Yard CCTV and facial recognition at a car dealership: the privacy rules
Cameras across your yard and showroom are governed first by your state's surveillance-devices law, which binds you whether or not the Privacy Act reaches your business. The core rules are the same as any premises: video only, never record a private conversation, and control who sees the footage. But facial-recognition and number-plate cameras are a different order of risk, because a facial template is sensitive information, and the OAIC's action against Bunnings over facial recognition is the clear warning of where the line is.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice, and this page does not tell you whether a particular facial-recognition system is lawful for your dealership.
Two layers of law over a dealership camera
- State surveillance-devices law is the first and most universal layer. Each state's Surveillance Devices Act governs what may be recorded, and it applies regardless of your turnover and regardless of the Privacy Act, so even a small dealer outside the Australian Privacy Principles must obey it.
- The Privacy Act and the APPs are the second layer, and they bind you only if your dealership is a covered entity (turnover over A$3 million, or otherwise caught). Where they apply, CCTV footage of identifiable people is personal information.
So "we are a small dealer" is not an answer to a surveillance-law problem: the camera rules bite either way.
The rules that apply to ordinary CCTV
- Video only, never audio. Recording a private conversation with a listening device without consent is a criminal offence under state surveillance law. Disable audio on all cameras and intercoms.
- Aim at your own premises for a genuine purpose. Cameras should cover the yard, showroom and lot for security, not the footpath or a neighbour's property beyond what is reasonable.
- Signage. Tell people cameras are operating. Note: signage is an APP 5 notice and good practice, not a magic "statutory compliant sign", do not assume a sign alone makes a system lawful.
- Controlled access and retention. Store footage securely, limit who can view it, and keep it only as long as you need it.
Facial recognition and number-plate cameras are a different order of risk
If your cameras do more than record vision, the bar rises sharply:
- A facial template is sensitive information. Facial-recognition technology (FRT) that identifies individuals creates biometric information, which is sensitive information under the Privacy Act and generally needs consent and a real necessity, a much higher standard than ordinary CCTV.
- The OAIC has enforced this. In its Bunnings determination (29 October 2024), the OAIC found the retailer's facial-recognition use breached privacy obligations, and on appeal the tribunal (4 February 2026) affirmed the transparency and notification breaches (APP 1 and APP 5) confirm the current appeal position before relying on it. For a dealership, the lesson is that deploying FRT quietly, without a strong basis and clear notice, is exactly what draws regulator attention.
- Number-plate recognition (ANPR) is different, and lower-risk than FRT. A number plate is not sensitive information in the Privacy Act's special sense, so ANPR does not carry the consent bar that facial recognition does. But an ANPR system that captures plates and links them to people or records is still collecting personal information, so it needs proper collection limits and notice under APP 3 and APP 5. Do not lump it in with facial recognition, and do not assume it is unregulated either.
The honest position: treat any facial-recognition or automatic number-plate proposal as a stop and get advice moment, not a security upgrade you switch on. This page explains the privacy rules; whether a specific system is lawful for your dealership is a question for advice.
The states are not the same
Surveillance-devices law is state law and differs materially:
- Victoria has the clearest optical-surveillance offence (recording a private activity without consent). New South Wales regulates optical surveillance more narrowly (its offence turns on entry or interference rather than recording a private activity as such). Queensland has no general optical-surveillance offence and regulates only audio, under the Invasion of Privacy Act 1971 . Audio is strictly controlled in every state.
- If you operate across states, do not assume one state's rules travel. Check the current Surveillance Devices Act for the state your yard is in.
This is general information and document templates you tailor to your own business, not legal advice.
Common questions
Can we run CCTV across the yard?
Generally yes for genuine security, as video-only cameras aimed at your own premises, with signage, secure storage and controlled access, and subject to your state's surveillance law. Audio is the hard line: disable it.
Can we use facial recognition to spot known offenders?
Treat that as a stop-and-get-advice decision. Facial-recognition creates sensitive biometric information, generally needs consent and necessity, and is precisely the technology the OAIC has enforced against. Do not switch it on without a strong, advised basis and clear notice.
Is a "CCTV in operation" sign enough?
Signage is an APP 5 notice and good practice, but it is not a statutory compliant sign that makes any system lawful. It is one part of doing it properly, alongside obeying the surveillance law, limiting the footage, and not running FRT without a proper basis.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice, and does not advise whether any particular surveillance or facial-recognition system is lawful. State surveillance-devices law varies by jurisdiction and changes over time, so confirm the current law for your state. Privaproof's car-dealer documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.