Bunnings has breached Australians' privacy by using facial recognition technology, the privacy watchdog has found.