Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.
We respect your Do Not Track preference.
From our experience, putting up a CCTV or surveillance camera can get a strong reaction from the public.
Our Privacy Concerns and Sharing Data 2020 survey found 41 percent of people over 18 years old were concerned about the use of surveillance cameras.
Because CCTV captures images of people, which can be used, stored, manipulated, and disseminated, those who operate the systems need to be aware of how to manage privacy issues.
Good management of personal information is essential to the effective running of CCTV systems. Businesses can only take advantage of the full benefits available from CCTV technology if they manage their system with privacy in mind.
All organisations considering using CCTV need to be mindful of their obligations under the Privacy Act 2020. Organisations must only collect personal information if it is for a lawful purpose connected with their functions or activities, and the information is necessary for that purpose.
We always recommend that agencies minimise the amount of personal information they collect. Any information that is collected should also be securely disposed of once it’s no longer needed for the organisation’s purpose.
Information on this page
Privacy and CCTV: A guide to the Privacy Act for businesses, agencies and organisations provides guidance for ensuring CCTV systems meet legal obligations and are run with good personal information handling practice.
Content includes simple practical help for setting-up and operating CCTV, ways to protect people's privacy such as by using privacy-enhancing technology, and guidance on complying with legal obligations under the Privacy Act.
The guidance applies to the public and private sectors, covering organisations of all sizes.
View a copy of the full guidelines or a copy of the shorter guidelines summary. Please note that while much of the information in these guidelines remains relevant, they were drafted before the Privacy Act 2020 so will not cover recent amendments.
We also have a handy pointers for security cameras and drones guidance leaflet.
Any organisation considering the use of CCTV should conduct a Privacy Impact Assessment (PIA) before using the technology. Some key considerations in the PIA should be whether the collection of personal information using CCTV is necessary for the organisation’s business activities, and whether it would intrude unreasonably into people’s personal affairs.
If the PIA concludes that the proposal should proceed, it should identify necessary mitigations to address privacy concerns. We would expect safeguards to include robust operational procedures, training and auditing to prevent unauthorised access to or misuse of personal information.
If CCTV is adopted, we would expect the information in the PIA to be translated into a clear policy that sets out its use of CCTV including:
Organisations using CCTV in public spaces must only collect personal information if it is for a lawful purpose connected with their functions or activities, and the information is necessary for that purpose.
Getting things right at the start should avoid encountering privacy issues down the track. Before proceeding with a proposal to use CCTV, agencies should undertake a thorough Privacy Impact Assessment. This should include consideration of:
We would also encourage engagement with the local community to understand any privacy concerns they may have.
Our guidelines help organisations work through the process from considering implementing CCTV right through to ensuring that they are regularly evaluating its use.
If individuals are concerned about the use of CCTV in public areas, they can contact our Office.
Generally, taking photos or recordings in public places is allowed, but there are limits in some cases. The role of the Privacy Act will generally depend on who is taking the photo or making the recording - whether they are an agency or an individual. Further information is available here.
People should avoid using CCTV in ways that other people may feel intrudes on their privacy.
But while it might not be polite or neighbourly to film across a fence, the actions of a neighbour acting in their personal capacity will generally not be covered by the Privacy Act.
This is because the Privacy Act does not apply to what someone does in their personal capacity except in a narrow set of circumstances where the collection, use and disclosure would be highly offensive to a reasonable person.
Highly offensive is a high threshold. CCTV capturing highly sensitive and intimate images may be highly offensive, but it would generally be unlikely home security cameras could capture this from their neighbour’s house. We would not consider images highly offensive if it could be seen from the street.
But while there is no complaint or remedy process for the use of CCTV in private homes under the Privacy Act, other laws may apply in this context.
For example, highly sensitive images could also be subject to the Crimes Act so we would recommend going to the Police first. The Crimes Act includes provisions prohibiting the intimate recording of people without their consent or knowledge and prohibits publication of such recordings so it is best to first raise any concern with the Police.
For example, if you are sunbathing semi-naked in your own back yard surrounded by a three-metre-high fence, you would likely have an expectation that you won’t be spied on. See section 216G to 216J of Crimes Act 1961.
It is also against the law to peer into people’s homes and record any activity within. See section 30 of the Summary Offences Act 1981.
Our tips for people using cameras at home:
Can a neighbouring business film me?
If you are concerned about the surveillance practices of an agency such as a business, they will have obligations under collection principles 1, 3, and 4 of the Privacy Act.
Under principle 1, an agency must not collect your personal information unless your information is collected for a lawful purpose connected with a function or activity of the agency, and if the collection of the information is necessary for that purpose.
Often an agency will collect information via surveillance cameras to keep its premises safe and secure. If your neighbouring agency is collecting information as a security precaution, this will likely be a proper purpose as required under principle 1.
Principle 3 requires an agency to be open about why they are collecting personal information and what they will do with it. When an agency collects personal information, it must take reasonable steps to make sure that the person knows why it’s being collected and who will receive it. If an agency has erected a surveillance camera, we generally recommend the agency have signage to alert passers-by about the camera and to advise them who operates it.
Ideally, an agency should have a full privacy notice available on its website and/or in hardcopy at its reception desk. Staff should also usually be aware of the cameras and be able to field any questions about their use.
Does this mean an agency can use surveillance and get off “scot free”?
No. Though we can rarely investigate surveillance cameras, there are circumstances where an agency’s conduct will reach a level where they are breaching the privacy principles and where their actions may attract an award of damages in the courts. This is not something we can assess but it is certainly something an agency should keep in mind.
