Video recording and CCTV have become ubiquitious in private and public settings. Ninety nine percent of the time video cameras are installed for security or safety reasons – to catch or deter someone from committing offences. It might be protecting retail premises from ram raid or homes from burglars. And there is a growing trend towards installing dash cameras in cars, bikes and motobikes or on the helmets of riders. Body worn cameras are also becoming increasingly visible in retail environments.
Inevitably these cameras will collect information about people, some behaving badly, some simply going about their lawful business. While cost is no longer a significant barrier to installing a CCTV camera or two, the responsibility for managing the footage in accordance with the Privacy Act remains the same. Additionally, cameras are now increasingly available with audio capability or artificial intelligence (AI) features such as facial recognition or automatic number plate recognition, which bring additional privacy risks and obligations. Carrying out a PIA on a new system is a sensible approach to identifying and managing privacy risk.
If you are currently using CCTV, or thinking about installing a new system or enhancing an existing system, we commend the advice published by the Privacy Commissioner. It’s comprehensive and very useful.
Leaving aside the rationale and the way in which CCTV is installed we encourage you to think carefully about the ongoing responsibility of managing your system. For example:
- Storage of digital records is affordable and it’s easy to default to undefined periods of hanging on to footage. Shorter periods of retaining footage make the information easier to manage. The obligation to provide access to information under the Privacy Act only applies to information that you hold.
- The Privacy Commissioner has set his expectation that if you are installing or upgrading a CCTV system you should choose one which supports your obligation to provide access to footage under IPP6, for example by allowing you to easily redact or blur footage to avoid releasing information about third parties.
- Don’t forget your obligation to advise that you have CCTV operating, including if it has audio or AI features. Being secretive about using these tools might be justified for investigating crime but rarely for general safety, security and deterence. Besides, deterence is enhanced by letting people know that their behaviour is likely to be observed and recorded.
- You acquire video images for security purposes not for general entertainment. It’s unwise and potentially unlawful to share security/safety video footage for entertainment or to ridicule someone (for example, via social media). If the captured event involves a criminal offence bring it directly to the notice of the appropriate authority.
- Keep in mind the likelihood of increased regulation of biometrics in the near future – this will likely make the use of technologies such as facial recognition subject to increased compliance obligations that might influence your decision to use them.