Under the Privacy Act 2020, businesses (known as agencies under the Act) have an obligation to inform people about what type of information they are collecting about them and why. Footage caught on CCTV can be “personal information” and therefore can be protected by the Privacy Act 2020. Agencies who fail to adequately inform people on why, and how, they are collecting personal information on CCTV, may ultimately be deemed to be in breach of the Privacy Act should a complaint to the Privacy Commissioner be made. Agencies must therefore have clearly defined purposes for collecting CCTV information and should only collect it if they need to.
The Act requires that people must know that they are in fact being filmed (and in some cases audio recorded), why they are being filmed and how the business intends to use and store the captured footage. This can be covered with the use of signage. However, CCTV footage cannot be used by a business in a manner that is unlawful, unfair or unreasonably intrusive and this largely depends on the sensitivity of the information being collected, as weighed against the seriousness or significance of why an agency is collecting it.
A person has the right to access to their personal information under Principle 6 of the Privacy Act and this includes CCTV recordings of them. Reasons why the footage is being sought do not need to be provided by the requester. While a business may be reluctant to release footage to a requester (for example stating the reason to withhold is that the privacy of other person(s) will be breached), the business may be in breach of the Privacy Act if a blanket refusal to give the footage is given to a requestor. Businesses must strike a balance between: the requestor’s access rights under the Privacy Act and the rights of the other individuals in the footage.
In 2019, the Privacy Commissioner considered this very scenario. A restaurant was asked to provide CCTV footage but it decided to withhold the footage from the requesting family. An altercation had taken place with the restaurant’s employee. Under Principle 6, the family had the right to access personal information held about them by the restaurant, unless there was a lawful withholding ground contained in the Act and which fell under sections27 to 29 of the Privacy Act. In this case the restaurant told the Privacy Commissioner that the footage was withheld “because it included other people and it would breach their privacy to release it” to the requester. The restaurant sought to rely on section29(1)(a). This section enables agencies to withhold personal information if releasing it would be an “unwarranted disclosure” of the affairs of other individuals. However, in this case the Privacy Commissioner noted that “where the privacy interests of others are involved, those interests must be strong before the agency can rely on section29(1)(a) to withhold CCTV footage. The slight embarrassment of third parties (i.e., restaurant employees or the owners) is not likely to be enough to outweigh the requester’s right of access to the footage. The Commissioner viewed the CCTV footage in question and decided the requester’s right to receive the footage outweighed the right of the employee to have their privacy protected. The Commissioner was not satisfied that giving access to the requester of footage that “incidentally” included other people would involve an unwarranted disclosure of those person’s affairs. The customers were in a public place and the other people in the footage did not have a high privacy interest, thus the restaurant did not have a proper, or legal basis, to withhold the footage. The Privacy Commissioner concluded that the restaurant had indeed interfered with the requester’s privacy by failing to provide the footage when requested. The restaurant was required to immediately release the footage to the requester. The Commissioner noted that a business cannot simply allow the footage to be viewed; where a requester wants a copy of the footage, an agency must take steps to provide it.
Breaches of the Privacy Act can be significant and where there has been an interference with a person’s privacy, complainants can thereafter seek an award of damages in the Human Rights Review Tribunal (HRRT) where they can show “adverse consequences” occurred. The Act provides for three kinds of “harm”: specific damages(financial loss or physical injury), loss of a benefit (actions that affect a person’s rights, benefits or interests), and emotional harm (humiliation, loss of dignity, significant injury to a person’s feelings).
We have seen instances of poor legal advice being provided to agencies that results in agencies actually breaking the privacy laws and causing an interference with a person’s privacy and ultimately a claim for substantial damages in the HRRT. Our team includes former Privacy Commissioner staff who have specific expertise in this very specialised area of law. Gina Jansen Lawyers easily and properly provides our business clients with legal advice and guidance in what is a very grey area of law.
Disclaimer: This article was written by Gina Jansen, Managing Director of Gina Jansen Lawyers Ltd, West Auckland and was reproduced in the West Auckland publication “Window on Swanson” in December 2022. The content of this article is not to be reprinted/republished without the express permission of Gina Jansen Lawyers and is not intended to be relied upon or quoted as legal advice. Please contact Gina Jansen Lawyers, West Auckland for a consultation and legal advice.