Blogs
CCTV can be a useful tool for protecting your physical business premises and can aid in discouraging illegal behaviour and preventing theft. However, if you want to install CCTV at your business, there are privacy laws surrounding your use of this technology that your business must follow. You need to be aware of your obligations under this law, and ensure that you comply with them. If not, your business could face significant legal repercussions. This article will explain:
- what kinds of CCTV these privacy laws apply to;
- your obligations under privacy law;
- the penalties for non-compliance; and
- how you can use CCTV appropriately.
What Does CCTV Mean?
CCTV stands for “Closed-Circuit Television”, which refers to video cameras that record video surveillance, which you can then view on other devices. Some kinds of CCTV only stream video that you cannot play back, while others record video that you can replay as needed. You may decide you want to set up CCTV at your business for a variety of reasons, including to:
- monitor what your staff and customers in your store are doing;
- surveil and gather information if a crime were to occur; or
- act as a deterrent for crime.
In New Zealand, you can only install CCTV cameras in the workplace if you comply with your privacy obligations. These rules apply to non-covert CCTV in public or semi-public places.
If you want to use hidden CCTV, or use it in your home rather than your business, there may be different legal requirements that apply.
Your Privacy Obligations
If your business deals with personal information, it is an “agency” and is liable under privacy law. Personal information is anything that can identify a person, which can range from your customers’ full names to their physical addresses. Video footage of people recorded by your CCTV cameras falls under that definition.
As such, there are rules you need to follow that govern how you:
Term Description Collect Information You need to have a clear purpose for collecting this information. Here, you need to let people know about this purpose and the fact that you are collecting this information directly from them. You can only gather what personal data is necessary for your purpose. Do not collect this personal information in an intrusive or unlawful way. Store Information You have to make sure that you have a safe method for storing personal data, and that the person involved can access that information and correct it if they wish. Further, check that this personal data is accurate and do not store it for longer than necessary. Use Information You can only use the personal data you collect for its original intended purpose. For instance, you likely would not be able to use video footage you recorded for health and safety purposes in an employee disciplinary process. Disclose Information You generally cannot share the personal information you have collected with others unless that was the purpose you collected that information for. For example, if you recorded footage to establish evidence of theft occurring, you could give this information to the police.
Penalties for Non-Compliance
If someone thinks that your business has breached their privacy or that you have been recording them without heeding your privacy obligations, then they can make a complaint to the Privacy Commission. This would launch an investigation into your business, and how you manage your CCTV. Depending on the severity of the breach, and how co-operative you are, penalties can range from compliance notices to hefty fines.
Develop a CCTV Plan
To ensure that you best comply with your privacy obligations as a business, you should draw up three documents surrounding your CCTV. These are:
- an evaluation of why you need CCTV, and what your CCTV system will look like;
- a business plan that outlines your CCTV strategy; and
- a CCTV policy that details how you will operate your system and provide rules for staff using it.
Once you have drafted these documents, you will have a clear system for CCTV usage in your workplace, which can be useful to refer back to if there are privacy concerns. Be sure to get expert advice if there is anything you are unsure about, and update these documents as you need. Some other things to keep in mind regarding CCTV:
- only record during necessary hours of operation;
- have clear signage alerting customers and employees that CCTV cameras are operating;
- use the cameras for legitimate business purposes, like health and safety maintenance or surveillance. Do not go outside of these purposes, unless you have the permission of the people you are recording;
- include information about your CCTV operations in your privacy policy on your website, or in a privacy notice at the main desk;
- only keep the recorded footage for as long as you reasonably need it, delete it once you do not;
- make sure your usage of CCTV cameras is lawful and not intrusive. For example, you would not put CCTV cameras in changing rooms; and
- ensure that only authorised staff have access to CCTV footage.
Key Takeaways
If you decide that you need CCTV cameras for your business, make sure that you comply with your privacy obligations when you do so. You could face legal penalties if you do not comply with those obligations. If you would like more information or guidance regarding your CCTV and privacy, contact LegalVision’s New Zealand IT lawyers on 0800 447 119 or fill out the form on this page.
FAQs
CCTV stands for “Closed-Circuit Television”. These are security cameras that are used for surveillance, that record video and stream it to another device.
If you have CCTV set up in your workplace, then you should indicate that fact with appropriate signage. This is so that your customers and employees know that you are recording them. If you do not, then you run the risk of breaching your privacy obligations.
The NZ Privacy Act sets out NZ privacy law. It operates on principles about how you should handle privacy, that outline how you should collect, store, and use personal data.
Personal information is information about an identifiable individual. This means that if you can identify someone using this information, such as a full name or a photo, then it is personal information. Privacy law protects this kind of information.
