"I take a dim view towards agencies being so cavalier with personal information.
"Expression Sessions didn't just omit details about how the photos would be used. It went as far as to explicitly say that the photos would be deleted, and then go on to print them on a poster."
The principals breached regarded the failure to say how information (the photo) would be used, the collection of information in unlawful or unfair ways, failing to delete then information when it was no longer needed, and using information for a purpose other than why it was collected.
Expression Sessions stopped communicating with the Privacy Commissioner's office halfway through its investigation last year.
"Agencies that breach peoples' privacy should take steps to make it right," Edwards said.
"At a minimum, this includes engaging with my office's investigations by answering questions and providing relevant information. Expression Sessions did not do this."
Edwards said the office chose to name the firm to warn consumers of its unlawful practices regarding the use of personal information.
Expression Sessions could not be reached for comment.