Failures at two Pak’nSave stores led to breaches of the Privacy Act involving former Green MP Golriz Ghahraman and Samoa’s Police Minister Faualo Harry Schuster, causing “significant reputational and emotional harm”, an independent inquiry by the Privacy Commissioner has found.
While brand-owner Foodstuffs (North Island) said “separate and isolated actions ... by third-party security guards” at two stores were to blame, the Privacy Commissioner Michael Webster has revealed widespread changes across the company’s supermarket business.
Webster’s ruling linked failures at both stores, saying “the underlying cause of both incidents was the absence of reasonable and appropriate safeguards” required by the Privacy Act.
Ghahraman told the Herald that while Foodstuffs had not acknowledged any systemic issue, the finding by the Office of the Privacy Commissioner showed there was one.
She said it also showed there was an issue with surveillance in supermarkets, which raised further concerns because retail surveillance is used by police.
“We have no idea what store staff are doing with our images. Police are also making use of it – and we have no idea what they are doing with this technology.”
In both cases, images from the stores were unlawfully sent outside the company and published online.
In Ghahraman’s case, it led to reporting she was again in police sights after a guilty plea earlier that year for shoplifting clothing from high-end fashion stores.
For Schuster, the imagery was posted to social media groups with a focus on Samoa.
“Both affected individuals experienced significant harassment and reputational harm as a result,” the Privacy Commissioner found.
Ghahraman was photographed inside the Royal Oak store in October 2024 after being stopped and questioned by security staff. Foodstuffs North Island later said the way the photograph was taken was part of the store’s protocol.
In January, Schuster, a lawyer and former judge, was shopping at Pak’nSave Clendon while on holiday in New Zealand. CCTV footage from inside the store was recorded by a contracted security guard on a personal mobile phone, provided to an employee and later published on social media with accompanying text alleging Schuster was shoplifting.
The Privacy Commissioner’s ruling found both stores breached the principles in the Privacy Act restricting disclosure of personal information and requiring those capturing such material to have “reasonable” safeguards in place to protect it from misuse or unauthorised disclosure.
The finding said the underlying cause in both cases was the absence of “reasonable” safeguards, particularly in relation to contracted security staff.
It said the incidents highlighted the risk to people’s privacy when agencies failed to have proper controls over contractors who access or operate surveillance systems.
The ruling found Pak’nSave Royal Oak had no written contract with its security provider. It meant there were no contracted terms around privacy obligations and no ability to compel co-operation in privacy investigations.
At Pak’nSave Clendon there was a written contract but it had a generic confidentiality clause and no enforceable privacy requirements.
The investigation found neither store provided privacy training to security personnel handling surveillance information and there were not enough controls in the organisation or its surveillance systems to prevent misuse.
The Commissioner’s ruling said these failures meant the safeguards around personal information were not reasonable in the circumstances.
In the ruling, he said outsourcing security functions did not outsource accountability. He said those who contracted outside companies and individuals had to make sure they knew what their privacy obligations were and to have a system to ensure they were routinely monitored.
The naming of the stores was appropriate, said the ruling, because of the seriousness of the breaches and public interest in how surveillance technologies were used in places such as supermarkets. It said public trust depended on people knowing surveillance footage was used responsibly and kept secure.
In the ruling, the Privacy Commissioner said the company had co-operated and been helpful during the investigation.
It said Foodstuffs had brought in changes across its stores, including mandatory written contracts with contractors handling personal information. It had also introduced a Security Systems Code of Conduct, a ban on the use of personal phones for security activities, and privacy and data security training for staff and contractors.
It has also updated its breach assessment protocols to ensure unauthorised disclosures of personal information on social media are treated as notifiable privacy breaches.
Foodstuffs had previously apologised to Ghahraman and to Schuster.
In a statement today, a spokeswoman for the company said Foodstuffs took its responsibilities under the Privacy Act seriously.
“The two incidents involved separate and isolated actions taken by third-party security guards. Their behaviour did not meet the standards we set for anyone working in our stores, including contractors.
“The individuals concerned did not follow appropriate processes and their conduct fell well short of what we expect.”
The statement said “each store has completed additional training for all security team members and contractors who handle personal information”.
“Updated written agreements are now in place with every security contractor, and our expectations on them are clear.”
The statement did not make reference to the wider changes raised by the Office of the Privacy Commissioner.
It said: “Protecting customer privacy is essential, and we are committed to ensuring our systems and oversight remain strong, so this does not occur again.”
The Herald has also approached police for comment. Officers were provided with the digital photograph taken by the security guard, saying the guard was treated as a witness. No charges were laid against Ghahraman.
The findings come as the Ministerial Advisory Group on Retail Crime, of which Foodstuffs is a member, pushes for law changes to allow expanded use of facial recognition technology by retailers.
Justice Minister Paul Goldsmith has said privacy safeguards would need to be in place if facial recognition powers were expanded, while retailers argue new technology is needed to combat theft and violence.
David Fisher is based in Northland and has worked as a journalist for more than 30 years, winning multiple journalism awards including being twice named Reporter of the Year and being selected as one of a small number of Wolfson Press Fellows to Wolfson College, Cambridge. He first joined the Herald in 2004.
Sign up to The Daily H, a free newsletter curated by our editors and delivered straight to your inbox every weekday.