The Sensible Sentencing Trust has been labelled "negligent and cavalier" - after wrongly posting an innocent man's photo next to the details of a convicted paedophile on its website.
The trust's online offender database posted the man's picture with the description of a convicted paedophile with a similar name for almost two years.
It led to social media abuse and fears the man's tarnished reputation would damage his business.
The two men had the same first and last names, but different middle names.
Privacy Commissioner John Edwards told Mike Yardley this breach was unacceptable.
"It's hard to imagine a worse slur that you could put on someone than that they are a convicted paedophile, and to have that information sitting there for two years affecting this man's business and social interactions is just appalling."
The man's photo was viewed 516 times over the two year period it was on the website.
Edwards said people also shared his name across social media, which lead to harassment and abuse.
"People took the information from the Sensible Sentencing Trust and posted it on other Facebook pages and posted it to schools and the like, so the harm was compounded."
"This man only found out about it when one of his customers said he didn't want to do business with him anymore and drew his attention to it."
He said the Trust had done nothing to verify the picture was of the right person.
"When he came to us, we looked into it and we asked Sensible Sentencing what steps they had taken to check that the photograph was of the man convicted of the offences and they could not tell us anything. So they had done nothing to check whether they had got the right guy.,"
"This just really illustrates the risks of these vigilante community based criminal justice groups."
Edwards said this case is particularly serious because the Sensible Sentencing Trust has done something similar in the past.
"This is just evidence of the cavalier approach they have taken to accuracy."
"I may not have taken the step of publicly identifying the Trust had they not already had a complaint before my office in 2014 with similar issues involved. "
"As part of that settlement, they had undertaken to ensure people involved had training, now only one person got training under the Privacy Act and then they left the organisation and there is simply no excuse for that."
"We offer free training from our website, online courses...we try to make it easy for people to comply and there is simply no excuse."
The man is currently going through the process to get compensation.
In response to the investigation, the Sensible Sentencing Trust acknowledged the mistake and deactivated its database.
The trust also called some of the man's clients, published a notice in a local school's newsletter, and offered to hold a public meeting to correct the mistake.
The Privacy Commissioner will now refer the man's complaint to the Director of Human Rights Proceedings after he and the Sensible Sentencing Trust were unable to reach a settlement.
"The man made a reasonable request for financial compensation to settle this complaint," Edwards' notes read. "The Sensible Sentencing Trust said it was unable to meet the proposed figure and offered a significantly lower amount."
In a settlement with the director for another privacy case in 2014, the trust had agreed to provide relevant personnel with privacy training.
The Privacy Commissioner said in today's statement his office understands the Sensible Sentencing Trust provided one person with training, but they left the trust shortly after.
"It's very disappointing that – having previously been found in breach and agreeing as part of a settlement to improve its compliance – the Sensible Sentencing Trust has failed to meet its obligations, at the cost of an innocent man's reputation and peace of mind," Edwards said.
An innocent man was implicated for a terrible crime, his reputation tarnished and potentially put at risk of violence, Edwards wrote in his notes.
"The magnitude of the error raises concerns of other errors in the database, and whether the Sensible Sentencing Trust has the capability to operate it."