---
title: "Assess a retail facial recognition collection against the sensitive information rules"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-retail-facial-recognition-collection-against-the-sensitive-info"
type: "task"
site: "AI Law Framework"
id: "A25-QU20261022-3"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Assess a retail facial recognition collection against the sensitive information rules

> From the system description the lawyer supplies, build an issues table on the consent pathway and on the two exception pathways the guide treats as most relevant: required or authorised by an Australian law or a court…

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-retail-facial-recognition-collection-against-the-sensitive-info  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the system description the lawyer supplies, build an issues table on the consent pathway and on the two exception pathways the guide treats as most relevant: required or authorised by an Australian law or a court or tribunal order, and a permitted general situation where consent is unreasonable or impracticable. Note that a brief capture, including an image held only in memory, is still a collection, and that a vendor does not move responsibility. The tool does not decide the lawful basis and writes nothing that is published. |
| What the lawyer must review | The lawyer decides whether collection is reasonably necessary and whether consent or an exception is available, and writes any notice, policy wording or assessment that is used. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Source-by-source verification**

Trace relied-on content to independent sources and check for relevant material the output has missed.

- What the AI does: From the system description the lawyer supplies, build an issues table on the consent pathway and on the two exception pathways the guide treats as most relevant: required or authorised by an Australian law or a court or tribunal order, and a permitted general situation where consent is unreasonable or impracticable. Note that a brief capture, including an image held only in memory, is still a collection, and that a vendor does not move responsibility. The tool does not decide the lawful basis and writes nothing that is published.
- What the lawyer does: The lawyer decides whether collection is reasonably necessary and whether consent or an exception is available, and writes any notice, policy wording or assessment that is used.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Treat a facial template used for automated identification or verification as sensitive information, and do not treat signage or an opt-out as consent.
2. Test reasonable necessity against less intrusive alternatives. Convenience or cost does not establish it.
3. Flag the privacy-policy requirement to refer specifically to facial recognition, and the further policy information required from 10 December 2026 where a computer program makes a decision of the kind the guide describes. The lawyer decides the basis.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC: Facial recognition technology guide](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/facial-recognition-technology-a-guide-to-assessing-the-privacy-risks) (checked 2026-10-22)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-retail-facial-recognition-collection-against-the-sensitive-info/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*