Skip to main content

Disclaimer: Educational purposes only. Not legal advice. Consult a qualified NZ legal practitioner for your specific circumstances.

SimplifiedLaw.co.nz
general

CCTV cameras: Privacy rules for homes and businesses

Key Takeaway

In New Zealand, CCTV camera use by businesses must comply with the Privacy Act 2020, requiring clear purpose, notification, and secure handling of footage. While personal home use has exemptions, cameras should not excessively intrude on neighbours' privacy. Certain areas, like bathrooms, are generally off-limits. Individuals have rights to access footage of themselves.

CCTV Cameras: Privacy Rules in New Zealand

CCTV (Closed-Circuit Television) cameras are increasingly used for security and monitoring in New Zealand. Their operation is primarily governed by the Privacy Act 2020, which sets out rules for how personal information is collected, stored, used, and disclosed. Other legislation, such as the Crimes Act 1961, also places restrictions on certain types of recordings.

The Privacy Act 2020 and CCTV

The Privacy Act 2020 applies to 'agencies' that collect and hold 'personal information'.

An agency is defined broadly and includes individuals, companies, government departments, and organisations [Source: Privacy Act 2020, s 7].

Personal information is information about an identifiable individual [Source: Privacy Act 2020, s 6]. Footage from CCTV cameras often constitutes personal information if it shows identifiable individuals.

The Act outlines 13 Information Privacy Principles (IPPs) that agencies must follow when dealing with personal information. Key IPPs relevant to CCTV include:

  • IPP 1 (Purpose of Collection): Agencies must collect personal information only if it is for a lawful purpose connected with the agency's functions or activities, and necessary for that purpose [Source: Privacy Act 2020, IPP 1]. For CCTV, this means there must be a clear, legitimate reason for recording, such as security, crime prevention, or health and safety.
  • IPP 3 (Collection from Subject): Where personal information is collected directly from the individual concerned, the agency must take reasonable steps to ensure the individual is aware of certain matters, including the fact that the information is being collected, the purpose of collection, and the intended recipients of the information [Source: Privacy Act 2020, IPP 3]. For CCTV, this typically means displaying clear and prominent signs informing people that cameras are in operation, stating the purpose of the surveillance, and providing contact details for inquiries.
  • IPP 4 (Manner of Collection): Personal information must be collected by lawful means and in a manner that is fair and does not intrude to an unreasonable extent on the personal affairs of the individual concerned [Source: Privacy Act 2020, IPP 4]. This implies that cameras should not be hidden, and generally, should not be placed in areas where there is a high expectation of privacy, such as bathrooms or changing rooms.
  • IPP 5 (Storage and Security): Agencies must ensure that personal information is protected by reasonable security safeguards against loss, unauthorised access, use, modification, or disclosure [Source: Privacy Act 2020, IPP 5]. CCTV footage must be stored securely.
  • IPP 6 (Access): Individuals have the right to request access to personal information an agency holds about them [Source: Privacy Act 2020, IPP 6]. This means individuals can request to view CCTV footage of themselves.
  • IPP 7 (Correction): Individuals can request correction of personal information held about them if they believe it is inaccurate [Source: Privacy Act 2020, IPP 7]. While less common for video footage, it is applicable if the identity or context is misconstrued.
  • IPP 9 (Retention): Personal information should not be kept longer than is required for the purposes for which it may lawfully be used [Source: Privacy Act 2020, IPP 9]. CCTV footage should be retained only for a reasonable period necessary for its stated purpose (e.g., typically a few days to a few weeks for security footage, unless a specific incident requires longer retention).
  • IPP 10 & 11 (Use and Disclosure): Personal information can generally only be used or disclosed for the purpose for which it was collected, or for a directly related purpose [Source: Privacy Act 2020, IPP 10 & 11]. Disclosure to third parties, such as the police, is permitted under specific circumstances (e.g., preventing a serious threat, or if required by law) [Source: Privacy Act 2020, IPP 11(e) & (f)].

