The Privacy Commissioner has found a firm to be in breach of a child's privacy after the firm used an image taken from the Internet without obtaining consent. A recording of a child was uploaded to the Internet without the child or their parents’ consent. The recording went viral and caused significant mental harm to the child. The parents managed to get the recording removed from most social media but were not able to get all copies taken down.

A commercial organisation found and used a still image from the recording for advertising purposes without consent. This re-traumatised the child as they were recognised and subjected to bullying both online and in person.

The parents managed to get the organisation to cease using the image but were unable to agree on a resolution of their privacy complaint. The Privacy Commissioner that found that the organisation breached privacy principle 11 and interfered with the child's privacy as harm had been caused to the child.

The age of the child was a significant reason why it was not fair or reasonable to use the publicly available image. The firm should have obtained parental consent to use the image of a child in an advert. Just because the image was publicly available on the Internet does not mean that it was able to be used without consent. The age of the child meant that they were vulnerable, and its use had a serious impact on the child. Also, the use of the image in an advertising campaign across the country for financial gain without any attempt to seek consent was relevant in finding the actions to be unfair and unreasonable.

The firm was unaware that the family had taken great steps to remove the recording from the internet, but ignorance was not an excuse in this situation. Following the Privacy Commissioner’s findings the firm reached a settlement with the parents of an undisclosed sum and also apologised for its breach of privacy.