Privacy Commissioner John Edwards is warning people of photography agency Expression Sessions after finding it breached four sections of the Privacy Act. Photo / File
Privacy Commissioner John Edwards is warning people of photography agency Expression Sessions after finding it breached four sections of the Privacy Act. Photo / File
The Privacy Commissioner has found a photography business misled a mother "about almost everything" in using photos of her young children in promotional material without her consent.
The commissioner took the step of naming Expressions Sessions to warn people about its unlawful practices in its use of personal information.
Expression Sessions was investigated after a mother complained she recognised her children, aged under 4, in advertising from photos the business took of the children during a free photo shoot at Bayfair Shopping Centre, Tauranga, in 2014. Expression Sessions is also being investigated by the Commerce Commission.
The photography agency had operated from a stall at shopping centre for up to two weeks at different times and offered free photo shoots for children. Parents were given the option of buying the photos after they were taken.
The mother took Expression Sessions up on the offer but did not buy the photos and was told they would be deleted. Two years later, the woman found the photos used in a variety of advertising material, including a large poster in a mall.
Privacy Commissioner John Edwards said Expression Sessions breached four principles of the Privacy Act and misled the mother "about almost everything".
"Not only did Expression Sessions omit the fact that photos would be used for promotional purposes, it went as far as to specifically say that photos would only be made available to the client. Putting someone's photos on a poster makes those photos available to thousands of people, the vast majority of whom are not the client."
The Privacy Act requires agencies to delete information when they no longer need it and banned agencies from using information for a purpose other than for which it was collected.
Since Expression Sessions told the woman that the photos were only for her, it should have deleted the photos when she declined to purchase them, Edwards said.
"I take a dim view towards agencies being so cavalier with personal information," Edwards said.
"Expression Sessions didn't just omit details about how the photos would be used. It went as far as to explicitly say that the photos would be deleted, and then go on to print them on a poster."
We are publicly naming the organisation to warn other consumers about its unlawful practices when it comes to personal information.
Expression Sessions briefly engaged with the investigation but stopped communicating with the Privacy Commissioner's office halfway through last year.
Edwards said agencies that breached people's privacy should take steps to make it right.
"At a minimum, this includes engaging with my office's investigations by answering questions and providing relevant information. Expression Sessions did not do this.
"We are publicly naming the organisation to warn other consumers about its unlawful practices when it comes to personal information," Edwards said.
The Bay of Plenty Times contacted Expression Sessions today but it did not return messages left with a woman at its Auckland office.
Bayfair Shopping Centre manager Steve Ellingford said Expression Sessions had not been at the mall in the past 18 months but Bayfair was not aware of any privacy issues from its time there.
"Bayfair does not have Expressions Sessions booked, and does not have any plans to lease the company space in the future because we already have similar services on site," Ellingford said.
A Commerce Commission spokesman told the Bay of Plenty Times it had received 23 complaints about the company since January 2015, covering a range of issues including issues relating to cancellation of contracts.
"Our investigation is looking at issues relating to consumers' right to cancel the contract and whether the company's contracts comply with legal disclosure requirements, rather than privacy concerns."
What it takes to be named by the Privacy Commission
Although each case is considered on its merits, the following reasons suggest that an agency ought to be named:
• Where the agency's conduct is likely to have affected persons other than a complainant who has already come forward, and the effect cannot be remedied in relation to those other persons by the agency; • The agency has been involved in a single very serious breach (where the breach has caused significant harm, or where a number of people have been affected by the breach), and/or the agency has been involved in multiple breaches, which it has failed to address; • The agency has demonstrated an unwillingness to comply with the law (as distinct from a bona fide disagreement over the meaning of the law); • There has been an exercise of public functions or statutory powers and naming is likely to enhance accountability; • In all the circumstances the public interest would benefit from identification of the agency, because of its deterrent effect, educative purpose or otherwise. • In circumstances where a decision not to name the agency in any report from the Commissioner is likely to unfairly impact on other agencies within that specific sector or industry.
