The Enterprise AI Failure Casebook

Kmart scanned the face of every shopper in 28 stores to catch refund fraud

Australia's Privacy Commissioner found that Kmart collected biometric data from every customer in 28 stores without consent, and that the exemption it relied on did not apply.

Kmart Australia Limited · August 26, 2025 · Updated October 31, 2026

On June 22, 2020, Kmart Australia switched on a facial recognition system in one of its stores. Between July 27 and December 22, 2021, it added 27 more. The retailer ran between 214 and 303 stores in that period. It called the 28 a pilot program.

The system took feeds from the stores' CCTV cameras. It captured the face of every person who walked in, and again of every person who came to the returns counter. Kmart told the regulator it generated five to six images of each person at each point. The software turned the best image into a set of feature vectors unique to that face. When a customer came to the returns counter, their face was compared against everyone who had entered that store and against a shared database of people Kmart suspected of refund fraud. The software came from a third-party supplier.

Kmart's staff guide told employees that "under no circumstances should any Team Members disclose or advise customer on the use of this technology." From September 2021, Kmart checked the system against a facial recognition standard written by Wesfarmers that Kmart had adopted. It marked itself non-compliant: "no notice provided in current test sites advising on FRT use." On October 7, 2021, Kmart told its stores to put up signs reading "This store has 24-hour CCTV coverage, which includes facial recognition technology." Five stores had run the system before then, one of them for about 15 months. Kmart displayed no sign at any returns counter.

The same standard required Kmart to weigh the system against other reasonable alternatives. The checklist recorded that the previous loss prevention team "did not hand over any assessments" and that "an assessment has been scheduled into the CCTV tender that will occur in early to mid-2022." The Commissioner found no evidence that it took place, and no evidence of a privacy impact assessment before the pilot began.

On July 11, 2022, the Australian Information Commissioner at the time opened an investigation. Kmart stopped the system on July 15, 2022. Kmart argued that it did not need consent because the Privacy Act lets an organization collect sensitive information when it suspects unlawful activity and reasonably believes the collection is necessary to act on it.

Privacy Commissioner Carly Kind signed her determination on August 26, 2025, and the OAIC published it on September 18, 2025. She accepted that refund fraud is unlawful activity. She accepted that the executive who sponsored the trial genuinely believed the system was necessary. She found that the belief was not reasonable. The system addressed only some kinds of refund fraud, and only some of the time. Less intrusive options had been available and "insufficiently explored." The fraud it prevented was small against Kmart's revenue of 9.2 billion Australian dollars in the 2020 financial year, and it had collected the faces of every customer to catch a far smaller group. She found that Kmart breached the rules on collecting sensitive information, on notifying people, and on what its privacy policy had to say.

She ordered Kmart not to repeat the conduct, to post an apology on its website and in the stores concerned, to publish a statement describing how the system worked, and to keep and then destroy what the system had collected. A party had 28 days to apply to the Administrative Review Tribunal. In February 2026, in a separate case about Bunnings, the Tribunal affirmed the Commissioner's findings that Bunnings breached the principles on notice and on open and transparent management of personal information. It found that Bunnings could rely on exemptions from the consent requirement. On July 29, 2026, the OAIC said the Kmart determination remained under review by the Tribunal, with hearings scheduled for early 2027.

What failed

A system that collected biometric data from every customer went live, and spread to 28 stores, with no privacy impact assessment on record. Kmart's legal position rested on an exemption for fighting unlawful activity. The only assessment of alternatives on record was what Kmart called the "compelling lived experience of its senior management." The comparison with alternatives that the company's own standard required was scheduled for a tender in 2022, and the Commissioner had no evidence that it took place. She found it unlikely that shoppers in the first store were given notice during its first 15 months, and the staff guide told employees to say nothing. The Commissioner found that alternatives had been insufficiently explored and that Kmart could not reasonably have believed the collection was necessary.

Sources

1. Office of the Australian Information Commissioner, Commissioner Initiated Investigation into Kmart Australia Limited (Privacy) [2025] AICmr 155 (archived copy of the OAIC PDF), paras 1 to 3, 7 to 9, 21 to 23, 41, 60, 64, 67, 99, 125 to 128, 133, 135 to 139, 149, 151, 152, 154, 156 to 158, 168, 176, 185; review rights, p. 35
2. Office of the Australian Information Commissioner, Kmart's use of facial recognition to tackle refund fraud unlawful, Privacy Commissioner finds (media release, September 18, 2025), paras 1 to 3 (publication date and summary of findings)
3. Office of the Australian Information Commissioner, OAIC statement on Administrative Review Tribunal's Bunnings decision (February 4, 2026), paras 2, 5 and 6
4. Office of the Australian Information Commissioner, Privacy Commissioner publishes updated guidance on facial recognition in retail spaces (media release, July 29, 2026), final paragraph