Research in the field uses “biometric” broadly: a 2022 review of EEG studies, for example, asks which biometric measures, such as eye tracking, combine best with brain recordings. The Privacy Act’s definition is narrower, so the useful questions come in order.
Six questions, in order
Is anyone identifiable?
Personal information is information or an opinion about an identified individual, or one who is reasonably identifiable, whether it is true or not, and whether it is recorded or not.
Two of the OAIC’s examples bear on consumer research. Information inferred about a person from their activities, such as their tastes and preferences from online purchases or browsing, can be personal information. So can a recording of a person’s voice, where the person is reasonably identifiable, for example because it is linked to their file.
De-identified information is not personal information. Context matters: the OAIC gives the example of a data set that might count as de-identified while researchers can reach it only in a secure lab under strict contracts, and would likely be personal information if the same data were posted freely online.
Is it sensitive information?
Sensitive information is a defined list. It includes health information, genetic information, biometric information to be used for automated biometric verification or identification, and biometric templates, alongside information about matters such as racial or ethnic origin, religious beliefs, sexual orientation or criminal record.
The OAIC lists the features biometric scanning can copy: the face, fingerprints, iris, palm, signature and voice. Sensitive information gets a higher level of protection because mishandling it can lead to discrimination, humiliation or embarrassment.
A recording that is not used to verify or identify anyone may fall outside that biometric category and still be personal information, or fit another category such as health information. Which applies depends on the data and its use.
Does the Privacy Act cover the organisation?
The Act applies to Australian Government agencies, to organisations that turn over more than $3 million a year, and to some others. Most small businesses, with a turnover of $3 million or less, are not covered, but some are whatever their turnover, including health service providers and businesses that trade in personal information. The OAIC’s small business page has the full list and a checklist.
What does collecting it require?
An organisation covered by the Act may collect personal information only where it is reasonably necessary for its functions or activities. For sensitive information, the person must also consent, unless an exception applies.
“Reasonably necessary” is an objective test, and the OAIC says it is not enough that collection is merely helpful, desirable or convenient. It expects organisations to collect the minimum needed.
Consent can be express or implied, and has four key elements: the person is adequately informed, gives it voluntarily, gives it for something current and specific, and has the capacity to understand and communicate it. For sensitive information, the OAIC says organisations should generally seek express consent. Consent should not be sought more broadly than needed, for example for undefined future uses, and withdrawing it should be easy.
What if the study records faces?
The OAIC’s guide to facial recognition technology, last updated on 29 July 2026, describes it as capturing an image of a face, extracting its distinct features into a biometric template, and comparing that with other templates to verify or identify someone. The Act is technology-neutral: it neither bans nor specifically permits the technology, and use must comply with the Australian Privacy Principles.
The guide’s key points include:
- a privacy impact assessment at the outset, before deciding to proceed;
- a lawful basis for collection, which on the consent pathway means valid consent, with collection reasonably necessary and proportionate;
- reasonable steps to notify people about the collection, whether it rests on consent or an exception;
- accurate biometric information, with steps to address the risk of bias; and
- security, and destroying or de-identifying the information once it is no longer needed.
The guide is written for identifying people in physical spaces such as shops, and notes that systems built for other purposes collect different information and raise their own considerations. It was updated after a tribunal decision about one retailer’s use of the technology; a determination about another retailer remains under review. An eye-tracking or facial-expression study is a different use, but the same questions about consent, notice and retention are a fair place to start.
Is there a remedy outside the Act?
Since 10 June 2025, people can also sue for a serious invasion of privacy under a statutory tort. It is broader than the Privacy Act and can reach people and organisations that the Australian Privacy Principles do not cover. It covers intruding on a person’s seclusion and misusing information about them, where they had a reasonable expectation of privacy. Among the other things a person suing must show is that the public interest in keeping their privacy safe is greater than any public interest that weighs against it. Consent is one of its defences, and the OAIC has no direct role in administering it. Some bodies are exempt, intelligence agencies and law enforcement bodies among them, and journalists in certain circumstances. A claim has to be started within set times: before the 21st birthday of a person who was under 18 when the invasion happened, and otherwise by the earlier of one year after the person became aware of it and three years after it happened.
For the research-ethics side of consent, which sits alongside these rules, see consent in research. For why privacy was among the first worries about neuromarketing, see what neuromarketing is.