The report of the Joint inquiry by the NZ Independent Police Conduct Authority and the NZ Privacy Commissioner into Police conduct when photographing members of the public states
This joint inquiry was prompted after whānau reported Police photographing their rangatahi in circumstances they considered unfair or unjustified. Subsequent media coverage led more people to report similar experiences. As a result, IPCA and OPC undertook a joint investigation beginning in March 2021, to examine Police photography of persons who have not been detained for the suspected commission of an offence.
In the course of the joint investigation, we considered five individual complaints in which whānau claimed Police had either uplifted rangatahi for care and protection reasons but had then photographed them in relation to a criminal investigation or had stopped their rangatahi in public places and photographed them without their consent. Two of these complaints were historic in nature and, given the time that had passed and the lack of records or other available information, we were unable to establish the facts or make any findings.
In relation to the three remaining complaints, we found that Police were not justified in photographing the rangatahi, as the photographs were not necessary for a lawful policing purpose. We also found that, in these incidents, Police had not properly sought consent from the rangatahi or their parents or caregivers before taking the photographs, and had not adequately explained why the photographs were being taken and what they would be used for. In one incident, we found Police had wrongly threatened to arrest a rangatahi if they did not consent to being photographed.
Our interviews with officers in relation to these complaints suggested that there were broader questions about the appropriateness of current Police practice in this area. We therefore extended the inquiry to an examination of the way in which photographs or video recordings of members of the public (referred to in the remainder of this report as “photography”) are being taken, used and retained in a variety of policing contexts. We interviewed a range of front-line officers and managers in four Police districts about their own practice, whether this was representative of general practice and their understanding of the law and Police policy. During this broader investigation, we also found that Police were regularly taking duplicate sets of “voluntary” fingerprints from youths who ended up in Police custody for suspected offending and retaining them for a longer period than permitted by the regime for compulsory prints under the Policing Act. We have included consideration of that practice within the scope of this report.
General findings
Police use of photography depends on the relevant powers that are available in each policing situation and the respective constraints that apply. Where Police are taking a photograph of a person or persons under any statutory power (which relate primarily to a search scene or a person in custody), they need to comply with the relevant specific legislative threshold and applicable constraints. The Privacy Act should not be used as a basis for taking photographs which circumvent those constraints. Where Police take photographs of people in contexts outside those specific statutory situations, officers must comply with the Privacy Act and the information privacy principles (IPPs) within it, taking into account the status of digital photographs as sensitive biometric information.
The way that the privacy principles operate as a constraint depends on the policing purpose and the particular circumstances that Police encounter. IPPs 1- 4 are the source of the privacy safeguards that apply when Police are taking photographs. These dictate the need for a lawful purpose and set out the expectation that the person will be informed at the time of the purpose for the photograph and their consent sought.
The privacy safeguards are flexible and Police can depart from these where necessary. For example, the Police can use covert photography where this is justified and proportionate to their policing purpose.
Overall, we have found aspects of both Police policy and practice are inconsistent with this framework and breach individual rights.
Officers are routinely taking photographs when it is not lawful for them to do so. Many are under the misapprehension that if they obtain the consent of the person photographed, this gives them the necessary authority, even though they do not have a lawful purpose in terms of the Privacy Act.
When they do take photographs in circumstances that comply with the information privacy principles, many officers appear to have very little understanding of the law relating to the retention of these photographs under the Policing Act or the Privacy Act. As a result, thousands of photographs of members of the public are kept on the mobile devices (mobile phones, tablets etc) of individual officers or, if transferred to the Police computer system, not destroyed after there is no longer a legitimate need for them.
Fundamentally, these problems have arisen because Police as an organisation have not developed appropriate training, guidance or policies to enable officers to use their powers and collect personal information effectively and lawfully. In particular, their roll-out of technology and mobile devices has not been accompanied by sufficient training and support, which has resulted in inconsistent and improper practices.
We have therefore concluded that Police policy, procedures and training need to be significantly revised and enhanced to reflect that photographs are sensitive biometric information and to ensure that, when Police are photographing people, they are doing so only when either there is a specific statutory authorisation or there is full compliance with the information privacy principles.
