In a case exposed by CHOICE, the privacy commissioner has found that home hardware retail giant Bunnings breached the Privacy Act.