$7,500 penalty puts social media group admins on notice in landmark Privacy Act ruling
Rules around privacy on social media groups can often be unclear. (Awaaz artwork)
In a first for New Zealand, a social media group has been found liable under the privacy law.
Social media groups and their admins on platforms like Facebook can be sued under New Zealand's privacy law for violating human rights, a court has ruled in a landmark decision this week.
The ruling came along with a $7,500 penalty for the admin of a closed Facebook group, which is now defunct, for having not complied with a personal data request from a Wellington resident.
"We note that this case appears to be the first time a New Zealand tribunal or court has had to determine the liability of a social media group in proceedings under the PA [Privacy Act 2020]," the Human Rights Review Tribunal said in its judgment on April 13, 2026.
The privacy legislation provides a legal framework for protecting people's right to privacy of personal information, including their right to access their personal information wherever reasonable.
In 2021, Adam Sheehan had asked the admin of the group named 'Bad Tenants, New Zealand (Landlords Only)' to tell him what information the group members had on him.
The group was meant for homeowners to share information about their experience with tenants. Basically a forum to share who is good and who is not so good.
Sheehan approached the Privacy Commissioner after the group admin refused to share whether, and what, information did the group and its members hold on him. The case ultimately reached the tribunal after the matter wasn't resolved.
The key question before the judges was whether social media groups are the type of private sector agency that falls under the ambit of the Privacy Act.
"In doing so, we find there is nothing in the [Act] itself to suggest any different approach is required when determining the liability of Facebook groups and other social media group from other agencies," the judges noted.
The whole point of the legislation is to promote and protect individual privacy, the judgment reads, including by giving effect to internationally recognised privacy and human rights standards and obligations.
In arriving at that conclusion, the judges categorized the Facebook group as an unincorporated private sector agency managed out of New Zealand. The kinds on which the Privacy Act applies.
"In this instance, it is evident that Bad Tenants is an unincorporated body that meets the criteria," the judges said.
"Its administrator...is based in New Zealand and its membership comprised exclusively of New Zealand landlords. Its central management and control were therefore in New Zealand."
The court also ruled that the liability of any possible human rights breaches within such a social media group rests "jointly and severally" with its members.
Between 2013 and 2018, Sheehan had been a tenant in several properties in the Wellington and Manawatu regions. He had minor disputes and disagreements with some landlords, he told the tribunal, but he was able to resolve most of them out of court.
He said that on several occasions over this period he experienced difficulties in securing a new tenancy. A rental property that he thought he had secured would become suddenly unavailable to him, the tribunal heard.
Sheehan said this was stressful and led to him experiencing periods of insecure accommodation and homelessness.
"He found it both disturbing and humiliating that his difficulties in securing rental accommodation may have been because his tenancy information was shared among landlords via Bad Tenants," the judgment noted.
Sheehan said his anxiety was exacerbated by the thought of inaccurate information about him being held and read by members of Bad Tenants.
"His anxiety and humiliation was then compounded by [landlord's] refusal to respond to his personal information request and further aggravated by [admin's] failure to engage further, including during the subsequent investigation and issuing of an access direction by the Privacy Commissioner" the judgment reads.
The tribunal ruled that the group admin had interfered with Sheehan's privacy by failing to respond to his request for data in 2021.
It also ordered the admin to pay $7,500 in damages for humiliation and loss of dignity, and provide the data requested by Sheehan within 20 days of the judgment.
