|---|
| Impact assessment | Document purpose, risks, alternatives and safeguards before rollout |
| Collection | Assess APP 3, consent or an applicable exception with an adviser |
| Notice | Provide a specific and accessible collection notice |
| Governance | Document responsibilities, access limits and vendor arrangements |
| Retention and transfers | Define deletion, hosting location and any cross-border disclosure |
What did the Bunnings decision actually change?
On 4 February 2026, the Administrative Review Tribunal reversed the APP 3.3 breach finding in Bunnings' particular circumstances, while affirming findings concerning APP 1 and APP 5: privacy governance and notice. The decision does not establish a universal exemption from consent or other privacy obligations.
How can hosting and local processing help?
An offline mobile or on-premise deployment can limit reliance on remote matching. Confirm enrolment storage, templates, event images, support access and any sync destination. Local processing does not remove the need for a lawful collection ground, notices and safeguards.
Plan a pilot around your workflow
For privacy or deletion requests, contact support@facetagr.com. Read our privacy policy.
Sources
- OAIC: statement on the Bunnings Tribunal decision (4 February 2026)
- OAIC: Australian Privacy Principles
Product capabilities describe FaceTagr's supported workflows, not third-party endorsement. This page is general information, not legal advice. Check your obligations with your data protection officer or adviser.
Frequently Asked Questions
Does processing on the device remove privacy obligations?
Face templates are biometric data, even when capture photos are not retained. Define the lawful basis, notice and consent where required, retention, access controls and a workable non-face alternative before rollout. On-device processing does not by itself establish legal compliance.
Are workers' photos stored?
Configured mobile attendance workflows can avoid retaining check-in photos or video. Enrolment references, templates and attendance records still need a documented retention policy. Customer-built SDK apps and CCTV may store images according to their configuration; confirm the data flow before deployment.
Can it work without a network?
Yes. FaceTagr's mobile SDK supports fully offline 1:1 verification, 1:N identification and passive liveness on Android and iOS. Reporting and integration need a connection when records are synchronised.
Are face templates sensitive information?
Biometric information used for automated identification or verification is treated as sensitive information under the Privacy Act. Review the applicable rules and any exceptions with an adviser.