Privacy Commissioner of New Zealand releases the guidelines on privacy and CCTV

June 12, 2022 |

The use of closed circuit television has been a matter of concern in for privacy commissioners in Europe and the UK for some time.  Now the Privacy Commissioner in New Zealand has provided guidance on the use of the CCTV, responding to the concerns about the use of surveillance cameras.  Unfortunately in Australia at the Federal level the Information Commissioner has showed scant interest with one short page saying pretty much nothing about the issues.  That is a pity.   The potential of privacy intrusion through the misuse of cctv technology is significant. 

The media release provides:

From our experience, putting up a CCTV or surveillance camera can get a strong reaction from the public.

Our Privacy Concerns and Sharing Data 2020 survey found 41 percent of people over 18 years old were concerned about the use of surveillance cameras.

Because CCTV captures images of people, which can be used, stored, manipulated, and disseminated, those who operate the systems need to be aware of how to manage privacy issues.

Good management of personal information is essential to the effective running of CCTV systems. Businesses can only take advantage of the full benefits available from CCTV technology if they manage their system with privacy in mind.

All organisations considering using CCTV need to be mindful of their obligations under the Privacy Act 2020. Organisations must only collect personal information if it is for a lawful purpose connected with their functions or activities, and the information is necessary for that purpose. 

We always recommend that agencies minimise the amount of personal information they collect. Any information that is collected should also be securely disposed of once it’s no longer needed for the organisation’s purpose.

The guidelines provides, with significant hyperlinking:

1. Guidelines for businesses, agencies and organisations using CCTV

Privacy and CCTV: A guide to the Privacy Act for businesses, agencies and organisations provides guidance for ensuring CCTV systems meet legal obligations and are run with good personal information handling practice.

Content includes simple practical help for setting-up and operating CCTV, ways to protect people’s privacy such as by using privacy-enhancing technology, and guidance on complying with legal obligations under the Privacy Act.

The guidance applies to the public and private sectors, covering organisations of all sizes.

View a copy of the full guidelines or a copy of the shorter guidelines summary. Please note that while much of the information in these guidelines remains relevant, they were drafted before the Privacy Act 2020 so will not cover recent amendments.

We also have a handy pointers for security cameras and drones guidance leaflet.

2. Conducting a Privacy Impact Assessment

Any organisation considering the use of CCTV should conduct a Privacy Impact Assessment (PIA) before using the technology. Some key considerations in the PIA should be whether the collection of personal information using CCTV is necessary for the organisation’s business activities, and whether it would intrude unreasonably into people’s personal affairs.

If the PIA concludes that the proposal should proceed, it should identify necessary mitigations to address privacy concerns. We would expect safeguards to include robust operational procedures, training and auditing to prevent unauthorised access to or misuse of personal information.

If CCTV is adopted, we would expect the information in the PIA to be translated into a clear policy that sets out its use of CCTV including:

    • the purpose of collecting information by CCTV
    • whether the cameras need to record visuals as well as audio
    • what it will be used for
    • how people will be made aware that cameras are in use
    • who can access the cameras
    • how long the information will be kept for
    • how the information will be kept secure and who can access it.

3. Using CCTV in public spaces

Organisations using CCTV in public spaces must only collect personal information if it is for a lawful purpose connected with their functions or activities, and the information is necessary for that purpose.

Getting things right at the start should avoid encountering privacy issues down the track. Before proceeding with a proposal to use CCTV, agencies should undertake a thorough Privacy Impact Assessment. This should include consideration of:

    • what will be filmed
    • whether that information is necessary for the agency to carry out its work
    • how the agency will inform the public that they are being recorded
    • how the recorded footage will be kept safe and secure – including controlling who has access

We would also encourage engagement with the local community to understand any privacy concerns they may have.

Our CCTV guidelines listed above help organisations work through the process from considering implementing CCTV right through to ensuring that they are regularly evaluating its use.

If individuals are concerned about the use of CCTV in public areas, they can contact our Office.

Quick question: Can I take photos or make recordings of people in public places? 
Generally, taking photos or recordings in public places is allowed, but there are limits in some cases. The role of the Privacy Act will generally depend on who is taking the photo or making the recording – whether they are an agency or an individual. Further information is available here.

4. Using CCTV at home

People should avoid using CCTV in ways that other people may feel intrudes on their privacy.

But while it might not be polite or neighbourly to film across a fence, the actions of a neighbour acting in their personal capacity will generally not be covered by the Privacy Act.

This is because the Privacy Act does not apply to what someone does in their personal capacity except in a narrow set of circumstances where the collection, use and disclosure would be highly offensive to a reasonable person. 

Highly offensive is a high threshold. CCTV capturing highly sensitive and intimate images may be highly offensive, but it would generally be unlikely home security cameras could capture this from their neighbour’s house. We would not consider images highly offensive if it could be seen from the street.

