In a first of its kind decision, the Human Rights Tribunal has confirmed that social media groups - and their members - can be liable for damages under the Privacy Act, with liability triggered simply by ignoring a privacy request for provision of personal information.

What happened

In Sheehan v Wilson [2026] NZHRRT 10, the Human Rights Review Tribunal considered whether a Facebook group, Bad Tenants, New Zealand (Landlords Only), was covered by the Privacy Act 2020. The group was a private Facebook community for New Zealand landlords, where members shared information and comments about tenants they considered problematic.

Mr Sheehan, asked the group for access to any personal information it held about him. He sent the request to the named group administrator, Mr Wilson using Facebook Messenger and through the group’s “join” questions. Shortly afterwards, he was blocked from the group and from messaging Mr Wilson. The group did not respond to the request or engage with the Privacy Commissioner or the Tribunal.

The Tribunal confirmed that social media groups can be “agencies” under the Privacy Act, even if they are informal and unincorporated. What mattered was what the group did - it operated from New Zealand and shared personal information as part of its activities.

Because the group was unincorporated, liability could rest jointly and severally with its members. The administrator’s decision to block the requester after receiving the request did not negate receipt; instead, it was treated as sufficient notification to the group and its members. 

Did the social media context exempt liability? 

Being on social media was no excuse. The same privacy rules apply online as they do offline. The Tribunal considered whether an exception in the Privacy Act - which excludes information held by an individual in connection within their personal or domestic life - applied.

The Tribunal said it did not. First and foremost, because the Facebook group in this case was treated as a body of persons, not “an individual”. The Tribunal went on to say that the exception does not apply where information is shared with a wide or undefined audience. The Bad Tenants group existed for landlords to discuss tenants and rental issues, connected to business interests with information was shared among many members. That took the activity well beyond personal or household use, meaning the Privacy Act applied in full.

The Tribunal also noted that even for individuals, the exception may not apply where information is shared widely online - raising questions about how far the exception really extends in private but large social media groups between friends. 

Liability to pay damages 

The Tribunal ordered the Bad Tenants Facebook group to respond to the request and to pay $7,500 in damages for anxiety and distress, plus costs. Importantly, the Tribunal awarded damages without needing to determine whether the group actually held any personal information. It found that ignoring the request alone was enough to cause anxiety and distress. In assessing quantum, the Tribunal treated the case as falling at the lower end of the least serious band of cases (up to $10,000), ultimately awarding $7,500.

The orders were made against Mr Wilson as the representative defendant, even though he was no longer the administrator and did not engage with the process. 

Liability flowed with joint and several exposures for members. This raises real questions about enforcement: while the Tribunal made orders against the representative defendant, the liability extends to members of the group - including those who had no knowledge that Mr Sheehan’s request had been made or that proceedings were underway.

The practical risk is clear. Acting as an administrator, even briefly, can place someone squarely in the firing line. But the exposure does not necessarily stop there. Simply being a member of an informal social media group may carry personal risk, particularly where the group shares personal information and has no legal structure separating individuals from liability.

Lessons from this case 

This latest case from the Tribunal case confirms that liability for Privacy Act requests is widening, particularly in online and informal settings. Ignoring a Privacy Act request can, by itself, lead to damages. 

The Tribunal also reinforced its established approach to damages bands, ranging from up to $10,000 for less serious cases to over $50,000 for the most serious. Even at the lower end, ignoring a Privacy Act request can still squarely expose a group and its members to damages of up to $10,000.

For members of informal or unincorporated groups, personal exposure is a real risk. Where a group has no separate legal identity, liability may sit with the people behind it.

For businesses using social media groups to engage with customers, industries or communities, this case reinforces the need to treat those spaces as an extension of the organisation’s operations, not as informal side channels.

Get in touch

If you would like to discuss what this means for your organisation or online communities, please reach out to one of our experts who will be happy to assist.

Special thanks to Holly Soar for her assistance in writing this article.