FRT falls under increased protections according to the Privacy Act since it gathers “sensitive information”. The law mandates that the use of FRT must be necessary and proportionate, and individuals’ consent must be obtained.

What did the Privacy Commission find?

The commissioner also determined that the FRT system’s role in fraud prevention was of “limited utility” and the widespread application — which affected thousands not suspected of return fraud — represented a “disproportionate interference with privacy”.

“I do not believe that Kmart could have reasonably assumed that the advantages of the FRT system in tackling refund fraud outweighed the impact on individuals’ privacy,” she stated.

Kmart ‘disappointed’ by the findings

“Like many other retailers, Kmart is facing growing incidents of theft in stores, frequently accompanied by anti-social conduct or violence against staff and patrons.”

They reported that “refund-related customer threatening incidents” had surged by 85 per cent from August 2024 to March 2025, which they claimed translated to a “heightened risk of the refund task for team members”.

Kmart case differs ‘considerably’ from previous Bunnings finding

In October 2024, Bunnings was found to have breached privacy laws through its use of FRT in 62 stores.