For many business owners theft can be a very real and costly threat. The use of closed circuit television and security cameras (CCTV) are an indispensable security tool for businesses deterring and catching thieves. When deciding whether to install and use CCTV it is essential that your business be aware of the legal responsibilities under the Privacy Act 1993 (Act).
The use of security footage has made headlines in recent months. For example, a picture was taken from security camera footage in a clothing shop and posted on a social media site. The individuals in the picture were easily identifiable and it was paired with a description accusing the group of theft. Despite some of the individuals pictured being charged and convicted of theft, one individual was innocent and subsequently defamed. The business posting the picture were later ordered to pay damages to the innocent party for privacy interference, resulting from the businesses failure to comply with the privacy principles under the Act.
The Act contains 12 privacy principles (Principles). The key principles in this situation are as follows:
Collection: Principles 1 and 2 of the Act requires that personal information may only be collected for a lawful purpose.
Use: Principle 10 specifies that CCTV must only be used by the business for the lawful purpose, or for any other purpose authorised by the individual.
Disclosure: Principle 11 requires that a business that holds personal information shall not disclose the information to any other person, business, or body unless that disclosure is within the purposes for which it was collected, or the disclosure is to the individual concerned, unless it is publically available information.
In order to comply with these Principles in relation to CCTV, we suggest you consider displaying signage which is visible prior to individuals entering the filmed area. This signage should make it clear that CCTV is operating, the reasons why it is operating, and the proposed use of the information collected.
We also suggest that you need to have a good understanding of the following points prior to installation of the CCTV:
- The purpose of collecting personal information via CCTV;
- How you intend to use CCTV images;
- Whether you intend to disclose CCTV images or information to others (such as the police or social media);
- How long the images are likely to be kept for;
- How you will securely store the images, and minimise risk of unauthorised access; and
- How you will enable the images to be accessed by the individual concerned.
The Privacy Commissioner has released a CCTV guide which can be found on the Privacy Commissioner’s website (www.privacy.org.nz). The guide provides further practical information for businesses using CCTV.
Failure to understand and comply with the Privacy Act could result in your busis facing expensive fines or other legal action. Getting it right at the outset can save your business spending large amounts of time and money in dealing with or remedying potential breaches in future.
Chris Steenstra is an Associate in the Commercial Corporate team at Norris Ward McKinnon, specialising in IT and Commercial Corporate law. Email Chris at: [email protected]