It’s a familiar sight in local Facebook groups: a CCTV image, a caption like “Do you know this person?”, and a warning that someone has allegedly been caught shoplifting, scoping a house for a burglary, or even worse.
The posts, often widely shared across platforms by businesses or individuals, might appear to be a form of community justice, but the legal risks that come with making them are real.
In New Zealand, publicly accusing someone online of committing a crime can have legal ramifications.
The Office of the Privacy Commissioner (OPC) says it receives complaints about public shaming or identification on social media “relatively often”.
A spokesperson told 1News that publishing a photograph of a person with the purpose of causing them harm or embarrassment was likely to breach the Privacy Act 2020.
They said there is a better route to take. “If you believe an individual has committed a crime, the appropriate response is to contact the police,” they said.
The Privacy Act 2020 provides clear rules for how personal information, such as an image of a person, can be collected, used or disclosed. Three key principles apply when someone is publicly identified online:
- Accuracy matters (IPP 8): Agencies must take reasonable steps to ensure personal info is correct before using or sharing it.
- Stick to the purpose (IPP 10): If you collect someone’s info for one reason – like security – you can’t use it for another, like public embarrassment.
- Don’t overshare (IPP 11): Disclosure is only allowed if there’s a valid reason, like consent or legal obligation.
In one such case, a shop manager posted CCTV images of a teenage girl on Facebook, accusing her of shoplifting with a group of friends in a clothing store.
The post, made to a local “Wall of Shame” page, implied all individuals pictured had stolen items, but only two of the group were charged.
The girl, who was not charged and cooperated with the police investigation, experienced humiliation in her small community and suffered a serious decline in her mental and physical health.
The Privacy Commissioner found the shop had breached Principle 10 (using personal information for a different purpose than it was collected) and Principle 11 (disclosing personal information without a valid exception).
Although the girl wasn’t named, she was clearly identifiable, and the post was deemed to be for the purpose of embarrassment, not security.
The OPC said while the Privacy Act does not generally apply to individuals, it can if the collection, use or disclosure of the personal information involved is “highly offensive”.
“The fact that posting personal details about another person may not be a Privacy Act breach does not mean that you can do so without any consequences. The Harmful Digital Communications Act sets out principles to prevent harm from certain online behaviours such as cyber bullying, spreading personal information and so on.”
People often forget that posting online can have real world consequences and that posting another person’s image can have impacts, the OPC spokesperson said.
“We advise people to be mindful of their privacy rights. If your photo is published online in a harmful way you can take steps to have it removed.”