20 Aug 2024, 09:00

Background
A video of an upset minor went viral on social media after it was uploaded without their consent. The minor’s family took steps to remove the video from major social media platforms. However, the video was not able to be completely removed and copies continued to circulate after the original was taken down.

Several months later, a New Zealand organisation’s social media team decided to use a still image of the boy crying and quote from the original video as part of an advertising campaign. This effectively turned the boy into a meme for profit.

Due to the significant reach and social media presence of this organisation, the boy was re-victimised resulting in a resurgence of both online and in-person bullying and a rapid decline in his mental health.

The family approached the organisation who used his image, explaining the situation, and the organisation promptly removed the post from its social media accounts. However, the effects on the boy and his family remained, and they were unable to reach a resolution with the organisation directly. The family complained to our Office about the collection and disclosure of the young boy’s photo.

The relevant information privacy principles
We investigated the complaint under the following principles.

Principle 4 states that personal information must be collected in a way that is lawful and seen as fair and reasonable in the circumstances. Particular care must be taken when the information is being collected from children or young people.

Principle 11 says an agency generally should not disclose personal information, including someone’s photograph, unless it reasonably believes one of the listed exceptions applies. 11(1)(d) allows for the disclosure where the source of the information was a publicly available publication AND in the circumstances of the case, it would not be unfair or unreasonable to disclose the information.

This qualification to the exception was introduced in 2015 when the Harmful Digital Communications Act came into force. This was done on the recommendation of the Law Commission, to reflect the fact that significantly more information is being made publicly available online, and in many cases the individual concerned would have had no role in or consented to the publication. Limiting the reuse or disclosure of this information helps to protect individuals from further harm or victimisation, without needing to consider the reason it was published in the first instance.

OPC Investigation
As the image was publicly available at the time of collection, we found the organisation did not breach principle 4. Therefore, the focus of our investigation was on the subsequent disclosure of the image in the social media posts.

The organisation argued that it was not unfair or unreasonable to use the image as it had already gone viral. It said it did not know the child was a minor when the image was used or that they did not want the original video online. It also argued other private individuals had reposted the video without consequence.

Our investigation found that the minor’s age was a major factor in this case when determining whether it was fair or reasonable to use a publicly available image in the circumstances. It was evident from the original video and the still image that the boy was a minor at the time of the recording. Children and young people are particularly vulnerable to the misuse of their personal information and extra care should be taken when disclosing personal information.

Another relevant factor included the disclosure was for an advertising campaign, intended for broad reach across the country and financial profit for the organisation, and that it did not make any attempt to identify or contact the minor or their family to seek consent before using their image. The Advertising Standards Code requires an agency to get parental or guardian consent must be obtained before personal information of anyone under the age of 18 is used in an advertisement.

Finally, our Office found it relevant the minor and his family had taken steps to have the original video removed, though the organisation did not initially know they had done this. We found in our investigation that the image and video were not as readily available, and the organisation would likely have searched specifically for that image.

OPC’s preliminary view was that the organisation had breached principle 11, and interfered with the minor’s privacy. For an action to be an interference with privacy, a breach of a privacy principle must have also caused harm to the individual to the threshold in section 69.

Commentary
Extra care needs to be taken with young people’s personal information. Age is an important factor when considering fairness and reasonableness under the Privacy Act. We encourage agencies to remember that these are real people in these videos or online memes.

This is a David vs Goliath case, where the onus and due diligence was on the organisation with a team of professional communication experts. Ignorance of the situation is not an argument to decision making which ultimately causes harm.

Just because information is publicly available, does not make it automatically ok to reuse or republish for your own purposes. There can be significant impacts on all individuals, and particularly those who are more vulnerable such as minors. Online tools make it easy to share information without thinking, but agencies still have obligations to take care with personal information collected.

A good way to avoid negative outcomes is to stop and think before sharing the information. Would the individual be surprised to find you are using or sharing their information in this way? Are their any factors which make them vulnerable, or you suspect they would not want the information shared? If the answer is ‘maybe’ or ‘yes’, that might be a good time to reassess what you’re using the information for.

The agency apologised for the harm caused, and a financial settlement agreement was reached between the parties.