The Privacy Commissioner has named a photography business it says used pictures of children in advertising material, despite not having received permission from their parents.

Expression Sessions operated a stall in a shopping centre in Tauranga in 2014, where it offered a free photo shoot for children, with the option for parents to later purchase prints.

One mother took Expression Sessions up on the offer, but did not ultimately purchase the photos of her children. She was told that the photos would be deleted.

Two years later, the woman found the photos used in a variety of advertising material, including a large print poster in a mall.

The Commissioner found that the Australian-owned company breached four principles of the Privacy Act.

“When people give their information to agencies, they need to be able to trust that those agencies will respect that information,” says Privacy Commissioner John Edwards.

“Expression Sessions misled this woman about almost everything – how long the photos would be stored, who would see them, and even why they were taking them in the first place.

“Not only did Expression Sessions omit the fact that photos would be used for promotional purposes, it went as far as to specifically say that photos would only be made available to the client,” says Mr Edwards.

“Putting someone’s photos on a poster makes those photos available to thousands of people, the vast majority of whom are not the client.”

Retention and use of information

Two principles of the Privacy Act are to require agencies to delete information when they no longer need it; and to prohibit agencies from using information for a purpose other than the purpose for which they collected that information. Since Expression Sessions told the woman that the photos were only for her, the Commissioner says, it should have deleted the photos when she declined to purchase them.

“I take a dim view towards agencies being so cavalier with personal information,” Mr Edwards says.

“Expression Sessions didn’t just omit details about how the photos would be used. It went as far as to explicitly say that the photos would be deleted, and then go on to print them on a poster.”

The company briefly engaged with the investigation, but ceased to communicate with the Privacy Commissioner’s office halfway through last year.

Mr Edwards says his office is publicly naming the company to warn other consumers about its unlawful practices when it comes to personal information.