Identify how the material managed to end up being published on the website.
A mother enrolled her daughter in a school holiday programme run by a regional sports trust. When filling out the enrolment form, the mother ticked 'No' to the question whether she gave permission for her daughter's name, photo and/or video to be published in programme newsletters or used for publicity.
A local newspaper published a photograph of the daughter and three other children. The photograph named the children and identified them as participants in the holiday programme. It stated where the programme was held. The mother complained that her daughter's privacy had been breached.
The complaint raised issues under principle 11 of the Privacy Act. This principle provides in part that an agency that holds personal information about an individual shall not disclose that information unless the agency believes, on reasonable grounds, that one of the exceptions to principle 11 applies.
The Trust did not seek to rely on any of the exceptions to principle 11 and in the view of the Privacy Commissioner, none of those exceptions applied. Accordingly, the Trust was found to have breached principle 11 by publishing the daughter's photograph.
In order to find an interference with privacy, the Privacy Commissioner must be satisfied that there has been a breach of a privacy principle and the breach has caused the individual some harm, loss or detriment as set out in section 66 of the Act.
The mother advised that she and her daughter had in the past been harassed by the mother's former partner. She had contacted Police who had advised the mother that no information should be disclosed to the former partner that would enable him to have access to the family. The daughter also explained that since her photograph had been published, she no longer felt safe.
The Privacy Commissioner was satisfied the daughter had suffered harm of the type and extent required by section 66. It was clear that the publication of the daughter's name, photograph and location could adversely affect her interests given the safety concerns.
The Trust apologised for the inadvertent disclosure of the girl's personal information and expressed genuine regret at what had happened. The Trust also put new procedures in place to prevent any recurrence of this situation.
The Trust offered the girl a 12-month gym membership to one of its facilities. But the mother did not find this acceptable and sought $500 in compensation.
Where there is an interference with privacy, the Privacy Commissioner encourages the parties to settle the matter. If they cannot do so, the matter can be referred to the Director of Human Rights Proceedings, who decides whether to bring proceedings to the Human Rights Review Tribunal.
While the mother's request for compensation was modest, the Trust was not in fact in a position to pay. It had made another offer of settlement, of equivalent value, in good faith.
Taking everything into consideration, the Privacy Commissioner exercised his discretion not to refer the complaint to the Director. But the mother was advised of her right to take the matter up with the Director of Human Rights Proceedings, if she wished.
Insights from agencies
“Banning social media is not a strategy. Many organisations bring in customers through networking. With guidance and training, employees can be encouraged to do this safely.”
“The term ‘data’ is not helpful and can invite complacency because it makes people forget that it is information about people.”
- New vulnerabilities are being found in computer operating systems and third party applications on a daily basis. Patches are regularly issued to address these vulnerabilities and they will protect you from hackers if you install them.
- Make sure all systems that contain or access sensitive information have all necessary operating system and third-party application security patches and updates.
- Carry out regular security checks and audits. Consider penetration testing as an option.
- Use strong passwords and don’t share or reveal passwords.
