Licensed clubs and hotels across NSW using facial recognition technology (FRT) for self-exclusion enforcement now have a formal rulebook to follow. The Code of Practice: Facial Recognition Technology in Hotels and Clubs, released on 16 March 2026, sets minimum standards for how venues deploy, govern, and secure FRT systems used to identify self-excluded patrons. For venues that have installed or are considering FRT-enabled surveillance, this is the first time there has been clear regulatory guidance — and it comes with a compliance clock attached.
What the Code actually requires
The Code doesn’t operate in isolation — it sits alongside existing obligations under the Privacy Act 1988 (Cth), and biometric templates generated by FRT are classed as sensitive information requiring a higher standard of protection than ordinary personal data. Venues using or planning to use FRT must now:
- Conduct a Privacy Impact Assessment (PIA) before deployment, or retrospectively if FRT is already installed, and retain it for inspection by Liquor & Gaming NSW (L&GNSW)
- Review and update data breach response plans to specifically address biometric data exposure and Notifiable Data Breaches scheme obligations
- Update privacy policies to clearly disclose FRT use, data types collected, storage, and deletion practices
- Display L&GNSW-approved signage once available, and obtain express, documented patron consent where possible
- Ensure FRT-linked data is stored exclusively in Australia with strict access controls
- Establish ongoing monitoring of system accuracy — including false positive/negative rates — and review effectiveness over time
- Confirm their FRT provider meets the minimum technical and support requirements set out in Attachment A of the Code
Venues requiring significant system upgrades to meet these requirements have six months from the Code’s release to become compliant. Venues that can already meet the standard are expected to do so sooner.
Why the Bunnings decision matters here
Six weeks before the Code dropped, the Administrative Review Tribunal (ART) handed down its decision in the Bunnings Appeal, partially overturning the Privacy Commissioner’s 2024 finding that Bunnings had breached the Privacy Act by deploying FRT across 62 stores. The ART upheld breaches relating to privacy governance, policy transparency, and patron notice (APPs 1.2, 1.3, 5.1), but set aside the finding that Bunnings had collected biometric data without lawful basis — accepting that the “permitted general situation” exception applied given Bunnings’ documented history of violent incidents and weapon-capable stock on shelves.
The Privacy Commissioner was quick to clarify this isn’t a general green light for FRT — the exception is fact-specific and tied to Bunnings’ particular risk profile. For clubs and pubs, the safer and more achievable path remains obtaining express patron consent through existing membership and sign-in processes, rather than relying on an exception that may not survive scrutiny without a comparable documented risk history. Critically, the ART’s affirmation of the governance and transparency breaches confirms that a PIA, a clear privacy policy, and unambiguous signage aren’t optional extras — they’re baseline Privacy Act obligations regardless of what the Code says.
Operational implications for venues
For operations managers running gaming floors with FRT-integrated CCTV or standalone facial recognition appliances feeding self-exclusion registers, this Code converts what was previously a best-practice conversation into a documented compliance obligation with an enforcement body attached. A few practical points worth flagging to management and boards:
- Compliance with the Code does not shield a venue from OAIC action for a separate Privacy Act breach, or from L&GNSW action for a gaming licence breach — the two regimes operate in parallel
- Existing FRT installations need a retrospective PIA if one hasn’t already been done — this isn’t just paperwork for new systems
- Data residency matters: if your FRT system or VMS integration routes biometric data through an overseas cloud service or vendor, that’s a compliance gap under the Code’s data localisation requirement
- “Reasonable” access controls and data security measures will likely be benchmarked against the FRT provider’s Attachment A obligations — worth confirming with your vendor directly rather than assuming compliance
Venues should also treat this as a trigger to revisit their broader surveillance documentation — not just the FRT component. A clear device register, data flow diagram, and network segmentation record make both the PIA and any future L&GNSW inspection considerably less painful.
The Mallen take
We’re increasingly seeing gaming venues ask whether their existing VMS and camera estate can even support what regulators now expect — accuracy reporting, access logging, and clean data segregation for biometric processing. If your facial recognition system was bolted onto a general-purpose CCTV deployment without that separation in mind, retrofitting compliance can be more involved than it first appears. This is exactly the kind of documentation gap the Mallen site audit is designed to surface before a regulator does — mapping what’s actually installed, where data flows, and where the gaps sit against a framework like this Code.
For venues running or considering FRT, the six-month compliance window starts now. Getting the PIA, privacy policy, and consent processes sorted early is far cheaper than scrambling once L&GNSW starts asking for evidence.
Original source: thomsons.com.au