Your responsibilities
.
If someone asks for their personal information then organisations need to be able to respond to the request. This is set out in principle 6 of the Privacy Act, which says people have the basic right to access information that is about themselves. This right includes CCTV recordings.
Businesses and organisations that use CCTV, or are considering it, will need to have ways they can give people the information they ask for.
What you can do
Consider each request individually on its own merits.
We regularly receive complaints from individuals who are not able to access their personal information from a business or organisation.
A person may want CCTV footage of themselves for a variety of reasons. Maybe they were involved in an altercation or dispute on the business’s premises, and they believe they can use the footage as evidence. They might want to present that footage as part of a complaint to Police or the courts. However, they do not need to give a reason for requesting the footage.
Businesses or organisations can be reluctant to release to a requester any footage they hold. Their concerns may include:
- The privacy of other individuals in the footage
- The agency will have no control over how the person may use or distribute the footage
- The footage is too difficult to locate or retrieve, or it no longer exists because it has been deleted.
Sometimes these concerns cause agencies to respond to these requests in ways that do not comply with the Privacy Act.
If you get one of these requests, how should you respond?
Every request for CCTV footage is different. In coming to a decision on the request, consider all individual circumstances. What is the nature of the footage? How identifiable are the other individuals in the footage? What are those other people doing? Considering these factors will help you decide what you need to release, and what you can withhold. Think of ways to strike a balance between the requester’s access rights and other individuals’ rights who are in the footage.
Where there are multiple people involved, you do not necessarily need to release the footage in full. For example, it may be appropriate to crop the footage so that only the requester is shown, and the other people are excluded. Or the agency could pixelate the others so they are not identifiable. If the agency is not able to do this in-house, they could contract an external provider to do it.
Options for handling footage
It can be expensive to alter security footage professionally and you may not have the technical know-how to do so. Any such cost may be a factor that is relevant to whether the information can be released and if so in what form - but this should not generally prevent someone from accessing a copy of their own information.
If you have concerns about how the requester may use or distribute the footage, you can ask them if they would be willing to view the footage onsite.
Please note, there are only limited circumstances when an agency can refuse to provide information in the manner requested by the individual.
In some cases, an agency may choose to impose reasonable conditions on how the information will be used. For instance, where there is information about third parties in the footage, you may ask the requester if they are willing to sign a confidentiality agreement.
We do accept there will still be circumstances where none of the above options are feasible, and in such cases, it may be appropriate for the agency to withhold the footage in full. But make sure you are aware of the range of options available to be able to strike a balance between the interests of all the parties concerned.
This may mean having a polite conversation with the requester and any third parties to find out what works for everyone.
Giving people raw CCTV footage of themselves will in many cases not present a problem. For instance, CCTV used in a supermarket or other types of public places is less sensitive than video taken in a gym, swimming pool, hospital or prison. The more sensitive the setting, the higher the privacy risk.
There will be times when you will need to protect the identity of others who have been captured on CCTV. The solution you choose for masking identity may depend on the nature of the setting which the CCTV is being used in.
Blurring footage of other people
Any organisation wanting to use a CCTV system should, as a starting point, do their research and know how they'll be able to blur footage of people other than the requester. For anyone already using CCTV, upgrading an existing system is a good time to add this capability.
Newer CCTV systems will come with built-in options that include facial blurring in their video management system. This capability may not exist with older CCTV systems – and this means organisations will have to consider external options for editing videos for release.
Choose a secure blurring technique
Choose a solution and technique that is secure. It would be self-defeating to upload an image to a third-party provider for editing only to discover later that the images were lost in a privacy breach or were collected for purposes beyond your control or knowledge.
- You will also need a system for deleting the footage (raw or altered) quickly once your legal or practical obligations have been fulfilled. Don’t keep it for any longer than you need it.
- Learn about using techniques that cannot be reversed or re-identified easily. Researchers have shown that facial recognition systems can re-identify blurred faces with increasing accuracy.
Each organisation needs to make its own assessment of cost, convenience and security in responding to CCTV access requests. The method or technique you choose can depend on how easy it is to use and the financial cost to your business or organisation.
What you shouldn't do
You shouldn't have a policy that says CCTV footage will never be released directly to a requester. Be aware that having a blanket policy approach not to release CCTV footage on request is inconsistent with your obligations under the Privacy Act.
Under principle 6 of the Privacy Act, individuals have a right of access to information about themselves held by an agency. This includes CCTV footage of themselves. Agencies cannot have a policy that actively prevents an individual’s ability to exercise their principle 6 rights.
You should not automatically refuse a request because other people are in the footage.
CCTV footage of the requester may include images of other people. But immediately refusing a request to protect the privacy of the others in the footage, while potentially based on good intentions, may be too rigid of an approach.
The Privacy Act does allow agencies to refuse a request or withhold some information from the requester, if releasing the information would involve the unwarranted disclosure of the affairs of another individual.
An individual may be entitled to a copy of CCTV footage they are in even if it includes someone else in the footage. You must undertake a balancing exercise between the rights of the requester and the privacy interests of the other individuals. Withholding the footage from the requester would only be appropriate if the privacy interests of the other individuals in the footage outweigh the privacy interests of the requester.
There will be situations where the privacy interests of other people clearly outweigh the requester’s access rights. For example, this would apply if the requester had a low privacy interest in receiving the information and if the footage of a third party is extremely intimate in nature or highly embarrassing.
- The approach adopted by agencies should be that the requester is entitled to the footage unless the other individuals have a greater privacy interest.
- You cannot ignore or delay responding to a request so that the footage gets deleted or overwritten.
- Most agencies will have limited storage for CCTV footage. They will only hold footage for a certain time before it is deleted or overwritten.
Sometimes an individual will make a request and the agency has already deleted the footage. In this case, you can withhold the information on the basis it no longer exists.
You must not deliberately delete or allow footage to be deleted knowing a request for that information has been made. To do so would almost certainly be an interference with the requester’s privacy - and this is a criminal offence under the Privacy Act.
Further information
We appreciate that responding to requests for CCTV is not always a simple exercise. It's worth noting that when an agency makes information available to an individual in good faith and pursuant to principle 6, an individual will not be able to bring proceedings against the agency for any consequence that follows from making the information available.
If you are really stuck, contact our enquiries team. While we can't provide legal advice or decide for your business or organisation, we can provide general guidance to help you with your decision-making process.
