Images of individuals in photographs or film are treated as personal information under the Privacy Act where the person's identity is clear or can reasonably be worked out from that image. If you are an organisation covered by the Privacy Act, consent is not required to collect photographs of identifiable individuals unless the picture records sensitive information about the individual. However, you must take reasonable steps to tell the individual who you are, what you are taking their picture for, and how they can get access to it later.

Generally speaking, individuals are sensitive to their pictures being published, particularly on the web, and so it is good practice to seek their express consent after telling them, in as much detail as possible, about what their picture will be used for and who will be able to see it.

The Privacy Act protects the personal information of both adults and children alike. Organisations are strongly encouraged to use particular care in the handling the images and other personal information of children. Depending on the age and ability of the child to understand your explanation about what is going to happen with their picture and to make a truly informed choice, you should discuss these things with their parent or guardian first. You should also be aware of and meet the requirements of any other legislation that protects children.

If you then use the picture for something that you didn't tell the individual about, you will probably need the individual's consent, unless they would reasonably expect you to use their photo for this other purpose.

It is also important to note that media organisations that are publicly committed to a published privacy standard are exempt from the Act for their journalistic activity. More detail about this exemption is contained in Information Sheet 12-2001.