UK watchdog says don’t post photos of shoplifters, due to privacy rules

The UK’s data watchdog has a message for furious shopkeepers: don’t plaster thief mugshots in your window.

If you’re a shopkeeper in Britain dealing with a tidal wave of theft, here’s the latest advice from the UK’s data watchdog: don’t put up photos of suspected shoplifters because it might violate data protection rules.

According to the Information Commissioner’s Office (ICO), sticking a “do not serve” mugshot in your window or plastering it on a lamppost may not be appropriate.

The regulator instead suggests that retailers should keep those images to themselves, share them only with the police, or perhaps pass them quietly to another shop’s manager.

The ICO’s position is rooted in GDPR logic: “You must only share personal information that’s proportionate and necessary to achieve your purpose.”

In other words, just because someone on a shop’s security camera is caught stuffing a vodka bottle down their hoodie doesn’t mean the shop owner can show their faces publicly.

Critics say the advice is absurd. Robert Jenrick, the shadow justice secretary, told The Telegraph that the situation is “data protection gone mad” and argued that “shoplifters should be named and publicly shamed.”

​​The situation also angers shopkeepers, as theft is spiraling out of control. Official statistics show that shoplifting in Britain has jumped 20% in a year – that’s nearly three thefts every minute. The British Retail Consortium says businesses lose £1.8 billion a year to theft, plus £700 million in extra security costs.

However, the ICO insists its advice isn’t about letting crime slide. It says targeted data sharing with the police or relevant parties can help fight shoplifting without “unjustified intrusion” into the lives of innocent people.

Privacy watchdog could have a point

Cybersecurity expert Dr. Kolochenko says the ICO might actually be doing the right thing.

“While the growing anger of shop owners is perfectly understandable, the intervention of the ICO is reasonable and very timely to protect both shop owners and innocent people,” he told Cybernews.

He points out that misidentifying someone as a thief can destroy lives. “People who are wrongly identified as shoplifters may suffer irreparable reputational damage if publicly named and shamed,” he said, adding that there are known cases where a real shoplifter looked like someone local who was then falsely accused and even arrested.And shopkeepers themselves can land in serious legal trouble.

“Some shop owners indeed go too far by either making overboard or extreme accusations, exposing themselves to civil and even criminal liability, in addition to possible violation of the UK GDPR,” Kolochenko warns.

Publishing hard evidence to stop a crime can be justified, but it must be done without “emotions and uncorroborated accusations” and ideally with a solicitor’s advice. Even if you do go public, it might not do much good.

“Most criminals will unlikely change their conduct, sometimes simply having no alternative to put some food on the table but to commit crimes,” he says. Worse still, shaming a thief might invite retaliation from damaged property to physical aggression.