CCTV in Homes (Domestic Use)

The Privacy Act 2020 generally does not apply to the collection, use, or disclosure of personal information for an individual's personal or domestic affairs [Source: Privacy Act 2020, s 45]. This means that if a homeowner installs a CCTV camera purely for their household's security and points it only at their own property, the Privacy Act's rules typically do not apply.

However, this exemption has limits:

  • Intrusion on Neighbours: If a camera is positioned to record a neighbour's private property (e.g., their garden, windows, or entrance), it could potentially be considered an unreasonable intrusion on their privacy, even if the Privacy Act does not directly apply. While not a Privacy Act breach, such actions could lead to disputes or other legal action (e.g., for nuisance or trespass, depending on the specific circumstances and degree of intrusion).
  • Public Areas: If a camera records public areas (e.g., the street), it is generally considered acceptable, provided it is not excessively intrusive or harassing.

For landlords operating CCTV in rental properties, particularly in shared areas of multi-unit dwellings, they are generally considered 'agencies' under the Privacy Act and must comply with the IPPs [Source: Privacy Act 2020, s 7]. Landlords may not install cameras inside a tenant's private dwelling without consent, as this would breach the tenant's right to quiet enjoyment [Source: Residential Tenancies Act 1986, s 39] and privacy.

CCTV in Businesses (Agencies)

Businesses are 'agencies' under the Privacy Act 2020 and must fully comply with all Information Privacy Principles when using CCTV [Source: Privacy Act 2020, s 7]. Key considerations for businesses include:

  • Clear Purpose: Businesses must have a legitimate, clearly defined purpose for using CCTV, such as protecting property, preventing theft, ensuring staff safety, or monitoring production [Source: Privacy Act 2020, IPP 1].
  • Notification: Prominent signs must be displayed at all entry points and within areas where cameras are operating, informing individuals about the surveillance, its purpose, and contact details for the operating agency [Source: Privacy Act 2020, IPP 3].
  • Fair Collection: Cameras must not be hidden and should not be used in private areas where employees or customers have a reasonable expectation of privacy, such as bathrooms, changing rooms, or staff break rooms (unless exceptional circumstances justify it and appropriate consultation has occurred) [Source: Privacy Act 2020, IPP 4].
  • Workplace Surveillance: Employers using CCTV in the workplace should consult with their employees or their representatives before installing cameras. The surveillance should be justified, proportionate to the risk, and only cover areas where there is no reasonable expectation of privacy for personal activities [Source: Privacy Act 2020, IPP 4].
  • Data Security: Footage must be securely stored and only accessible by authorised personnel [Source: Privacy Act 2020, IPP 5].
  • Access and Retention: Individuals have the right to request footage of themselves [Source: Privacy Act 2020, IPP 6], and footage should only be kept for as long as necessary [Source: Privacy Act 2020, IPP 9].

Prohibited or Restricted Areas for CCTV

Beyond the general principles, the Crimes Act 1961 specifically prohibits making an intimate visual recording without consent. An intimate visual recording involves recording a person's intimate parts or an intimate act, or a person in a place where they would reasonably expect to be afforded privacy [Source: Crimes Act 1961, s 216G]. This would cover the use of cameras in places like changing rooms or bathrooms for such purposes. Distribution of such recordings is also an offence [Source: Crimes Act 1961, s 216H].

Rights of Individuals and Responsibilities of Operators

Individuals recorded by CCTV have rights under the Privacy Act 2020, including:

  • To be informed that cameras are operating and the purpose of collection [Source: Privacy Act 2020, IPP 3].
  • To access footage that identifies them [Source: Privacy Act 2020, IPP 6].
  • To complain to the Privacy Commissioner if they believe their privacy rights have been breached [Source: Privacy Act 2020, Part 9].

Operators of CCTV systems, whether businesses or individuals falling under the Act, have the responsibility to ensure their systems and practices comply with all applicable Information Privacy Principles.

When to Seek Independent Legal Advice

Individuals and organisations seeking specific guidance on complex CCTV installations, workplace surveillance policies, or privacy complaints should consult with a legal professional. For general information and free advice regarding privacy issues, individuals can contact the Office of the Privacy Commissioner or visit Community Law Centres for assistance.

Key Resources