What is the Privacy Act?
The Privacy Act controls how people can collect, use, share and store personal information. Personal information can be in the form of a photo, emails or a recorded conversation (for example), which identifies you, and contains facts that wouldn’t normally be available publicly and could be sensitive (i.e. you would not want everyone to have that information).
The Act applies mostly to personal information collected by organisations and government agencies. Exemptions from the Privacy Act are described by the Privacy Commissioner and include personal information collected by an individual for personal, household or family purposes (e.g. a family photo taken on holiday). From 3 July 2015, the latter exemption does not apply if it would be highly offensive to an ordinary reasonable person to collect, use or disclose this information.
Back to top
What does the Privacy Commissioner do?
The Privacy Commissioner investigates complaints about breaches of privacy, including breaches of the twelve information privacy principles.
They can also provide information and advice to people who think their privacy has been breached, and to organisations that need help in complying with the Privacy Act.
If you have a complaint about a privacy breach you can report it to the Privacy Commissioner.
Back to top
If I want to photograph someone in public do I have to ask for their permission?
In general it is lawful to photograph someone in a public place (where there is no expectation of privacy, e.g. in the streets or a shop during business hours), without having to get their consent.
If you’re taking the photo for commercial purposes (e.g. for an advertisement) and the person can be identified in the photo, you will have to abide by the Privacy Act. For example you should ask your subject for permission to take their photo, and tell them who you are and how you will use the photo. You should not use the photo for a different purpose than what the person has agreed to.
Back to top
What can I do if someone has posted a photo of me on Facebook without my permission?
If the person who published the photo did so on behalf of an organisation or government agency (e.g. for a workplace photo ID), or if its publication could cause offence (e.g. because it is an intimate image) then they could be in breach of the Privacy Act. In this case you can contact the Privacy Commissioner to find out what your options are. If the photograph was taken in a public setting, it’s not likely to be considered a breach of your privacy.
Bear in mind that, once information is posted on Facebook or other social media websites, it is publicly available and the Privacy Commissioner cannot compel an agency to remove it, nor control how that information will be copied or distributed once it has been posted.
You can also report it to the content host and ask them to remove it (for example Facebook is supposed to remove content if they believe it is a breach of their Statement of Rights and Responsibilities).
However, it might be difficult to remove copies that have already been downloaded, or to enforce the removal from an overseas site.
If you feel that you have suffered as a result of this breach of your privacy you could also take legal action against the person who published the photo. It’s best to get legal advice if you are thinking of doing this. More about this is on the NetSafe website.
If sharing the image could be considered highly offensive (e.g. it is an intimate image) then you can make a complaint to the Police and to the organisation hosting the harmful content. Content hosts based in New Zealand must follow a complaints process when someone complains about harmful material on their site. This may include taking the image down. You will find more information about legal protections against harmful digital material on our Bullying page.
Back to top
My ex-boyfriend took an intimate photo of me from when we were together, and shared it online with his mates. What can I do?
If your ex shared an explicit image online without your permission (or even threatens to do so) then he is breaking the law. You can contact NetSafe for help and advice on what to do. If it’s appropriate (and with your permission) NetSafe can work with the online content host to remove the image, or contact your ex about removing the image from circulation.
You can call NetSafe on 0508 NETSAFE (0508 638 723) - they are available 8am - 8pm Monday to Friday, 9am – 5pm on weekend. Alternatively you can use their web form. There is more information the NetSafe website about this kind of activity (called “revenge porn”) on the NetSafe website.
The Police may get involved if:
- an intimate visual recording of you was made without your knowledge or consent, or
- an intimate visual recording of you has been shared digitally - online, for example - without your knowledge or consent (see the information on our Bullying page).
If NetSafe is unable to help, you can consider taking legal action on the grounds that your privacy was breached when the intimate photo was published (shared) without your consent, and that the privacy breach has caused you suffering. It’s best to get legal advice if you’re thinking of doing this.
Back to top
Someone has distributed my private emails around their workplace without my permission. What are my options?
If they did this on behalf of an organisation or government agency (for example if you emailed your health information to your insurer as part of a claim, and they distributed the information to people who did not need to see it), then they are in breach of the Privacy Act.
If they circulated your emails in their capacity as a private individual (e.g. colleague or friend) the Act would not normally apply, unless doing so would be considered by an ordinary reasonable person to be highly offensive (see the information on our Bullying page) - for example if you emailed health information to a family member who then forwarded it to others without your permission.
You can contact the Privacy Commissioner who can advise you of your options and give you an opinion about the rights or wrongs of the event. For breaches of the Privacy Act, the Commissioner can also refer your case to the Human Rights Review Tribunal if appropriate. The Tribunal can, for example, order that damages be paid to you.
More about this is on the NetSafe website.
Be aware that if your private emails are distributed by someone overseas it may be difficult to take effective action against it.
Back to top
My neighbour has installed a security camera which just happens to point directly into my son’s bedroom. What can I do about this?
Your first step is probably to talk to your neighbour about it. They may not realise that the camera is aimed into your own home, and might be fine with adjusting it. Most neighbour problems are best solved through calm and reasoned discussion.
The use of surveillance cameras must comply with the Privacy Act. If your neighbour knows that the camera is allowing them to see into your home and refuses to do anything about it, you can complain to the Privacy Commissioner.
Having a surveillance camera pointing into your home without your permission might result in you or your family feeling harassed – see our Harassment page for information on dealing with harassment, including how to apply for a restraining order to stop your neighbour from invading your privacy.
Neighbourhood Support New Zealand has some guidelines for neighbourhood groups wanting to install security cameras in residential areas.
There are fuller guidelines aimed at businesses, on the Privacy Commissioner’s website.
Back to top
Can my employer install surveillance cameras in the workplace?
Your employer is entitled to install surveillance (CCTV) cameras in the public areas of your workplace, for example to prevent theft in a shop. However they must do this under the Privacy Act principles . For example, the cameras should not be placed in such a way that they unreasonably intrude on people’s privacy (such as pointing into a changing room). In general your employer should tell the people affected (e.g. employers, customers and visitors ) that surveillance cameras are on, and why.
If your employer is trying to obtain evidence of illegal activity among the staff, such as theft or drug use, then it might be considered reasonable to have CCTV cameras operating covertly. In this situation the employer has to only collect the minimum footage necessary to achieve this aim.
There are guidelines aimed at workplaces, on the Privacy Commissioner’s website.
Back to top
My church group is taking some kids sailing. What do we need to know about taking photos of them to promote our group?
You’ll need to comply with the Privacy Act. This includes requesting permission from the children’s parents, telling them what you will use the photos for and how they will be published or distributed, and only using the photos for that purpose. It’s best to do this using a form that the parents can sign if they agree to it.
Back to top
Is it legal to record a phone conversation to use as evidence in a dispute?
It’s okay to record a phone conversation if all of the people in the conversation have agree to it.
You can also surreptitiously record a phone conversation which you are taking part in, if you have a good reason for doing so.
However you may be in breach of the Privacy Act if:
If you are in business and are recording phone conversations with your clients in case of a dispute, it is a good idea to let them know in advance. For example many organisations play a recorded message at the beginning of each call they receive.