Facial recognition, ANPR and smart surveillance in strata buildings

Only if your managing-agent business is a covered APP entity, and many smaller managers are not. But where you are covered, facial recognition and number-plate cameras are the highest-risk technology in the building. The OAIC's Bunnings determination treated facial images as sensitive biometric information that needs clear notice and a compliant privacy policy, and the 2026 tribunal appeal affirmed those transparency and notification breaches. State surveillance law applies to the cameras either way.

By Jon Oates, Founder of Privaproof · Last updated 23 July 2026

General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.

Need to know

A managing-agent business is only a covered APP entity if its turnover exceeds A$3 million or it is a related body corporate of a larger covered group, so smaller independent managers may genuinely fall outside the Australian Privacy Principles.
State Surveillance Devices Acts bind the cameras themselves regardless of the Privacy Act, so even a manager inside the small-business exemption must still meet by-law, signage, and video-only rules (and Queensland notably has no general optical-surveillance offence).
The OAIC's Bunnings determination treats facial images as sensitive biometric information, and the 4 February 2026 tribunal appeal affirmed the APP 1 and APP 5 transparency and notification obligations while setting aside the APP 3 collection-without-consent finding, so whether express consent to collect is required remains unsettled.
ANPR is generally lower-risk than facial recognition because a plate is not biometric, and a bare plate may not identify a person, but once matched to a resident, car space, or access log it becomes personal information carrying APP obligations.

First, work out who is actually on the hook

Smart surveillance does not change the coverage question, it just raises the stakes of getting it wrong. So start where every strata privacy question starts.

The owners corporation that owns the common property is almost always a small business (turnover A$3 million or less) and usually sits within the s 6D small-business exemption, so the Australian Privacy Principles largely do not bind it.
Your managing-agent business is a covered APP entity only if either its turnover exceeds A$3 million or it is a related body corporate of a larger covered group. Branded and national managers are often caught through that second limb even where an individual office assumes it is exempt. Read: does the Privacy Act apply to strata managers?
If you are a smaller independent manager under A$3 million and not part of a larger group, you may genuinely fall outside the APPs, and we will not pretend otherwise.

Here is the honest catch, though: state surveillance-devices law binds the cameras regardless of any of this. The exemption that shelters a small manager from the APPs does nothing to shelter the surveillance hardware. So even a manager who is outside the Privacy Act cannot install whatever cameras it likes.

Why facial recognition is the highest-risk camera in the building

An ordinary CCTV camera captures images of people. A facial recognition camera does something legally different: it converts a face into a biometric template and matches it against a database. Under the Privacy Act, biometric information used for automated identification is sensitive information, a special category that attracts a higher level of protection than ordinary personal information.

That distinction is what makes a "smart" entry system in an apartment lobby a different problem from a plain camera over the bins. If your managing-agent business is covered, you are no longer just holding footage. You are collecting and holding the most sensitive category of personal information the Act recognises, about every resident, visitor, contractor and delivery driver who walks through the door, most of whom never agreed to it and many of whom never dealt with you at all.

What the Bunnings case actually decided

The clearest Australian guidance comes from the OAIC's Bunnings determination (29 October 2024), which examined a retailer using facial recognition on shoppers. It is not a strata case, but it sets the benchmark for how the regulator treats facial recognition, and the reasoning transfers directly to a covered strata manager running the same technology in a building.

The original determination found breaches of APP 1 (failing to manage information openly, including through a compliant and up-to-date privacy policy), APP 3 (collecting sensitive information without consent) and APP 5 (failing to notify people that the collection was happening).

On appeal, the Administrative Review Tribunal (4 February 2026) affirmed the APP 1 and APP 5 findings, the transparency and notification failures, but set aside the APP 3 finding on collection without consent. So be precise about the durable lesson, because it is easy to overstate: the affirmed, settled obligations are transparency and notice, not a blanket rule that you always need express consent to collect. If you are a covered manager, you must have a privacy policy that openly discloses the facial recognition, and you must clearly tell people, before or at the point of entry, that their face is being captured and matched. The narrower consent-to-collect question is more contested after the appeal, so treat it as unsettled rather than as a fixed rule .

ANPR and number-plate cameras at the boom gate

Automatic number-plate recognition (ANPR) sits at the car-park boom gate and video intercom, reading plates to open a gate, log entries or flag visitors. Managers often assume a number plate is not personal information, so ANPR feels lower-risk than facial recognition. Be careful with that assumption.

