Hardline law-and-order advocates the Sensible Sentencing Trust have been labelled "negligent and cavalier" after wrongly posting an innocent man's photo next to the details of a convicted paedophile on its website.
The trust's online offender database listed the man's picture with the description of a convicted paedophile with a similar name for almost two years, leading to social media abuse and fears that the man's tarnished reputation would damage his business.
The convicted paedophile had the same first and last names as the man, but their middle names were different.
Founded by former Conservative Party candidate Garth McVicar, the trust has now deactivated the database and is checking all of the offenders' records.
The blunder was only discovered after the innocent man received a call from one of his customers before he notified SST and later complained to the Office of the Privacy Commissioner.
In a statement released today, Privacy Commissioner John Edwards lambasted the trust after an investigation.
He said it was important for New Zealanders to be aware of the breach to warn them of the trust's "continuously negligent, cavalier, and dangerous approach to privacy".
The case also highlights the lack of an effective enforcement regime in the Privacy Act, he said.
When explaining the error to Edwards, the Sensible Sentencing Trust said a member of the public submitted the man's photo before a volunteer uploaded it to the database - but without taking any steps to verify its accuracy.
The trust admitted it did not know who submitted the photo or who uploaded it, while also confessing its volunteers were not provided with privacy training.
This disclosure came despite a 2014 assurance from the trust to provide relevant personnel with privacy training.
"Agencies must take reasonable steps to check that personal information is accurate before they use it," Edwards said.
"Relying on the assistance of unpaid volunteers does not excuse the Sensible Sentencing Trust of its legal obligations."
The Privacy Commissioner found the trust clearly harmed the man with its actions, who was the victim of social media abuse and afraid his tarnished reputation would damage his business.
The database page with the man's photo received just 574 unique views over the two years, but someone who saw the picture posted it to school and community Facebook groups.
He called the man a threat to children.
"It took a lot of effort for him to get these social media posts removed," Edwards' case notes read.
"He contacted schools and community groups, as well as NetSafe and the police. The man found it frustrating that he had to go to all this trouble to fix someone else's mistake."
The innocent man, meanwhile, suffered a financial loss and the customer who alerted him to the photo said they would no longer work with his business.
"He had to take a lot of time out of running his business to try to fix this issue," Edwards wrote.
"The man described how this incident humiliated him and his family, affecting their dignity and injuring their feelings. He recounted his feelings of fear and anger and described this situation as an 'emotional nightmare'."
Uncertain how far the false information had spread, the man was also worried the photo may be in similar databases across the internet.
"When he was in public, he found himself looking away from people for fear that someone would recognise him from the database," Edwards said.
"The man also described the difficulty he had in explaining the Sensible Sentencing Trust's mistake to his friends, who thought that they had been associating with a convicted paedophile."
The trust told the Privacy Commissioner the purpose of its offender database is to protect the public from harm and help keep offenders accountable.
"In this case it has done the exact opposite," Edwards said.
"The magnitude of this error calls the Sensible Sentencing Trust's capabilities into question and raises concerns that the database may have contained other significant errors," Edwards said.
In response to the investigation, the Sensible Sentencing Trust acknowledged the mistake and deactivated its database.
The trust also called some of the man's clients, published a notice in a local school's newsletter, and offered to hold a public meeting to correct the mistake.
The Privacy Commissioner will now refer the man's complaint to the Director of Human Rights Proceedings after he and the Sensible Sentencing Trust were unable to reach a settlement.
"The man made a reasonable request for financial compensation to settle this complaint," Edwards' notes read. "The Sensible Sentencing Trust said it was unable to meet the proposed figure and offered a significantly lower amount."
In a settlement with the director for another privacy case in 2014, the trust had agreed to provide relevant personnel with privacy training.
The Privacy Commissioner said in today's statement his office understands the Sensible Sentencing Trust provided one person with training, but they left the trust shortly after.
"It's very disappointing that – having previously been found in breach and agreeing as part of a settlement to improve its compliance – the Sensible Sentencing Trust has failed to meet its obligations, at the cost of an innocent man's reputation and peace of mind," Edwards said.
An innocent man was implicated for a terrible crime, his reputation tarnished and potentially put at risk of violence, Edwards wrote in his notes.
"The magnitude of the error raises concerns of other errors in the database, and whether the Sensible Sentencing Trust has the capability to operate it."