But while there is no complaint or remedy process for the use of CCTV in private homes under the Privacy Acy, other laws may apply in this context.

For example, highly sensitive images could also be subject to the Crimes Act so we would recommend going to the Police first. The Crimes Act includes provisions prohibiting the intimate recording of people without their consent or knowledge and prohibits publication of such recordings so it is best to first raise any concern with the Police.

For example, if you are sunbathing semi-naked in your own back yard surrounded by a three-metre-high fence, you would likely have an expectation that you won’t be spied on. See section 216G to 216J of Crimes Act 1961.

It is also against the law to peer into people’s homes and record any activity within. See section 30 of the Summary Offences Act 1981.

Our tips for people using cameras at home:

    • Talk to your neighbours before setting up a camera.
    • Put up signs telling people that cameras are in place.
    • Show your neighbours footage of themselves if they ask for it.
    • Consider other security measures, such as lights and alarms.
    • Think before uploading footage to the internet.
    • Give your footage to Police if you suspect an offence has taken place.
    • Don’t be creepy. Don’t record activities that would otherwise be private.
    • Don’t point a security camera directly at a neighbour’s property, doors or windows.
    • Don’t hold onto camera footage for longer than necessary.
    • Don’t share footage of your neighbours on their property.
    • Don’t over-record by recording all the time or from every angle.

Can a neighbouring business film me?

If you are concerned about the surveillance practices of an agency such as a business, they will have obligations under collection principles 1, 3, and 4 of the Privacy Act.

Under principle 1, an agency must not collect your personal information unless your information is collected for a lawful purpose connected with a function or activity of the agency, and if the collection of the information is necessary for that purpose.

Often an agency will collect information via surveillance cameras to keep its premises safe and secure. If your neighbouring agency is collecting information as a security precaution, this will likely be a proper purpose as required under principle 1.

Principle 3 requires an agency to be open about why they are collecting personal information and what they will do with it. When an agency collects personal information, it must take reasonable steps to make sure that the person knows why it’s being collected and who will receive it. If an agency has erected a surveillance camera, we generally recommend the agency have signage to alert passers-by about the camera and to advise them who operates it.

Ideally, an agency should have a full privacy notice available on its website and/or in hardcopy at its reception desk. Staff should also usually be aware of the cameras and be able to field any questions about their use.

Does this mean an agency can use surveillance and get off “scot free”?

No. Though we can rarely investigate surveillance cameras, there are circumstances where an agency’s conduct will reach a level where they are breaching the privacy principles and where their actions may attract an award of damages in the courts. This is not something we can assess but it is certainly something an agency should keep in mind.

For instance, in Armfield v Naughton there was a tense and confrontational relationship between an owner of a bed and breakfast and his neighbours. The owner set up eight surveillance cameras, three cameras which pointed towards his neighbour’s property, including a children’s play area. The owner refused to talk to his neighbour about the cameras and to respond to letters from the neighbour’s lawyer asking him to change the angle of the cameras. In that case, the Human Rights Review Tribunal found a breach of principles 3 and 6 and awarded the owner’s neighbour damages.

In this case note, a pub installed cameras for the purpose of keeping the premises safe and secure. But it had placed a camera in a men’s toilet area which overlooked urinals. We did not consider the pub had a proper basis for collecting this information and we considered this to be an unfair collection under principle 4. Even with signage in the area, we considered this was highly sensitive information collected in an unreasonably intrusive manner.

5. Airbnb and other home rental business

The Privacy Act is geared toward regulating organisations, this means it applies to Airbnb and other home rental business.

Owners must ensure they are complying with the Act when collecting and managing guests’ personal information such as their image and conversation. Detailed information on the Act and its principles outlining the use of people’s personal information are available here.

A key point is that businesses must only collect personal information if it is for a lawful purpose connected with their functions or activities and the information is necessary for that purpose.

This means owners must ensure guests are aware of any camera recordings, such as by putting up clear signage, and that recordings are only being made for a legal purpose. This includes ensuring people aware of whether the cameras are recording video, audio or both.

Agencies should minimise the amount of personal information they collected. For example, security camera systems should not record audio if visuals are sufficient because of the increased privacy intrusiveness.

Recordings should be securely disposed of once no longer needed.

6. Recording Audio

Generally, CCTV systems should not record audio.

We always recommend that agencies take a data minimisation approach. Collecting audio significantly increases privacy intrusiveness. If recording of audio is not necessary but the system comes with audio capability, it would be highly advisable to disable the audio capability.

Public authorities should consult their privacy officers and legal teams.

Remember, organisations using CCTV must ensure people are aware that cameras are operating such as through signage. If they are recording audio, this should be made clear.

The signs or other information should also make clear who owns and operates the CCTV system, and the contact details of that agency if this information is not already obvious.

7. Biometrics and Facial Recognition Technology

Facial Recognition Technology relates to the automated recognition of people based on biological or behavioural characteristics. An example could be shop owners using special security cameras to automatically scan groups of shoppers and identify known shoplifters by their face. Perhaps it could be used by an airport to scan the faces of passengers and record their identities against passport and ticketing information before they board a plane.

