That’s a really good question. I believe the Privacy Act was updated in 2020 to have more teeth but I haven’t had to work in that space in a long time so I’m not sure what that changes actually were.
The Privacy Act basically says you can’t collect personal info on people without them knowing, and even if they know, without a reason (to sell it to third parties is still a reason).
IANAL so I’m not sure on the ramifications here, but I suspect lawyers aren’t too sure either and are waiting for some precident. But collecting people’s faces would be personal information. If they don’t store it then maybe no harm no foul? But for the people they store (suspected shoplifters - NOT convicted shoplifters), you would have to inform them in some way and get their consent (implied consent via signage?).
The privacy commissioner’s office is probably watching closely to see how they implement this within the law to set a standard, but I suspect they don’t have a lot of power to stop it if New World follow the Privacy Act (much like Facebook and Google exploit the hell out of people’s personal info, but inform them via Ts & Cs).