What are the rules around collecting photos or other information of people from their social media profiles?

Anyone can generally collect photos and personal information about other people from social media for their own personal use. But in other contexts, businesses and organisations should:

only collect information that is necessary for them to carry out their relevant functions (information privacy principle one)
get it directly from the person concerned where practicable (information privacy principle two), and
take care not to be unfair or unreasonably intrusive when doing so (information privacy principle four).

These three principles mean that collecting information about someone from publicly available social media when you have a genuine need for that information, and you can’t get it directly from the person, is not an issue. Accessing a publicly available social media profile is not considered unreasonably intrusive, since it is information that anyone can see.

Bear in mind that there are different rules for news media. For one thing, the news media are exempt from the Privacy Act, along with MPs and courts and tribunals. If you have a privacy complaint about a news organisation, you will need to address it to a relevant media regulator – the Broadcasting Standards Authority (BSA)(external link) or the New Zealand Media Council(external link).

Here's how the BSA dealt with a complaint against a news broadcaster over how it used publicly viewable photos sourced from Facebook in its coverage of a fatal bus accident(external link). In this case, the BSA upheld the complaint that the broadcaster had breached the privacy of the victims and their families. It noted that where social media content is re-published on another platform, such as broadcast media, privacy considerations should be considered afresh, particularly in sensitive circumstances.

The collection of information from individual social media platforms might also depend on the terms and conditions of a particular platform.