The Privacy Commissioner has released two case notes which look at the investigation of complaints where information about the complainants was posted online.

In Case Note 240409 [2016] NZ Priv Cmr 1, security camera footage of a group in a clothing shop was posted on the shop's Facebook page. The post, on a page entitled "Wall of Shame", stated "these people forgot to pay for their items". Only two of the group were charged with shoplifting. 

The father of a teenage girl who was in the group but not charged with any offence complained to the shop about the photos which he said unfairly branded his daughter as a shoplifter.

The father said the shop's use of the security camera photos gave the impression that all of those shown in the images were shoplifters.

Signage on the shop's front window said that any security camera footage might be shared with other retailers, but it did not mention any use beyond that.

The manager said she had published the photos but not included their names, and felt justified in publishing them on Facebook because of the notice on the front window.

The Privacy Commissioner says the publication of the images was for the purpose of embarrassing the people in the photos, and was not consistent with collecting personal information for security reasons.

"We concluded that the shop had breached both privacy principles 10 and 11 by posting the photos online. The shop eventually did remove the photos of the group from its Facebook page," the Commissioner says.

In Case Note 256329 [2016] NZ PrivCmr 2, a woman was accused of being a "dodgy trader" by an online community. Her personal information, including her address, photos, bank account and cell phone numbers were all posted in a comments thread on the website.

She told the website administrators that the information about her was wrong and asked for it to be immediately removed. The website's administrators refused to remove the information.  They told the woman that they would only consider her request if she had evidence to show that the claims about her were wrong.

"We told the site administrators that we were concerned because this was the second complaint we had received about that online community," the case note says.

"We considered whether the site had met its Privacy Act obligations, including correcting personal information when asked; making sure personal information on the site was relevant, up to date and not misleading; and not improperly disclosing personal information (privacy principles 7, 8 and 11). 

"We talked to the website administrators about the need to moderate comments, and advised them not to use anyone's full name or contact details, unless they had consented. 

"We also advised the site administrators that they should ask people to provide proof of any potentially defamatory assertions so they could be tested for accuracy before being published.  People should also be made aware that if they were named on the website they had a right of reply.  If they asked for their personal information to be removed, that request should be responded to as soon as possible.

"The website administrator told us our advice had 'not been enthusiastically received' by the rest of the website team.  However, they did eventually remove all the information about the woman."