Cameras capturing the faces of shoppers at one of Australia’s biggest retailers breached privacy laws, the Privacy Commissioner has ruled.