Source: Radio New Zealand
Royal Oak Pak’nSave in Auckland. File picture. RNZ / Marika Khabazi
The supermarket where a photo of former MP Golriz Ghahraman was leaked has been formally named and shamed by the Privacy Commissioner.
The store, in Royal Oak in Auckland, is one of two Pak’nSave stores singled out for breaching customer privacy.
Commissioner Michael Webster said it was significant to name Hutchinson Bros Limited, trading as Pak’nSave Royal Oak and C Park Traders Limited, formerly trading as Pak’nSave Clendon, which no longer owns it.
Both supermarkets failed to have adequate oversight of third-party security providers, he said.
Security guards shared images of customers along with allegations of theft or criminal activity.
Webster said it meant two individuals whose images were shared faced a heightened risk of harassment and harm to their reputations.
“Both stores lacked important safeguards that retailers should have in place when allowing third party providers access to sensitive information such as surveillance information,” he said.
“Agencies engaging third-party agents who access or operate surveillance or loss-prevention technologies such as CCTV should ensure that privacy obligations are explicit, enforceable, and routinely monitored to prevent harm. That keeps information safe and maintains public confidence in how personal information is handled.”
Webster said while it was rare for him to name entities, it was a reminder to businesses that outsourcing does not outsource accountability.
The Pak’nSave stores are individually accountable for privacy compliance, the commissioner said.
However, the office has also been working with Foodstuffs North Island for remedial action.
Webster said this included training with store workers including security contractors, and requiring stores to have written agreements.
What happened?
At the Pak’nSave Royal Oak store, a security guard took a photo of someone in October 2024 for surveillance.
It was captured on a personal mobile phone, following store protocol, because of the poor quality of the security camera footage.
Last January it was published online accusing the individual of shoplifting leading to them facing harassment and threats.
FoodStuffs North Island issued a direct apology on behalf of the store.
Former Green MP Golriz Ghahraman was reported to police for shoplifting on 12 October 2024 but there were no charges.
“Any police investigation considers the solicitor-general’s Guidelines for Prosecution, including factors such as evidential sufficiency and a public interest test,” police said after investigating.
“In this case, police have considered the public interest test was not met as well as taking other factors into account.”
Separately, Ghahraman was convicted on four counts of shoplifting in June last year and later failed to have the convictions wiped.
At Pak’nSave Clendon, a store employee instructed a security contractor in January to record CCTV footage of an alleged theft on their personal phone.
The guard then send the footage to the store worker, who put it on social media alongside allegations of theft.
The store became aware of the unauthorised disclosure after it circulated online.
A public figure, the Privacy Commissioner said it resulted in international media attention and reputational and emotional harm.
In this instance the store and Foodstuffs North Island issued an apology to the individual, the Privacy Commissioner said.
Privacy Commissioner’s findings
Pak’nSave in Royal Oak had no written contact with its security provider, the commissioner said.
The lack of enforceable terms meant the store had no way to make the provider comply with privacy obligations.
The commissioner said there was also no clarity around escalating procedures, and no way to compel cooperation in privacy investigations.
At the Clendon supermarket, the commissioner said there was a written contract but it had only a generic confidentiality clause and no enforceable privacy obligations.
He said neither store gave training to security workers to include surveillance information.
Foodstuffs North Island had a policy in place, but neither store clarified and enforced responsibilities for workers handling security footage until after the incidents.
‘Conduct well short of what we expect’ – Foodstuffs
Foodstuffs North Island told RNZ it took its responsibilities under the Privacy Act seriously, and acknowledged the findings.
“The two incidents involved separate and isolated actions taken by third-party security guards,” it said.
“Their behaviour did not meet the standards we set for anyone working in our stores, including contractors.
“The individuals concerned did not follow appropriate processes, and their conduct fell well short of what we expect.”
Foodstuffs told RNZ each supermarket had done additional training for all security team members and contractors who handled personal information.
“We regret there were shortcomings in how our contractors handled the situations.
“Protecting customer privacy is essential, and we are committed to ensuring our systems and oversight remain strong, so this does not occur again,” it said.
Sign up for Ngā Pitopito Kōrero, a daily newsletter curated by our editors and delivered straight to your inbox every weekday.
– Published by EveningReport.nz and AsiaPacificReport.nz, see: MIL OSI in partnership with Radio New Zealand