Biometric information is personal information and is regulated by the Privacy Act. It is particularly sensitive and requires careful assessment before use.

The increasing role of biometric technologies in the lives of New Zealanders has led to calls for greater regulation of biometrics. Other countries are also considering how best to regulate the technology, and some have enacted specific regulatory frameworks for biometrics.

A position paper explaining how the Privacy Act regulates biometrics in detail is available here. It is intended to inform decision-making about biometrics by all agencies covered by the Privacy Act, in both the public and private sectors.

8. Responding to access requests for CCTV footage

In Aotearoa New Zealand, if someone asks for their personal information, organisations need to be able to respond to the request.

This is set out in principle 6 of the Privacy Act which says people have the basic right to access information that is about themselves.

This right extends to CCTV recordings. It follows that businesses and organisations that use CCTV, or are considering such use, will need to have ways they can give people the information they ask for.

Giving people raw CCTV footage of themselves will in many cases not present a problem. For instance, CCTV used in a supermarket or other types of public places is less sensitive than video taken in a gym, swimming pool, hospital or prison. The more sensitive the setting, the higher the privacy risk.

There will be times when you will need to protect the identity of others who have been captured on CCTV. The solution you choose for masking identity may depend on the nature of the setting which the CCTV is being used in.

Visit our Responding to access requests for CCTV footage page for further information.

9. Privacy and Drones

The threat drones pose to privacy is similar to any camera, including mobile phones or automated CCTV systems. Our CCTV guidelines listed earlier on this page apply to how someone might use drones fitted with cameras and comply with the Privacy Act.

The main points for any camera operator to observe are:

    • being clear about why you are collecting the information
    • making sure people know you are collecting the information
    • how you intend to use the information
    • keeping the information safe and making sure only authorised people can see it
    • disposing of the information after it has served its purpose
    • right of access to the information by the individual or individuals concerned

Visit our privacy and drones page for further information or view our handy pointers for security cameras and drones guidance brochure.

10. Privacy and dash cams

Dashboard cameras capture images of travel and vehicles in public places. They do not usually capture clear images of other drivers by which they can be readily identified. But with a dash cam you are going to be collecting a lot of background footage. This background footage is likely to be made up in part of some personal information.

The Privacy Act is all about the collection, use, storage and disclosure of personal information. Personal information is defined in the Act as information about an “identifiable individual”.

Our advice to people wanting to upload video taken by dash cam (and this also applies to CCTV and drone footage) is to consider carefully why you might need to do this. If there is a compelling reason, you also need to think about how to edit out or mask the number plates of other cars, or images of passers-by.

If you see examples of dangerous or bad driving, uploading the footage to YouTube is not necessarily the best way of drawing attention to it. A more effective option might be to give the footage to Police.

Visit our Privacy and dash cams page for further information.

11. Case notes and further reading

Case Note 209484 [2010] NZ PrivCmr 15: Police disclose recognisable image of crime victim to media

A man (‘the victim’) worked at the front counter of a finance company which was robbed at gunpoint. Police released CCTV images from the finance company to public media in the hope of identifying the offender. However, the victim was clearly visible in one of the photographs.

Case Note 244873 [2013] NZ PrivCmr 5 : Man objects to CCTV camera in the men’s public toilets of a pub

A man was concerned that he had been filmed in the men’s toilets of a pub by a fixed CCTV camera. He was initially unaware of the camera’s presence but had later seen copies of the pictures taken while he was using the bathroom.

Case note 308105 [2020] NZPrivCmr 5: Charity shop failed to notify CCTV cameras recorded audio

A charity shop volunteer complained to our office after discovering CCTV cameras in the shop they worked at was recording audio without the knowledge of customers or other staff.

Case note 300099 [2019] NZPrivCmr 12: Restaurant withheld CCTV recording from family

A fast-food restaurant declined to hand over video footage to three customers who said they were harassed by a restaurant employee. The trio, who were members of one family, complained to our office.

Case note 277412 [2016] NZ PrivCmr 13: Corrections failed to comply with access request from inmate seriously assaulted in prison

The Privacy Commissioner’s final opinion was that Corrections had interfered with the complainant’s privacy by not providing him with footage related to an assault he suffered in prison.

Blog post: Lessons on CCTV use from the Human Rights Review Tribunal

A Human Rights Review Tribunal case attracted some attention as a result of its colourful facts – bad feelings between previously friendly neighbours, allegations about vandalism, and a compensation bill of $7000.

Case note 289943 [2018] NZPriv Cmr 5: NZ Post employee complains about audio recordings made on delivery vehicles

An NZ Post delivery agent complained to us that audio recordings were being made by cameras installed on “Paxster” electric delivery vehicles without his knowledge.



Leave a Reply

Verified by MonsterInsights