Assess a retail facial recognition collection against the sensitive information rules
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- From the system description the lawyer supplies, build an issues table on the consent pathway and on the two exception pathways the guide treats as most relevant: required or authorised by an Australian law or a court or tribunal order, and a permitted general situation where consent is unreasonable or impracticable. Note that a brief capture, including an image held only in memory, is still a collection, and that a vendor does not move responsibility. The tool does not decide the lawful basis and writes nothing that is published.
- What the lawyer must review
- The lawyer decides whether collection is reasonably necessary and whether consent or an exception is available, and writes any notice, policy wording or assessment that is used.
- Written for / version
- US
Open a jurisdiction version of this task to see which instruments apply: US
Who does what
| Role | What they do |
|---|---|
| Assistance | From the system description the lawyer supplies, build an issues table on the consent pathway and on the two exception pathways the guide treats as most relevant: required or authorised by an Australian law or a court or tribunal order, and a permitted general situation where consent is unreasonable or impracticable. Note that a brief capture, including an image held only in memory, is still a collection, and that a vendor does not move responsibility. The tool does not decide the lawful basis and writes nothing that is published. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Treat a facial template used for automated identification or verification as sensitive information, and do not treat signage or an opt-out as consent.
- Test reasonable necessity against less intrusive alternatives. Convenience or cost does not establish it.
- Flag the privacy-policy requirement to refer specifically to facial recognition, and the further policy information required from 10 December 2026 where a computer program makes a decision of the kind the guide describes. The lawyer decides the basis.
Sources
- OAIC: Facial recognition technology guide · 2026-10-22
These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.