Yard CCTV and facial recognition at a car dealership: the privacy rules

Cameras across your yard and showroom are governed first by your state's surveillance-devices law, which binds you whether or not the Privacy Act reaches your business. The core rules are the same as any premises: video only, never record a private conversation, and control who sees the footage. But facial recognition and number-plate cameras are a different order of risk, because a facial template is sensitive information under s 6(1) of the Privacy Act. The Bunnings case shows where the line sits: Bunnings won the consent argument on appeal and still breached the two transparency principles, APP 1 and APP 5.

By Jon Oates, Founder of Privaproof · Last updated 9 September 2026

General information, not legal advice. Privaproof is not a law practice, and this page does not tell you whether a particular facial-recognition system is lawful for your dealership.

Two layers of law over a dealership camera

State surveillance-devices law is the first and most universal layer. New South Wales and Victoria each have a Surveillance Devices Act; Queensland has no equivalent and regulates listening devices under the Invasion of Privacy Act 1971. All of it applies regardless of your turnover and regardless of the Privacy Act.
The Privacy Act and the APPs are the second layer, and they bind you if your dealership is an APP entity. Turnover over A$3 million is one route in. Section 6D(4)(c) is another: a business that discloses personal information about someone to anyone else "for a benefit, service or advantage" is not a small business operator, subject to the s 6D(7) carve-outs for consent or legislation. Do you pass buyer details to a lender for a commission? Where the APPs apply, CCTV footage of identifiable people is personal information.

So "we are a small dealer" is not an answer to a surveillance-law problem: the camera rules bite either way.

The rules that apply to ordinary CCTV

Video only, never audio. Using a listening device to record a private conversation you are not a party to is a criminal offence in every state: s 7 of the NSW Act, s 6 of the Victorian Act, s 43 of Queensland's Invasion of Privacy Act 1971. Disable audio on all cameras and intercoms.
Aim at your own premises for a genuine purpose. Cameras should cover the yard, showroom and lot for security, not the footpath or a neighbour's property beyond what is reasonable.
Signage. Tell people cameras are operating. Note: signage is an APP 5 notice and good practice, not a magic "statutory compliant sign", do not assume a sign alone makes a system lawful.
Controlled access and retention. Store footage securely, limit who can view it, and keep it only as long as you need it.

Facial recognition and number-plate cameras are a different order of risk

If your cameras do more than record vision, the bar rises sharply:

A facial template is sensitive information. Section 6(1) of the Privacy Act makes "biometric information that is to be used for the purpose of automated biometric verification or biometric identification" and "biometric templates" sensitive information. APP 3.3 then bars a covered business from collecting it without consent and reasonable necessity, unless an APP 3.4 exception applies. A materially higher bar than ordinary CCTV.
The Bunnings case is the one to read, and it split. The OAIC's determination, [2024] AICmr 230 (29 October 2024), found that facial recognition in Bunnings stores breached APP 1, APP 3.3 and APP 5. On appeal the Administrative Review Tribunal's Guidance and Appeals Panel, in Bunnings Group Limited and Privacy Commissioner (Guidance and Appeals Panel) [2026] ARTA 130 (4 February 2026), affirmed APP 1 and APP 5 but set aside APP 3.3, accepting a permitted general situation under s 16A for the limited purpose of combatting retail crime. The Privacy Commissioner has since stated that no appeal was filed. The lesson for a dealership: the business that won the consent argument still contravened the two principles about telling people what you are doing.
Number-plate recognition (ANPR) is different, and lower-risk than FRT. A number plate is not sensitive information in the Privacy Act's special sense, so ANPR does not carry the consent bar that facial recognition does. But an ANPR system that captures plates and links them to people or records is still collecting personal information, so it needs proper collection limits and notice under APP 3 and APP 5. Do not lump it in with facial recognition, and do not assume it is unregulated either.

The honest position: treat any facial-recognition or automatic number-plate proposal as a stop and get advice moment, not a security upgrade you switch on. The OAIC's guide to assessing facial-recognition privacy risks, republished 29 July 2026 after the appeal, sets the bar high. This page explains the privacy rules; whether a specific system is lawful for your dealership is a question for advice.

The states are not the same

Surveillance-devices law is state law and differs materially:

Victoria has an optical-surveillance offence, but a narrow one: s 7 of the Surveillance Devices Act 1999 bans recording a private activity you are not a party to without consent, and s 3 excludes from private activity "an activity carried on outside a building", so an open yard sits outside it. New South Wales is narrower again: s 8 of the Surveillance Devices Act 2007 turns on entry onto premises or a vehicle, or interference with one, not on recording as such. Queensland has no general optical-surveillance offence and regulates listening devices only, under s 43 of the Invasion of Privacy Act 1971. Audio is controlled in all three.
If you operate across states, do not assume one state's rules travel. Check the current Surveillance Devices Act for the state your yard is in.

This is general information and document templates you tailor to your own business, not legal advice.

Common questions

Can we run CCTV across the yard?

Generally yes for genuine security, as video-only cameras aimed at your own premises, with signage, secure storage and controlled access, and subject to your state's surveillance law. Audio is the hard line: disable it.

Can we use facial recognition to spot known offenders?

Treat that as a stop-and-get-advice decision. A facial template is sensitive information, so APP 3.3 requires consent and reasonable necessity unless an APP 3.4 exception applies. In the 2026 Bunnings appeal the Tribunal accepted such an exception for the limited purpose of combatting retail crime, a fact-specific finding rather than a general permission, and it still upheld the APP 1 and APP 5 findings. So whichever way the consent question falls for your yard, two duties survive: a privacy policy that discloses the technology, and a notice at the point of collection.

Is a "CCTV in operation" sign enough?

Signage is an APP 5 notice and good practice, but it is not a statutory compliant sign that makes any system lawful. It is one part of doing it properly, alongside obeying the surveillance law, limiting the footage, and not running FRT without a proper basis.

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice, and does not advise whether any particular surveillance or facial-recognition system is lawful. State surveillance-devices law varies by jurisdiction and changes over time, so confirm the current law for your state. For advice on your specific circumstances, consult a qualified Australian legal practitioner.