The eye-opening tale of the mum treated like a shoplifter has received a lot of internet attention since she posted it yesterday. For those who haven’t read it: woman is grabbed by a Tesco security guard who accuses her of stealing shampoo and won’t listen to her protestations of innocence, then released without apology when the accusation turns out to be complete rubbish.

The guard who marched Not Now Nancy through the store refused to tell her what was going on; his only remark to her was a command to “Keep walking”. It was only when she was taken to a back room that she found out what the problem was: four people, presumably store employees, said that they had seen her on CCTV putting shampoo in her bag.

She emptied her bag on the table as proof that she’d taken nothing, then asked to see the supposedly incriminating CCTV footage. Her request was refused. Why? “Data protection”, apparently.

I’ve written before about how companies use the Data Protection Act to suit themselves, but this takes the Tesco Value biscuit.

What happened to this woman is an object lesson in how not to detain a suspected shoplifter. The employees involved seem to have looked at the correct procedures for people with real law-enforcement powers and then chosen to do the opposite.

  • A suspected shoplifter discovered by a police officer would be asked to accompany them to the station, and only arrested if they refused to cooperate. If they were arrested, they would be told on what grounds. Tesco’s security guard went for the “pouncing and frog-marching without explanation” option.
  • Someone who’d been arrested would have the option of calling a lawyer to be present during the police interview. Tesco went for the “lead her into a back room and make her face four scowling employees alone (except for her frightened children)” option.
  • Finally, someone actually charged with shoplifting would generally be given access to evidence relied on by the prosecution, including CCTV footage. But Tesco’s employees refused to show Not Now Nancy the footage that supposedly proved her crime, and their justification for refusing her this basic courtesy was “data protection”.

I hope I don’t need to clarify that the Data Protection Act does not give kangaroo courts the right to deny accused people the right to see any evidence against them. As far as I’m aware, no legal guidelines exist for the bullying of innocent shoppers by jumped-up jobsworths. This omission may just be because this bullying shouldn’t be happening in the first place.

There are guidelines about how to use CCTV in accordance with the Data Protection Act. This guidance explicitly states that individuals whose images are recorded have the right to view the images of themselves and to receive a copy of the images if they wish it.

In other words, Tesco’s staff cited the Data Protection Act in order to justify a decision which was itself in contravention of the Data Protection Act.

I don’t know the unfortunate shopper, but I hope she won't mind me writing about her experience. It's an extreme example of how “data protection” can be wrongly used by organisations (and individuals) to justify their own bad behaviour.


This woman may well have a claim in the tort of false imprisonment.  Supermarkets should not be able to get away with this kind of shoddy behaviour, and it is only the fact that people are ignorant of the law and rightly nervous about undertaking litigation that causes them to get away with this sort of thing.  She should seek legal advice.

Thanks for the legal perspective, Christi. It's good to hear from a real live lawyer-to-be. I agree she may well have a case.

I would add that sometimes it's not just ignorance of the law that stops us standing up for ourselves in this kind of situation: sometimes it's just shock, combined with the fact that most of us are trained to obey people in official positions. Although her account of the incident is long, my guess is that it was over in minutes. When things happen quickly, sometimes you don't have time to question what's going on, let alone marshall a coherent, assertive response.

I totally agree that now the dust has settled, she should seek legal advice.

kittykat (not verified)

Tue, 2011-08-16 18:47

My dad had his wallet stolen from his office at work (he works in a hospital lab so you'd expect good security). Money was then taken from his account by someone who turned up at the bank and used his old style paper driving licence as ID. My dad asked to see the footage of the person who extracted the money from the account and was told he couldn't due to data protection. The bank repaid him but someone got away with the money and could well have been one of his colleagues who was legitimately able to enter the office. It's not just Tesco where the rules apply

kittycat, the whole point of my post is that if Tesco did apply any "rules", they bear no resemblance whatsoever to the laws of this country. If a police officer had asked for the footage to help them investigate the case, data protection law wouldn't prevent that. In fact, the official guidance says that organisations should ensure the images can be used by law enforcement agencies if necessary.

It's ridiculous that your dad's employer refused to release the footage to solve the crime, but the problem isn't the law itself. It's with organisations using it as a smokescreen for bad behaviour.