Resources and learning

A woman with long red hair and a fringe stands sideways looking behind her. She has her hands in a bin of CDs. She is white and wearing a plain black top and tartan pants. Often known as a ‘wall of shame’, displaying CCTV images in a shop where the public can see, creates privacy risks for people . It also potentially breaches the Privacy Act.

Images displayed in stores or on store windows are likely to be privacy intrusive because they:

share personal images of people claiming that they’ve committed a crime in the store
make that information available to the public, not just staff who need the information as part of their job.

Businesses might think this is a good way to deter crime, but publishing identifiable images captured by CCTV carries privacy risks for the store.

What the Privacy Act says

The Privacy Act requires that agencies only collect personal information (like footage of someone) that is necessary for a reason connected to their functions or activities. In the case of using CCTV, the purpose for using it is generally connected to security reasons.

The Privacy Act prevents agencies from sharing personal information, including a person’s image, unless an exception applies. One of these exceptions is where sharing is necessary to avoid prejudice to the maintenance of the law by any public sector agency.

For example, if a retailer believes someone has committed a crime, they can share this information with the Police. The retailer also needs to ensure that the information they’re sharing is accurate.

A retailer may believe a person has committed an offence, and may want to find out who they are, but there is always the possibility they are mistaken. Publishing and sharing footage without ensuring accuracy can cause the person serious embarrassment, emotional, and reputational harm.

Public disclosure is difficult to justify, even if the use of CCTV is generally lawful.

Factors to consider

The impact of posting images of people in stores or online can be huge, with children and young people especially at risk. There can also be tikanga Māori considerations, which can be significant and sensitive for Māori because of the tapu concerning the human body and images, including tā moko, mataora or moko kauae.

The below examples are based on fictional organisations.

Example A: Fern Leaf

Emily walks into a store, Fern Leaf, which has signage at its storefront that says CCTV is in operation. She shops for a small time and walks out without purchasing or taking anything. The store manager saw Emily picking up items while they were in the store and believes that they shoplifted.

The store has a “wall of shame” near the front entrance and using the CCTV footage, a grainy but clearly identifiable image of Emily is put up on the wall. The store manager also posts an image of Emily on their local Facebook community page accusing her of shoplifting.

A few of Emily’s friends and family see the wall of shame and the Facebook post. This causes her a great deal of embarrassment and distress. They get in touch with Fern Leaf to explain the situation, but their request to take down the image and post is denied.

The reputational harm continues and Emily complains to the Office of the Privacy Commissioner. The store was found in breach of Information Privacy Principles 10 and 11.

Eventually Emily and the store reached a settlement and Fern Leaf take the images down. The issue was resolved but cost time, stress, and money for everyone involved.

A woman with a brown long bob stands in a shop holding and looking at a jar of honey or jam. She is wearing a floral dress.

Example B: Swiftstart NZ

Clyde walks into a small store, Swiftstart NZ, and steals several expensive items.

Swiftstart NZ has clear signage that tells people CCTV is in operation. They also tell people who they can contact for enquiries about collected CCTV footage.

Clyde is caught on this CCTV and trespassed from the store.

Swiftstart NZ’s store manager informs their small team of the trespass and submits a report to Police.

A few days later, when Clyde returns to Swiftstart NZ, a staff member notices them and calls the Police. Clyde is later apprehended by Police, and the stolen goods are returned to the store.

In this example, the CCTV footage is only disclosed to authorised staff and authorities, which results in a positive outcome for the store.

A man in his 20s stands in a car park looking at a phone. He is wearing a blue puffer jacket and has tight black jeans and blue sneakers. He has short curly hair and is white.