OAIC Update: Facial Recognition
While the Privacy Commissioner’s latest guidance addresses retail settings following the Bunnings tribunal decision, the legal implications are vital for WA independent schools. The determination reinforces that Australian privacy law sets a very high bar for deploying facial recognition technology, and schools must take a strictly precautionary approach before adopting biometric tools.
Under the Privacy Act, facial templates processed for automated identification are classified as sensitive biometric data. Capturing this information requires explicit, informed consent unless a narrow legal exception applies. The tribunal confirmed that even momentary scanning and algorithmic matching of faces constitutes a formal data collection. Standard CCTV records passive footage, but introducing automated facial matching or AI profiling fundamentally changes the legal landscape.
Schools cannot simply rely on broad safety or operational convenience to bypass consent. Deploying facial recognition for campus gate security, visitor kiosks, or automated roll marking does not meet the exceptional legal threshold required to collect biometric data without permission. Given that schools manage children's data and community concern regarding biometrics is at an all time high, deploying high surveillance tech without rigorous governance creates significant regulatory and reputational risk.
Before procuring or expanding smart camera systems, school leadership teams should evaluate whether less invasive measures like standard smartcards or supervised check-ins can achieve the same goals. Where biometric technology is genuinely considered, schools must conduct a formal Privacy Impact Assessment, secure explicit consent from parents and guardians, and provide transparent collection notices across campus.
For guidance on navigating biometric compliance, school leaders can reach out to the AISWA, consult qualified education and privacy legal counsel, or access regulatory resources directly through the Office of the Australian Information Commissioner (OAIC).
