The Context
Bunnings is trialling facial recognition technology in two Hamilton stores from April 2026, with a nationwide New Zealand rollout to follow. This comes directly after the company’s 2025 appeal of a 2024 Australian ruling that found its prior FRT trial breached privacy law. The breach was specific: a failure to properly inform customers their images were being captured. The tribunal accepted the crime-fighting justification but condemned the implementation. Now, the same technology architecture is being deployed here. The New Zealand Privacy Commissioner has already flagged “significant privacy concerns.” The precedent is set. The risk is live.
The Risk
Your personal liability is not about the technology. It’s about the trust. The Australian case provides a clear blueprint for failure: inadequate disclosure. If the New Zealand trial replicates that failure, it may constitute a breach of the Privacy Act 2020. This could trigger investigations, enforcement actions, and severe reputational damage. The ‘Court of Public Opinion’ is already in session. The psychosocial damage from a perceived surveillance overreach can be profound. It erodes the social licence to operate. Brand erosion is not a line item on a P&L, but it directly impacts valuation and director credibility. Under the Companies Act 1993, a director’s duty to act in good faith and in the best interests of the company includes safeguarding its reputation. A privacy scandal is a direct assault on that duty.
The Control
You must demand a crisis-grade communication and consent strategy that goes beyond legal minimums. Treat customer biometric data with the highest duty of care. The strategic solution is to lead with radical transparency, not technical compliance. This means overt, unambiguous signage at every entry point. It means clear, simple language explaining what data is collected, why, and how it is protected. It means providing a genuine, easy opt-out. This isn’t just about avoiding a breach finding; it’s about building public trust in a volatile environment. Governance must shift from a box-ticking exercise to an active, ethical stewardship of customer identity.
The Challenge
These are the critical questions you should be raising at the board table:
| Given the identical failure mode in Australia, what specific, verifiable changes have been made to our customer notification and consent processes for the New Zealand trial to ensure we do not repeat the breach? | |
| Where is the crisis communications plan that details our public response when—not if—a customer group or media outlet frames this trial as a covert surveillance operation? | |
| What is the quantified brand risk? Show me the scenario modelling that projects the impact on customer sentiment and foot traffic if this triggers a privacy backlash. |