Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.

We respect your Do Not Track preference.

A professional photographer took a picture of a man in a shopping mall. Later the shopper saw two photographs of himself in a business directory promoting the shopping mall.

The shopper complained to my predecessor Bruce Slane, who looked into the actions of the shopping mall, which had supplied the photos to the directory. Mr Slane investigated whether, at the time that it photographed the shopper, the mall made the shopper aware of matters outlined in information privacy principle 3. I considered the case and agreed with Mr Slane's approach.

Principle 3

Principle 3 provides that where an agency collects personal information directly from an individual it must take such steps (if any) that are reasonable in the circumstances to ensure that the individual is aware of certain matters, including the fact of collection, the purpose for the collection, and the intended recipients of the information it collects. There are some exceptions.

The mall believed that as the photographer was clearly visible, it was not reasonable in the circumstances to inform the shopper of any of the principle 3 requirements. The mall also sought to rely on three exceptions under principle 3.

Principle 3(4)(b) – non-compliance would not prejudice the interests of the individual

Principle 3(4)(b) provides that it is not necessary to comply with the requirements of principle 3 if the agency believes, on reasonable grounds, that non-compliance would not prejudice the interests of the individual concerned.

The mall management thought it was reasonable to assume that people who were present in the shopping mall would have been comfortable with having their presence publicised.

Mr Slane did not accept that individuals would necessarily be comfortable with having their presence at a shopping mall publicised. In his view, the mall was not in a position to determine what would prejudice the interests of shoppers. Mr Slane observed that what may be considered prejudicial will often depend on the individual concerned. For example, an individual in a witness protection scheme may consider that having their picture taken at a shopping mall would endanger them. Further, the collection and use of such photographs may be culturally offensive to some individuals.

Principle 3(4)(e) – compliance not reasonably practicable in the circumstances

Principle 3(4)(e) provides that it is not necessary to comply with the requirements of principle 3 if the agency believes, on reasonable grounds, that compliance is not reasonably practicable in the circumstances of the particular case.

The mall management argued that it would not have been practicable for the photographer to seek the authorisation of every individual photographed. The mall indicated that the photographer relied on individuals who had concerns approaching him and seeking an explanation.

Mr Slane took the view that principle 3(4)(e) did not apply. He thought the mall management could have satisfied its obligations under principle 3(1) by placing prominent signage at its entrance, informing shoppers that there was a roving photographer on site for publicity purposes. However, Mr Slane agreed that it would not be practicable to require the mall to obtain consent from every individual who is photographed.

Principle 3(4)(d) – compliance would prejudice the purposes of collection

Principle 3(4)(d) provides that it is not necessary to comply with the requirements of principle 3 if the agency believes, on reasonable grounds, that compliance would prejudice the purposes of collection.

The mall management claimed that if a shopper's attention was drawn to the photographer, the photographer would be unable to obtain natural (as opposed to “posed”) images and this would defeat the object of the exercise.

Mr Slane disagreed that informing shoppers through the use of signage that they might be photographed for promotional purposes would prejudice the purposes of the collection. He thought that signage at the mall entrance would also have ensured that those people who did not want to be photographed could have shopped elsewhere or returned when the exercise was complete.

The mall management also subsequently explained that no specific written instruction was provided to its photographer to ensure compliance with principle 3. However, when people approached the photographer, the photographer would inform them that the photographs were being taken for mall publicity purposes.

Mr Slane formed the opinion that the mall management had breached principle 3 by failing to inform the photographer of the requirements in principle 3(1).

Section 66

In order for there to have been an interference with the man's privacy, Mr Slane had to be satisfied that the mall's actions had had an adverse effect upon him.

The man advised that since the photographs were in every household in the area, this had had a detrimental effect on him.

While there had been a breach of principle 3, Mr Slane was not satisfied that the man suffered an adverse consequence of the degree required by section 66. He advised the man of his right to take the matter to the Human Rights Review Tribunal.

As a result of the investigation, the shopping mall management changed its policies, including:

  • placing appropriate signage at the entrances to the mall alerting shoppers when a publicity photographer is on site;
  • redrafting the terms of engagement on which it contracts photographers to ensure that photographers are aware of the privacy issues involved;
  • ensuring that all photographers wear explicit signage to alert individuals to their presence and the fact that they are taking photos for publicity purposes.


March 2006

Indexing terms: Collecting personal information – Shopping mall – Shoppers photographed for publicity purposes –Steps taken to make individual aware of fact and purpose of collection –Whether breach caused harm – Privacy Act 1993, s 66(1)(b) – Information privacy principle 3(1), 3(4)(b), 3(4)(d), 3(4)(e)