Using AI Safety Cameras Without Privacy Risk: How Australian Sites Can Deploy Flagman Lawfully
AI safety cameras are lawful at Australian workplaces when deployed properly. What privacy and surveillance law requires, and what the 2026 Bunnings decision means for facial recognition.
In brief
- AI safety cameras that detect people, vehicles and hazards can be used lawfully at Australian workplaces, provided workers are properly notified and the footage is used for safety.
- Facial recognition sits in a different category. It collects biometric information, which the Privacy Act treats as sensitive, so it needs consent or a clear legal basis, specific notices and a documented privacy assessment.
- Running the system offline is good security practice, but it does not remove privacy obligations. The 2026 Bunnings decision confirmed that even images processed for milliseconds on site are “collected”.
- The smart approach is to deploy safety detection as standard and treat facial recognition as an optional module with its own privacy controls.
Facial images processed for about 4 milliseconds and then deleted were still found to be collected biometric information.
Administrative Review Tribunal, Bunnings decision, February 2026
When safety managers talk to us about AI cameras, the first question is rarely about detection accuracy. It is usually: “Are we allowed to do this?” It is a fair question. Australian workers are increasingly aware of workplace surveillance, unions are paying close attention to AI monitoring, and recent decisions have put facial recognition firmly in the spotlight.
The good news is that AI safety monitoring can be deployed lawfully and with the support of the workforce. The key is understanding where the legal lines sit, and designing the deployment around them from day one.
Safety detection and facial recognition are not the same thing
Most AI safety use cases do not need to know who a person is. Detecting that someone has walked into a forklift’s path, entered a machine guarding zone or is missing a hard hat only requires the system to recognise a human shape and its position. No identity is involved.
Facial recognition goes a step further. It converts a face into a biometric template and compares it against a database to identify the individual. In industrial settings, it is typically used for access control, for example to ensure only trained and authorised operators can enter a dangerous machine area. That additional step is what triggers stronger privacy obligations.
What the Bunnings decision changed
Between 2018 and 2021, Bunnings used facial recognition in a number of its stores to identify people it considered a risk to staff and customers. The Privacy Commissioner found in 2024 that this breached the Privacy Act. In February 2026, the Administrative Review Tribunal reviewed that decision.
The Tribunal accepted Bunnings’ safety reasons for using the technology and set aside the finding that it needed consent in those circumstances. However, it upheld findings that Bunnings had not properly notified people and had not put adequate privacy governance in place. Importantly, it also found that facial images were “collected” as biometric information, even though they were processed in about 4 milliseconds and then deleted.
For industry, the lesson is clear. Where the data is processed matters less than whether people were properly informed, and whether the business assessed the privacy risk before switching the system on. “It runs offline” is a strong security feature, but it is not a privacy strategy on its own.
The legal framework at a glance
| Law | What it requires |
|---|---|
| Privacy Act 1988, Australian Privacy Principle 3 | Consent, or a recognised exception, before collecting biometric information |
| Australian Privacy Principles 1 and 5 | Documented privacy governance and a specific notice explaining what is collected and why |
| Employee records exemption | Covers some employee records, but not contractors or visitors, who are present on almost every industrial site |
| Workplace Surveillance Act 2005 (NSW) | At least 14 days’ written notice before camera surveillance begins, clearly visible cameras and signage |
| Work health and safety consultation duties | Consultation with workers before introducing significant changes to how work is monitored |
New South Wales has also passed the Work Health and Safety Amendment (Digital Work Systems) Act 2026. Once SafeWork NSW publishes its guidelines and the provisions commence, businesses will need to manage risks arising from excessive or unreasonable monitoring by AI and digital systems. Organisations planning AI deployments in New South Wales should build this into their approach now.
Building trust on site
Technology only improves safety when the workforce trusts it. Safety systems succeed when crews understand why a control exists, what is being monitored and how information about them will be used. Sites that explain this clearly, before the cameras go live, get better participation in reporting and fewer objections later. That principle should shape every AI safety deployment, including the Australian rollout of Flagman.ai.
A practical checklist before you switch on AI safety cameras
- Define the safety purpose. List the specific hazards you are monitoring, such as forklift interaction, machine guarding zones or personal protective equipment compliance. Purpose drives every other decision.
- Start with detection only. Add facial recognition only where there is a clear safety reason, such as restricting access to dangerous machinery to trained operators.
- Notify and sign. Give written notice (at least 14 days in New South Wales) and install clear signage at entrances and monitored areas.
- Consult early. Involve workers, health and safety representatives and, where relevant, unions before deployment. Explain what is monitored, what is not, and who can see the footage.
- Assess privacy for facial recognition. Complete a privacy impact assessment, obtain consent, and always offer an alternative such as a swipe card or PIN.
- Switch off audio. Keep audio recording disabled unless there is a specific legal basis for it.
- Set retention rules. Keep footage linked to incidents for as long as the law requires, and delete routine footage promptly.
- Restrict access. Limit who can view footage and keep a record of access.
The solution: how Flagman is configured for Australian sites
Flagman processes video on a rugged edge device on site and does not need a cloud connection, which keeps footage within the customer’s control. For Australian deployments, Sharktech Global recommends starting with people, vehicle and personal protective equipment detection. Facial recognition access control is offered only as an optional module, supported by a privacy pack covering notices, consent, a privacy impact assessment template and data retention settings.
This approach lets sites capture the safety benefit quickly, while giving workers confidence that the system is there to protect them, not to watch them.
The outcome you can measure
The outcome is a safety monitoring system the workforce understands and the business can defend. Sites gain real-time detection of people, vehicles and missing protective equipment, footage that stays on site, and a clear privacy position before the first camera goes live. Facial recognition becomes a deliberate, documented choice rather than a hidden feature, which reduces legal exposure and builds the trust that makes workers more willing to report and act on safety issues.
Key takeaways
AI safety cameras are lawful and increasingly expected in high-risk Australian workplaces. Facial recognition is lawful too, but it carries stricter obligations that offline processing alone does not satisfy. Organisations that define a clear safety purpose, notify and consult early, and treat facial recognition as a separate decision will get the safety benefits without the legal and cultural risk.
Next step
Planning an AI safety rollout? Start with a site assessment that covers both safety and privacy. Sharktech Global is the Australian delivery partner for Flagman. Learn about Flagman in Australia or request a safety assessment.
Sources: Clayton Utz on the Bunnings Tribunal decision (February 2026); Office of the Australian Information Commissioner, facial recognition technology guide; Office of the Australian Information Commissioner, employee records exemption; NSW Government, Workplace Surveillance Act 2005; SafeWork NSW, Digital Work Systems Act 2026. This article is general information, not legal advice.
