Striking the Balance of Privacy and Security in the Retail Sector

As technology continues to reshape the retail landscape, businesses are increasingly adopting tools aimed at enhancing security. At the recent Retail Risk 2025 conference, Privacy Commissioner Carly Kind addressed the audience on the topic of balancing retail security with privacy. Kind spoke on how privacy and security should not be seen as opposing forces, emphasising that “narrow thinking is the enemy”, and that retailers can, and must, achieve both. 

Privacy and security may be viewed as conflicting interests because security measures typically involve increased monitoring and data collection, which can feel intrusive and against the right to personal privacy. However, below is a summary of Commissioner Kind’s address which reflects how retailers do not have to choose between privacy and security.  
 

Privacy as a business imperative 

Privacy isn’t just a legal requirement, it is also a strategic asset. In fact, when choosing products and services, Kind highlighted that Australians rank privacy just behind quality and price as a top influencing factor. When executed correctly, privacy can fuel innovation, build trust, and give businesses a competitive edge. However, when privacy is mishandled, it can lead to legal risk, reputational harm, and revenue loss. 

 
Lessons from the facial recognition determination 

Kind’s high-profile determination involving breached privacy laws by using facial recognition technology serves as a caution to other retailers. Despite acknowledging its use was for good intentions, the technology in the circumstances was found to be intrusive and largely ineffective in practice. The lack of transparency and governance, along with indiscriminate data collection, violated key principles of the Privacy Act.  
 

What retailers need to know 

Retailers must consider both the legal requirements and the ethics of their security measures. Kind urged businesses to: 

• Ensure data collection is necessary and proportionate. 

• Obtain informed, voluntary, and specific consent, particularly for sensitive personal information 

• Be transparent about how data is collected and used. 

• Consider the ‘pub test’ i.e. would the individual consider it both reasonable and fair for their personal information to be collected and used in the circumstances.  

• Implement strong governance and data security practices. 

 
Where to from here? 

The OAIC is engaging with the retail sector to provide clearer guidance on responsible use of technologies like facial recognition and AI. The goal is to support compliance while enabling innovation, especially in light of recent Privacy Act reforms that expand the OAIC’s regulatory powers. Kind’s mission is to make it as easy as possible to comply with the law.  

Kind closed her address with a well-considered statement, “Let’s take the opportunity to pause, get the balance right, and not sleepwalk into using technology that may have greater ramifications.” It’s easy to get carried away and jump on the next technology trend without looking at the broader implications. For retailers, the message is clear that privacy and security are not mutually exclusive. With careful planning and ethical decision-making, both can be achieved.