A bare number plate, on its own, may not identify a person . But a strata manager rarely holds it on its own. The moment you match a plate to a resident, an allocated car space, an owner on the roll or an access log, the plate becomes information about an identifiable individual, which is personal information for a covered manager. A log of who came and went, and when, is a movement record, and it inherits the same APP obligations as any other personal information you hold: collect only what is reasonably necessary (APP 3), tell people it is happening (APP 5), keep it secure and destroy it when it is no longer needed (APP 11). Whether a plate alone is personal information in your specific setup is worth confirming for your state and circumstances .

ANPR is generally lower-risk than facial recognition because a plate is not biometric sensitive information, but it is not no-risk, and a manager who treats the entry log as disposable exhaust is the one who gets caught out when it leaks.

The surveillance-law layer that binds even if you are exempt

Whatever the Privacy Act does or does not do, state Surveillance Devices Acts apply to the cameras themselves, independently, and they bind a manager who is inside the small-business exemption just as much as one who is outside it. Facial recognition and ANPR are still optical surveillance devices, so the state rules on common-property cameras apply on top of everything above: cameras must be video-only (recording private conversation is generally a criminal offence), must not point into private lots or windows, need a by-law and appropriate approval, and need signage. Read: CCTV and surveillance on strata common property

Those rules are not uniform. NSW, Victoria and WA each make it an offence to optically record a private activity without consent, while Queensland notably has no equivalent general optical-surveillance offence and regulates mainly audio . So the same smart-camera install can be lawful in one state and an offence in another. Confirm your own state before relying on any of this. Read: strata CCTV rules by state

There is also a newer lever worth noting: a statutory tort of serious invasion of privacy was legislated in 2024 and is understood to have commenced around mid-2025, giving an individual a direct right to sue for intentional or reckless conduct . It is narrow, but intrusive, poorly justified building surveillance is exactly the kind of egregious case it was designed to reach, and it does not depend on you being an APP entity.

What a covered manager should actually do before switching it on

If your managing-agent business is a covered APP entity and a scheme wants facial recognition or ANPR, the honest baseline is to treat the technology as a decision to justify, not a default to install.

Ask whether you need it at all. APP 3 lets a covered entity collect sensitive information only where it is reasonably necessary. Plain CCTV, a fob or a PIN often achieves the security goal without capturing biometrics, and "we could" is not "we reasonably need to".
Get the notice right, because that is the affirmed obligation. Clear signage at every entry, a plain-English resident notice, and a privacy policy that openly names the facial recognition or ANPR and what it does with the data.
Lock down and time-limit the data. Secure the templates and logs, restrict who can view them, and set a retention period so footage and entry logs are destroyed or de-identified when no longer needed (APP 11), rather than hoarded indefinitely.
Clear the surveillance-law and by-law hurdles first. Confirm your state's Surveillance Devices Act position, that cameras avoid private areas and audio, and that the scheme has the by-law and approval it needs.
If you are not covered, still do the surveillance-law and signage steps. The exemption does not reach the cameras, and a resident harmed by intrusive surveillance does not care about your turnover.

Common questions

The settled obligations after the 2026 Bunnings appeal are transparency and notice: a covered manager must openly disclose the technology in its privacy policy and clearly tell people it is happening. The narrower question of whether express consent is required to collect the biometric data is more contested after the tribunal set aside that part of the finding, so treat it as unsettled and take advice before relying on either position .

Is a car number plate personal information?

A bare plate may not identify a person on its own . But once a covered manager matches it to a resident, a car space, the owners roll or an access log, it becomes information about an identifiable individual, which is personal information carrying APP obligations. Treat your ANPR entry log as personal data unless you have confirmed otherwise for your setup.

We are a small manager under $3 million. Can we install facial recognition freely?

No. Even if your business falls within the small-business exemption and the APPs largely do not bind you, state surveillance-devices law still governs the cameras, the scheme still needs the right by-law and approval, and the statutory tort of serious invasion of privacy does not depend on you being an APP entity. The exemption shelters your business from the APPs, not the hardware from the law.

Is facial recognition riskier than ANPR?

Generally yes. Facial recognition creates biometric sensitive information, the most protected category under the Privacy Act, while a number plate is not biometric. ANPR is lower-risk but not no-risk, because a plate matched to a resident is still personal information and a movement log is still a security and privacy liability if it leaks.

Keep reading

General information and compliance tools, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act 1988 (Cth) applies to your managing-agent business depends on your turnover and structure; state Surveillance Devices Acts and strata legislation apply separately and vary by jurisdiction. The Bunnings determination and its 2026 tribunal appeal are cited as general guidance, not as advice about your building. Privaproof's strata documents are self-authored and are not independently reviewed by a solicitor. The law changes over time, so check you are working from a current version and confirm your own state's requirements. For advice on your specific circumstances, consult a qualified Australian legal practitioner.