The woman’s privacy breach was highlighted in a recently released decision by the Office of the Privacy Commissioner (OPC), in which it was revealed she learned of the photograph after a member of the public spotted it and recognised her.
Details identifying both the woman and the agency have been redacted.
It said while the photo was not displayed in a publicly accessible area of the reception, such as the desk or the waiting room, it had been pinned to a partition wall in the agency’s office, which could be seen by people standing in the public reception area.
The woman filed a complaint with the Privacy Commissioner, claiming finding out about the photograph from a third party led to “significant humiliation” and “injury to her feelings”.
“She said the fact of the photograph being visible in the reception area was open to the interpretation that she was a criminal or significant risk to the public,” the decision said.
“She said she suffered from social anxiety as a result and that she was afraid to go out and interact with other agencies.”
An investigator for the Privacy Commissioner asked the agency why it had a photo of the complainant on the wall.
While it could not give a reason, it noted the complainant did have “dealings” with the organisation.
“The agency said the photo had been up there for several years, and no current staff could remember exactly why the photo was there, nor why it had been there for so long.”
The OPC’s investigation found the original purpose as to why the photograph was collected, the basis on which the agency was disclosing the photograph, or what steps, if any, it took to keep the complainant’s personal information safe or secure from unauthorised disclosure were unsatisfactory.
The case raised issues under three principles of the Privacy Act - storage and security of information, use of personal information and disclosing personal information.
The agency accepted it had not met its obligations under the Privacy Act and removed the photograph.
“The agency acknowledged that this photograph should not have been kept where it was, and the fact that this was potentially visible, and would have been seen by visitors, was wrong,” the decision stated.
“That said, there was no malicious intent behind it.”
While the agency has apologised to the woman, she was not satisfied and wanted financial compensation, the decision stated.
However, the agency was not prepared to offer financial compensation.
The OPC closed the complaint for the woman to pursue her concerns in the Human Rights Review Tribunal, a judicial body where financial damages can be awarded.
OPC, an independent Crown entity, said the case was a reminder that the privacy principles apply to information in the physical environment, and not only to electronic systems.
“Agencies must have up-to-date information disposal, information safeguarding, and information retention policies for all the personal information they hold, electronic and physical.”
Tara Shaskey joined NZME in 2022 as a news director and Open Justice reporter. She has been a reporter since 2014 and previously worked at Stuff where she covered crime and justice, arts and entertainment, and Māori issues.
