A controversial decision by the NSW Administrative Decisions Tribunal (ADT) on 3 May has raised concerns about the CCTV surveillance of our communities. Shoalhaven City Council has turned off its CCTV cameras in the Nowra CBD as the Tribunal ruled the cameras were in breach of the Privacy and Personal Information Protection Act 1998 (PPIP Act).

While the decision has received a lot of attention it is unlikely that the decision will effect private sector organisations.

Politicians from both sides of politics have reacted angrily to the decision with NSW Premier Barry O'Farrell saying "CCTV is a vital tool in the fight against crime and I am determined to ensure they remain so" and has asked the NSW Attorney General to "seek urgent advice on the implications and whether legislative amendments are required to validate the continued use of CCTV".

Although the decision may have had an immediate impact on Shoalhaven City Council's use of CCTV surveillance it is unlikely to restrict the use of CCTV by Councils and law enforcement agencies. The decision is more about how CCTV is used by those agencies.

FACTS

The Council installed CCTV cameras throughout the Nowra CBD which became operational in late 2009.

The CCTV cameras were owned and operated by the Council with a live feed monitored at Nowra Police station.

There were signs indicating the presence of CCTV camera coverage in the area.

Adam Bonner, a resident of the Shoalhaven area objected to the Council recording and storing footage of him walking through Nowra CBD on 5 March 2011 and 7 March 2011. The ADT proceedings arose from an application by Mr Bonner for an internal review of the Council's conduct under Part 5 of the PPIP Act and the claim that the Council's conduct of using CCTV cameras to record images of members of the public contravenes various Information Protection Principles (IPP) under the PPIP Act.

MR BONNER'S POSITION

In regard to the collection of his personal information, Mr Bonner argued that:

  1. it is not lawful for the Council to record or retain CCTV images of him in a public place and transfer those CCTV images to Nowra Police Station;
  2. the policing and the collection of evidence for prosecuting alleged offenders is a State responsibility and, on that basis, it is not lawful for the Council to have a role in evidence collection by way of the cameras; and
  3. in the alternative, if the use of cameras by the Council is lawful, the recording of images is not directly related to Council's functions.

Mr Bonner sought that the Tribunal order the Council to switch the cameras off and remove them.

COUNCIL'S POSITION

The Council argued that:

  1. it has an express statutory power to develop local crime prevention plans;
  2. it is authorised by statute to collect personal information in the implementation of its crime prevention plan; and
  3. the use of the cameras is reasonably necessary for the effective implementation of the crime prevention plan.

TRIBUNAL DECISION

The Tribunal decided that the Council breached several provisions of the PPIP Act, in particular the obligations imposed on it by sections 10, 11(a) and 12(c) of the PPIP Act and was required to apologise to Mr Bonner for the breaches.

Although the Tribunal did not order the Council to switch the cameras off and remove them, it did order that the Council refrain from any conduct or action in contravention of an IPP, which might require Council switching the cameras off and removing them.

TRIBUNAL'S REASONING

The reasoning for the Tribunal's decision is as follows:

  1. Section 10 of the PPIP Act provides that the Council must ensure:
    1. an individual is aware that the Council is collecting the information,
    2. the purpose for which Council is collecting the information;
    3. the intended recipients of the information;
    4. whether the supply of the information by the individual is required by law or voluntary, and any consequences if information is not provided;
    5. the existence of any right of access to, and correction of, the information, and
    6. the name and address of the Council collecting the information and the agency that is to hold the information.

    Although the Council had installed signs indicating the presence of CCTV camera coverage in the area with the Council's logo and contact details on the signs, the Tribunal was not satisfied that the signage was sufficient to ensure the individuals are made aware of all of the information addressed in section 10. The Tribunal found that "the signage that is in place and other action taken by the Council has not been sufficient to ensure that individuals are made aware of the implications for the privacy collection process, and of any protections that apply prior to or at the time of collection."

  1. Section 23(3) of the PPIP Act provides an exemption for some of the IPPs, in particular "a public sector agency (whether or not a law enforcement agency) is not required to comply with section 10 if the information concerned is collected for law enforcement purposes".

  2. Surprisingly, the Tribunal found that "a small proportion of the information is used for law enforcement purposes", whereas the main purpose it is collected is for 'crime prevention', meaning the exemption under section 23(3) of the PPIP Act could not apply.

  1. Section 11 of the PPIP Act requires a Council collecting an individual's personal information to take such steps that are reasonable in the circumstances ensuring that the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and the collection of the personal information does not unreasonably intrude on the personal affairs of the individual to whom the information relates.

  2. Mr Bonner submitted that the quality of the images and footage collected was of such a poor quality that it would be of little assistance for law enforcement purposes. Further, expert evidence that was submitted suggested that CCTV does little to prevent crime. In fact, available data suggested that since the Council's CCTV program was implemented crime had increased in the Nowra CBD in the categories of assaults, break and enters and malicious damage.

    The Tribunal found that the Council failed to comply with its obligations under section 11 as Mr Bonner's personal information that was collected was "not relevant to the purpose of crime prevention, and is excessive, inaccurate and incomplete" and did not provide any meaningful assistance "in a general law enforcement context".

  1. Section 12(c) of the PPIP Act provides that the Council must ensure that the information is protected by taking reasonable security safeguards against loss, unauthorised access and misuse.

Although the collected data was only available to Council staff and Police Officers, the issue of having a generic password to access the system, rather than an individual name and password for each authorised user meant that there was no way for checking who is and isn't using the live monitor at the Nowra Police station. Even though it is primarily police that access the system, there are no measurers in place to determine whether those who access the live monitor have been appropriately trained. The Tribunal noted that while the system design achieves this objective, the Council has failed to monitor compliance of the safeguards that are in place. The Tribunal concluded that the Council's CCTV program is "open to unauthorised access and misuse" and fails to comply with section 12(c) of the PPIP Act.

While the Tribunal's decision may have caused the Council to turn off the cameras, in reaching its decision, the Tribunal noted that the NSW Police are exempt from compliance with any of the IPPs in respect of all of their functions other than their educative and administrative functions. The Tribunal further noted that had the NSW Police operated the CCTV system, then the conduct of which Mr Bonner has complained about would arguably be permissible under the PPIP Act.

Although it is unlikely this decision will impact businesses that have CCTV cameras installed around and within their business premises, it is a reminder to all businesses of the need to be able to justify the use of the CCTV cameras.

The fact that the personal information collected using CCTV can be useful deterring and capturing criminals does not mean that the use of CCTV is always justified. As with all forms of personal information, an organisation or agency collecting personal information using CCTV must ensure that it does not unreasonably interfere with the privacy of those individuals whose personal information they collect.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.