Source: New Zealand Privacy Commissioner – Blog
Has your business ever received a request from a customer or client for a copy of the CCTV footage taken while they were in your shop? Not sure how to deal with that request? We hope this blog helps. If you’re unsure if you’re an ‘agency’ as defined in the Privacy Act, you can find out here.
The Office of the Privacy Commissioner (OPC) receives a high volume of complaints from individuals who are not able to access their personal information from a business or organisation. A person may want CCTV footage of themselves for a variety of reasons. Maybe they were involved in an altercation or dispute on the business’s premises, and they believe they can use the footage as evidence. They might want to present that footage as part of a complaint to Police or the courts.
In our experience, businesses or organisations are often reluctant to release to a requester any footage they hold. When we speak to these agencies, we often hear the same concerns. They include:
- The privacy of other individuals in the footage
- The agency will have no control over how the person may use or distribute the footage
- The footage is too difficult to locate or retrieve, or it no longer exists because it has been deleted.
Unfortunately, sometimes these concerns cause agencies to respond to these requests in ways that do not comply with the Privacy Act.
If you get one of these requests, how should you respond? We’ve listed the ‘do’s and don’ts’ with reference to the relevant parts of the Privacy Act.
What you can do
You should consider each request individually on its own facts.
Every request for CCTV footage is different. In coming to your decision on the request, you should consider all individual circumstances. What is the nature of the footage? How identifiable are the other individuals in the footage? What are those people doing? Considering these factors will help you decide what you need to release and what you can withhold.
Think of ways to strike a balance between the requester’s access rights and other individuals’ rights who are in the footage.
Where there are multiple people involved, you do not necessarily need to release the footage in full. For example, it may be appropriate to crop the footage so that only the requester is shown, and the other people are excluded. Or the agency could pixelate the others so they are not identifiable. If the agency is not able to do this in-house, they could contract an external provider to do so. We realise it can be expensive to alter security footage professionally and you may not have the technical know-how to do so. Any such cost may be a factor that is relevant to whether the information can be released and if so in what form – but this should not generally prevent someone from accessing a copy of their own information.
If you have concerns about how the requester may use or distribute the footage, you can ask them if they would be willing to view the footage onsite. Please note, there are only limited circumstances under section 42(2) when an agency can refuse to provide information in the manner requested by the individual.
In some cases, an agency may choose to impose reasonable conditions on how the information will be used. For instance, where there is information about third parties in the footage, you may ask the requester if they are willing to sign a confidentiality agreement.
We do accept there will still be circumstances where none of the above options are feasible, and in such cases, it may be appropriate for the agency to withhold the footage in full. But make sure you are aware of the range of options available to be able to strike a balance between the interests of all the parties concerned. This may mean having a polite conversation with the requester and any third parties to find out what works for everyone.
What you should not do
You should not have a policy that says CCTV footage will never be released directly to a requester.
The default position for some agencies is to not release CCTV to individual requesters. They may only be prepared to release CCTV footage to law enforcement agencies, but not to individual requesters. Be aware that having a blanket policy approach like this is inconsistent with your obligations under the Privacy Act.
Under principle 6 of the Privacy Act, individuals have a right of access to information about themselves held by an agency. This includes CCTV footage of themselves. Agencies cannot have a policy that actively prevents an individual’s ability to exercise their principle 6 rights.
You should not automatically refuse a request because other people are in the footage.
CCTV footage of the requester may include images of other people. But immediately refusing a request to protect the privacy of the others in the footage, while potentially based on good intentions, may be too rigid of an approach.
The Privacy Act does allow agencies to refuse a request or withhold some information from the requester, if releasing the information would involve the unwarranted disclosure of the affairs of another individual – see section 29(1)(a).
That said, an individual may be entitled to a copy of CCTV footage they are in even if it includes someone else in the footage. You must undertake a balancing exercise between the rights of the requester and the privacy interests of the other individuals. Withholding the footage from the requester would only be appropriate if the privacy interests of the other individuals in the footage outweigh the privacy interests of the requester.
There will be situations where the privacy interests of other people clearly outweigh the requester’s access rights. For example, this would apply if the requester has a low privacy interest in receiving the information and if the footage of a third party is extremely intimate in nature or highly embarrassing. But the approach adopted by agencies should be that the requester is entitled to the footage unless the other individuals have a greater privacy interest.
You should not ignore or delay responding to a request so that the footage gets deleted or overwritten.
We note that most agencies will have limited storage for CCTV footage. They will only hold footage for a certain time before it is deleted or overwritten.
Sometimes an individual will make a request and the agency has already deleted the footage. In this case, you can withhold the information on the basis it no longer exists under section 29(2)(b).
But tread with caution. You must not deliberately delete or allow footage to be deleted knowing a request for that information has been made. To do so would almost certainly be an interference with the requester’s privacy – and from 1 December 2020, the Privacy Act will make this a criminal offence.
“Help, I’m still confused”
We appreciate that responding to requests for CCTV is not always a simple exercise. Before you make a decision, it is always worth checking out our website, as we have a range of guidance materials, such as case notes, that may be of assistance.
It is worth noting under section 115 when an agency makes information available to an individual in good faith and pursuant to principle 6, an individual will not be able to bring proceedings against the agency for any consequence that follow from making the information available.
If you are really stuck, contact our enquiries team. While we cannot provide legal advice or make a decision for your business or organisation, we can provide general guidance to help you with your decision making process.
Image credit: Needpix
