Social media and privacy: NZ laws fail to keep pace

Existing legal protections for the unauthorised use of an individual's image, likeness, or personality and their removal from online platforms are inadequate, writes Nikki Chamberlain in the book Privacy Law in New Zealand (third edition), due for release this month.

Consider the following, she writes, you're an average person, you're not famous, and you don't actively seek publicity. You meet a friend at an intimate public setting. You implicitly consent that other people at the gathering have permission to know your identity. However, while there, you do something embarrassing, and someone you don't know takes your photo and posts it on social media without your consent.

The person posting the image has a large following but doesn't receive any commercial gain from the post or social media. You become the subject of a viral meme and there are over five million views of your image. You're now the target of jokes and known as 'that' person in your community.

The post causes you severe mental anguish, stress and embarrassment. But does the law currently provide an adequate remedy?

Put simply, the answer is no, says Chamberlain, whose research advocates for a misappropriation of likeness or personality tort to fill a space that New Zealand's Privacy Act 2020 doesn't cover.

If an image is used in trade and for commercial gain, there are some existing legal protections, however, this is not the case for a person who finds themselves in a situation such as the above, says Chamberlain.

"It is time to adopt privacy protection for the unauthorised use of an individual's image if its use would be highly offensive, regardless of whether that image is used for commercial gain or in trade," says Chamberlain.

During the development of the Privacy Act 2020, she says several opportunities were missed in terms of upping fines and allowing legal avenues for personal information to be deleted.

In 2019, soon after the Christchurch terror attack was live streamed on Facebook, the privacy commissioner at the time requested the ability to fine an individual up to $100,000 and a company up to $1 million for those who ignore breach notices of the 2020 Act. Unfortunately, says Chamberlain, the government denied that request, leading to a cap of merely $10,000 in the 2020 Act.

Meanwhile, unlike the European Union's General Data Protection Regulation 2018 (GDPR), which is the international benchmark in consumer data protection, New Zealand's Privacy Act doesn't allow for the erasure of personal information, which is referred to as 'the right to be forgotten' in the United Kingdom, 'the right to oblivion' in France and 'practical obscurity' in the United States.

The Privacy Act 2020 falls short of the privacy and enforcement protections provided by the GDPR despite New Zealand lawmakers having the benefit of the GDPR prior to the 2020 Act's assent, says Chamberlain.

Former privacy commissioner, John Edwards, lobbied for the right to be forgotten to be included in legislation. Although he wasn't successful, Chamberlain says there is always the potential for the common law to step in should the appropriate case present.

"To have a statutory right to have information removed from certain places or de-linked is important," she says.

"We live in a society where, depending on the crime committed, we have the Clean Slate scheme, where after a period, the offence comes off your record, so it doesn't impair you. Why is it that we have information that can live in perpetuity online and come back to haunt you?"

There is the option of asking the likes of Google to take something down, but should we allow or rely on big tech's self-regulation? asks Chamberlain.

"We need some bottom-line rights and laws in place."

New Zealand also has the Harmful Digital Communications Act (HDCA) and the Harassment Act, but they're both very specific acts with very specific purposes.

"The Harassment Act can be used to issue a take-down order if someone's being bullied or the HDCA in the case of revenge porn, however, you cannot obtain civil compensation under either act."

At present, the gaps left by The Privacy Act 2020, the HDCA and the Harassment Act will need to be filled by using and adopting common law privacy torts (judge-made law), says Chamberlain.

"Social media has created so many privacy issues that weren't there before and the common law will need to step in, as it has done in the past when rapid technological changes outpace statutory legal protections."