Say cheese! A decision last week greenlighting Bunnings’ use of facial recognition technology to routinely monitor customers provides a not-so-happy snap of how ill-prepared Australia is for the coming AI storm.
On its face, the administrative review tribunal decision to overrule the privacy commissioner’s finding that Bunnings’ use of intrusive, high-impact AI was unlawful is a technical call. But the impact will be material.
Expect retailers and others operating in public spaces to scale up the capture of our biometric information, matching it against massive and often inaccurate external databases to make real-time decisions about whether we can access what used to be the commons.
Bunnings argues it was acting on concerns about in-store violence, but it chose this crude tech solution that dehumanises customers and staff in the name of their safety.
Covertly tracking customers has transformed the marketplace from a place of human connection to one of automated checkouts, monitored customers and staff forced to don body-cams to document the inevitable backlash.
Our outdated privacy laws, which have not had a serious makeover in 40 years, are a feature not a bug of this dystopian cycle of automation and pivotal to the broader direction big tech is taking us.
Significant privacy reform had been a priority of the former attorney general Mark Dreyfus, and he managed to get a modest round of changes focused on children’s privacy through the parliament before he fell victim to internal factional machinations after the 2025 election landslide.
His proposed second round of changes should not be controversial: expanding definitions of “personal information” to include our digital footprint; ending “tick a box” consent to collect and exploit personal information, giving people the right to access and erase our digital footprint – and requiring greater scrutiny of high-impact AI such as facial recognition.
We know from regular polling that the public emphatically supports these changes; the challenge has always been to find a way to harness this support to counter the powerful vested interests that have resisted meaningful change in this area.
The list of those seeking exemptions to the bill is long; small business, media and political parties all argue their special case, while the growing list of businesses that run on the extraction of our data will do everything to protect their patch.
The progress (or otherwise) of these privacy reforms will be an early test of the government’s broader approach to AI, embodied in its light-touch National AI Plan, which preferences the update of a phalanx of existing laws over bespoke guardrails and redlines in the name of “productivity”.
This strategy might look simpler on paper, but with laws fragmented and spread across multiple portfolios, the risk is that each legislative fight will pit a cashed-up tech sector and vested industry interests against under-resourced pockets of civil society.
A passing glance at the work required to prepare for the coming wave includes but is not limited to: copyright (as the tech industry reboots its bid to legitimise the theft of creative output), online safety (as AI dumps “nudify” apps and sexed-up AI companions on the market with seeming impunity), consumer protection (especially the automation of sophisticated scams), workplace laws (so workers might understand how their labour is being used to drive the models that will replace them), and an online duty of care (to hold those who deploy the technology accountable for the impact of their tools).
It’s tiring just listing these challenges, but of even greater concern is that under the National AI Plan there is no sequenced, integrated approach to lining these issues up and creating a general set of principles for how they might be addressed.
That’s why the foundations for any effective social compact with AI must be a robust set of privacy principles that establish the ground rules on the collection and trade of our personal information from web and search to observed behaviour – both online and in the real world.
If the AI revolution meets even a fraction of its hype, the disruptions we face as workers, as consumers and as citizens will be profound. Surely it’s not too much to ask government to take ownership and give us a collective voice in what comes next.
Which brings us back to Bunnings and the model of routine citizen surveillance that it normalises.
We are told we need to accelerate the AI race to beat the repressive Chinese model of constant monitoring and social credits, even while similar identification technology is being deployed in the United States by ICE agents and the Israeli military in Gaza.
Poignantly, privacy laws were one of the principles that emerged from the horror of the Holocaust, recognition of the dangers inherent in classifying and centralising information about citizens after it emerged how IBM had served the Nazi regime.
Indeed, the first consumer privacy laws were enacted in the 1960s in West Germany and later that unified nation was a driver of the European Union’s GDPR, which remain the closest to a balanced set of principles to deal with the information age.
Way before the advent of social media algorithms and language models built on the illegal harvesting of our creativity, it was recognised that we needed refuges where we were not observed and could simply be ourselves.
This space has eroded gradually, but the pace of its erasure is now accelerating – from documentation to occasionally affirm an identity, to a living digital footprint that is traded between companies, to a unique biometric profile that will pre-empt and shape our every move.
Without stronger privacy protections we are all guinea pigs in a real-time experiment to upturn our once private lives. If we are ever going to draw a line in the sand it needs to be now. Bunnings can provide the sausages.
