ARTICLE
15 January 2025

What are My Privacy Obligations Regarding CCTV in New Zealand?

L
LegalVision

Contributor

LegalVision, a commercial law firm founded in 2012, combines legal expertise, technology, and operational skills to revolutionize legal services in Australia, New Zealand, and the UK. Beginning as an online legal documents business, LegalVision transitioned to an incorporated legal practice in 2014, and in 2019 introduced a membership model offering unlimited access to lawyers. Expanding internationally in 2021 and 2022, LegalVision aims to provide cost-effective, quality legal services to businesses globally.
Develop a clear CCTV plan including an evaluation of its purpose, a business strategy, and a policy for staff.
New Zealand Privacy

In Short

  • CCTV footage is considered personal information, so businesses must comply with NZ privacy laws regarding its collection, use, and storage.
  • Use CCTV for clear purposes, display signage, store footage securely, and only retain it for as long as necessary.
  • Non-compliance can result in investigations, compliance notices, or fines.

Tips for Businesses

Develop a clear CCTV plan including an evaluation of its purpose, a business strategy, and a policy for staff. Display clear signage, limit recording hours, and ensure only authorised staff access footage. Include CCTV usage in your privacy policy and seek legal advice if you're unsure about compliance.

CCTV can be a useful tool for protecting your physical business premises and can aid in discouraging illegal behaviour and preventing theft. However, if you want to install CCTV at your business, there are privacy laws that your business must follow. You need to be aware of your obligations under the law, and ensure that you comply with them. If not, your business could face significant legal repercussions. This article will explain:

  • what kinds of CCTV privacy laws apply to;
  • your obligations under privacy law;
  • the penalties for non-compliance; and
  • how you can use CCTV appropriately.

What Does CCTV Mean?

CCTV stands for "Closed-Circuit Television", which refers to video cameras that record video surveillance, which you can then view on other devices. Some kinds of CCTV only stream video that you cannot play back, while others record video that you can replay as needed. You may decide you want to set up CCTV at your business for a variety of reasons, including to:

  • monitor staff and customers;
  • surveil and gather information if a crime were to occur; or
  • act as a deterrent for crime.

In New Zealand, you must comply with your privacy obligations if you install CCTV cameras in the workplace.

It is important to note that these rules apply to non-covert CCTV in public or semi-public places.

If you want to use hidden CCTV, or use it in your home rather than your business, there may be different legal requirements that apply.

Your Privacy Obligations

If your business collects personal information, it is an "agency" and is liable under privacy law. Personal information is anything that can identify a person, which can range from your customers' full names to their physical addresses. Video footage of people recorded by your CCTV cameras falls under that definition.

As such, there are rules you need to follow that govern how you:

Term Description
Collect Information You need to have a clear purpose for collecting this information. Here, you need to let people know about this purpose and the fact that you are collecting this information directly from them. You can only gather what personal data is necessary for your purpose. Do not collect this personal information in an intrusive or unlawful way.
Store Information You have to make sure that you have a safe method for storing personal data. Further, check that this personal data is accurate and do not store it for longer than necessary.
Use Information You can only use the personal data you collect for its original intended purpose. For instance, you likely would not be able to use video footage you recorded for health and safety purposes in an employee disciplinary process.
Disclose Information You generally cannot share the personal information you have collected with others unless that was the purpose you collected that information for. For example, if you recorded footage to establish evidence of theft occurring, you could give this information to the police.

Penalties for Non-Compliance

If someone thinks that your business has breached their privacy or that you have been recording them without complying with your privacy obligations, then they can make a complaint to the Privacy Commissioner. This would launch an investigation into your business, and how you manage your CCTV.

Depending on the severity of the breach and how cooperative you are, penalties can range from compliance notices to hefty fines.

Develop a CCTV Plan

To ensure that you best comply with your privacy obligations as a business, you should draw up three documents surrounding your CCTV. These are:

  1. an evaluation of why you need CCTV, and what your CCTV system will look like;
  2. a business plan that outlines your CCTV strategy; and
  3. a CCTV policy that details how you will operate your system and provide rules for staff using it.

Once you have drafted these documents, you will have a clear system for CCTV usage in your workplace, which can be useful to refer back to if there are privacy concerns. Be sure to get expert advice if there is anything you are unsure about, and update these documents as you need.

Some other things to keep in mind regarding CCTV:

  • only record during necessary hours of operation;
  • have clear signage alerting customers and employees that CCTV cameras are operating;
  • use the cameras for legitimate business purposes, like health and safety maintenance or surveillance. Do not go outside of these purposes, unless you have the permission of the people you are recording;
  • include information about your CCTV operations in your privacy policy on your website, or in a privacy notice at the main desk;
  • only keep the recorded footage for as long as you reasonably need it, delete it once you do not;
  • make sure your usage of CCTV cameras is lawful and not intrusive. For example, you would not put CCTV cameras in changing rooms; and
  • keep a detailed record of who has access to the footage, and ensure that only authorised staff have access to it.

NZ Website Privacy Policy

This Website Privacy Policy states how a business will deal with the personal information of its users.

Download Now

Key Takeaways

If you decide that you need CCTV cameras for your business, make sure that you comply with your privacy obligations when you do so. You could face legal penalties if you do not comply with those obligations.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More