For instance, in Armfield v Naughton there was a tense and confrontational relationship between an owner of a bed and breakfast and his neighbours. The owner set up eight surveillance cameras, three cameras which pointed towards his neighbour’s property, including a children’s play area. The owner refused to talk to his neighbour about the cameras and to respond to letters from the neighbour’s lawyer asking him to change the angle of the cameras. In that case, the Human Rights Review Tribunal found a breach of principles 3 and 6 and awarded the owner’s neighbour damages.
In this case note, a pub installed cameras for the purpose of keeping the premises safe and secure. But it had placed a camera in a men’s toilet area which overlooked urinals. We did not consider the pub had a proper basis for collecting this information and we considered this to be an unfair collection under principle 4. Even with signage in the area, we considered this was highly sensitive information collected in an unreasonably intrusive manner.
The Privacy Act is geared toward regulating organisations, this means it applies to Airbnb and other home rental business.
Owners must ensure they are complying with the Act when collecting and managing guests' personal information such as their image and conversation. Detailed information on the Act and its principles outlining the use of people’s personal information are available here.
A key point is that businesses must only collect personal information if it is for a lawful purpose connected with their functions or activities and the information is necessary for that purpose.
This means owners must ensure guests are aware of any camera recordings, such as by putting up clear signage, and that recordings are only being made for a legal purpose. This includes ensuring people aware of whether the cameras are recording video, audio or both.
Agencies should minimise the amount of personal information they collected. For example, security camera systems should not record audio if visuals are sufficient because of the increased privacy intrusiveness.
Recordings should be securely disposed of once no longer needed.
Generally, CCTV systems should not record audio.
We always recommend that agencies take a data minimisation approach. Collecting audio significantly increases privacy intrusiveness. If recording of audio is not necessary but the system comes with audio capability, it would be highly advisable to disable the audio capability.
Public authorities should consult their privacy officers and legal teams.
Remember, organisations using CCTV must ensure people are aware that cameras are operating such as through signage. If they are recording audio, this should be made clear.
The signs or other information should also make clear who owns and operates the CCTV system, and the contact details of that agency if this information is not already obvious.
In Aotearoa New Zealand, if someone asks for their personal information, organisations need to be able to respond to the request.
This is set out in principle 6 of the Privacy Act which says people have the basic right to access information that is about themselves.
This right extends to CCTV recordings. It follows that businesses and organisations that use CCTV, or are considering such use, will need to have ways they can give people the information they ask for.
Giving people raw CCTV footage of themselves will in many cases not present a problem. For instance, CCTV used in a supermarket or other types of public places is less sensitive than video taken in a gym, swimming pool, hospital or prison. The more sensitive the setting, the higher the privacy risk.
There will be times when you will need to protect the identity of others who have been captured on CCTV. The solution you choose for masking identity may depend on the nature of the setting which the CCTV is being used in.
Visit our Responding to access requests for CCTV footage page for further information.
The threat drones pose to privacy is similar to any camera, including mobile phones or automated CCTV systems. Our CCTV guidelines listed earlier on this page apply to how someone might use drones fitted with cameras and comply with the Privacy Act.
The main points for any camera operator to observe are:
Visit our privacy and drones page for further information or view our handy pointers for security cameras and drones guidance brochure.
Dashboard cameras capture images of travel and vehicles in public places. They do not usually capture clear images of other drivers by which they can be readily identified. But with a dash cam you are going to be collecting a lot of background footage. This background footage is likely to be made up in part of some personal information.
The Privacy Act is all about the collection, use, storage and disclosure of personal information. Personal information is defined in the Act as information about an "identifiable individual".
Our advice to people wanting to upload video taken by dash cam (and this also applies to CCTV and drone footage) is to consider carefully why you might need to do this. If there is a compelling reason, you also need to think about how to edit out or mask the number plates of other cars, or images of passers-by.
If you see examples of dangerous or bad driving, uploading the footage to YouTube is not necessarily the best way of drawing attention to it. A more effective option might be to give the footage to Police.
Visit our Privacy and dash cams page for further information.
Case Note 209484 [2010] NZ PrivCmr 15: Police disclose recognisable image of crime victim to media
A man ('the victim') worked at the front counter of a finance company which was robbed at gunpoint. Police released CCTV images from the finance company to public media in the hope of identifying the offender. However, the victim was clearly visible in one of the photographs.
A man was concerned that he had been filmed in the men’s toilets of a pub by a fixed CCTV camera. He was initially unaware of the camera’s presence but had later seen copies of the pictures taken while he was using the bathroom.
Case note 308105 [2020] NZPrivCmr 5: Charity shop failed to notify CCTV cameras recorded audio
A charity shop volunteer complained to our office after discovering CCTV cameras in the shop they worked at was recording audio without the knowledge of customers or other staff.
Case note 300099 [2019] NZPrivCmr 12: Restaurant withheld CCTV recording from family
A fast-food restaurant declined to hand over video footage to three customers who said they were harassed by a restaurant employee. The trio, who were members of one family, complained to our office.
The Privacy Commissioner’s final opinion was that Corrections had interfered with the complainant’s privacy by not providing him with footage related to an assault he suffered in prison.
Blog post: Lessons on CCTV use from the Human Rights Review Tribunal
A Human Rights Review Tribunal case attracted some attention as a result of its colourful facts – bad feelings between previously friendly neighbours, allegations about vandalism, and a compensation bill of $7000.
An NZ Post delivery agent complained to us that audio recordings were being made by cameras installed on “Paxster” electric delivery vehicles without his knowledge.