The recommendations are
Taking photographs for intelligence purposes
R 1 Police should develop a consolidated and comprehensive policy covering the use of photography to collect personal information under the Privacy Act for general intelligence gathering purposes. This policy should develop clear, practical guidelines for complying with the Privacy Act when stopping individuals in public and taking photographs for intelligence gathering purposes including: (a) setting an appropriate threshold under the Privacy Act (IPP1) for the collection of personal information: when turning their minds to their reasons for collection officers must be able to articulate a reasonable possibility, based on more than mere conjecture, that the individual being photographed could be relevant to a particular or likely investigation (the lawful purpose). (b) unless an exception applies, informing the individual of the purpose for taking the photograph, the consequences for the individual if the photograph is not provided and other information required under the Privacy Act (IPP 3); (c) setting out the applicable thresholds for exceptions to the requirement to inform the individual. In relation to the maintenance of the law exception, that requires a reasonably held belief that not complying with IPP 3 is necessary to avoid prejudice to the maintenance of the law; (d) the circumstances that require the consent of the individual to ensure that photographing the individual is fair and does not intrude to an unreasonable extent on their personal affairs. For example: (i) if an officer is engaging with an individual and informing them of the reason and purpose for the photograph, it will generally be fair to also obtain their consent, particularly if the individual is a youth; or (ii) if seeking the individual’s consent would be disproportionately prejudicial to the reason for taking the photograph or to the maintenance of the law, that risk of prejudice can justify proceeding without consent; and (iii) that, if a photograph is taken after the refusal of consent, the individual must be informed that the photograph is mandatory.
R 2 Police policy should provide clear guidelines for complying with the Privacy Act when stopping a youth in public and taking photographs for general intelligence-gathering purposes including: (a) reflecting the youth specific protections in the Oranga Tamariki Act and UNCROC; (b) tailoring the explanation under IPP 3 to youth in an age-appropriate way; and (c) reflecting the requirements of IPP 4 when officers are deciding to proceed with a photograph of a youth and require officers to engage with the youth’s family, whanau or caregiver and, in the case of a child or tamariki under the age of 14, to obtain their consent (or if they are unavailable another appropriate and independent adult), before taking a photograph of the youth.
R 3 Police policy should require officers to record the circumstances and considerations that they rely on to justify the collection of personal information for purposes of intelligence gathering.
R 4 Police policy should include guidance on the limits of an officer’s power to take photographs or video recordings when that officer is lawfully on private premises.
Taking photographs for investigation purposes
R 5 Police should develop a consolidated and comprehensive policy covering the use of photography to collect personal information under the Privacy Act for non-crime scene identification. This policy should develop clear, practical guidelines for complying with the Privacy Act when stopping individuals in public and taking photographs for purposes of investigations including: (a) setting an appropriate threshold under the Privacy Act (IPP1) for the collection of personal information: when turning their minds to their reasons for collection officers must be able to articulate a reasonable possibility, based on more than mere conjecture, that the individual being photographed could be relevant to a specific investigation that is currently underway (the lawful purpose); (b) unless an exception applies, informing the individual of the purpose for taking the photograph, the consequences for the individual if the photograph is not provided and other information required under the Privacy Act (IPP 3); (c) setting out the applicable thresholds for exceptions to the requirement to inform the individual. In relation to the maintenance of the law exception, that requires a reasonably held belief that not complying with IPP 3 is necessary to avoid prejudice to the maintenance of the law; (d) the circumstances that require the consent of the individual, to ensure that photographing the individual is fair and does not intrude to an unreasonable extent on the personal affairs of the individual concerned. For example: (i) if an officer is engaging with an individual and informing them of the reason and purpose of the photograph, it will generally be fair to also obtain their consent, particularly if the individual is a youth; or (ii) if seeking the individual’s consent would be disproportionately prejudicial to the reason for taking the photograph or to the maintenance of the law, that risk of prejudice can justify proceeding without consent; and (iii) that, if a photograph is taken after the refusal of consent, the individual must be informed that the photograph is mandatory.
R 6 Police policy should provide clear guidelines for complying with the Privacy Act when taking photographs of youth for investigation purposes including: (a) reflecting the youth specific protections in the Oranga Tamariki Act and UNCROC; (b) tailoring the explanation under IPP 3 to the youth in an age-appropriate way; and (c) reflecting the requirements of IPP 4 when officers are deciding whether to proceed with a photograph of a youth and require officers to engage with the youth’s family, whanau or caregiver and, in the case of a child or tamariki under the age of 14, to obtain consent from them (or if they are unavailable another appropriate and independent adult), before taking a photograph of the youth.
R 7 Police policy should require officers to record the circumstances and considerations that they rely upon to justify the collection of personal information for investigation purposes.
R 8 Police policy should confirm that Police may take photographs at a crime scene provided that the privacy of those unrelated to the incident is taken into account. This could be addressed by the redaction of images that include individuals who are not relevant to the investigation.
Traffic checkpoints and other traffic stops
R 9 Police should prioritise review of training and policy on LTA checkpoints and stops to ensure that: (a) policies reflect the current legal constraints, including the application of the privacy principles when taking photographs for non-LTA purposes; (b) checkpoints and other traffic stops are not established for the primary purpose of collecting photographs and personal information for a collateral purpose; (c) information gathered in the course of an LTA checkpoint or stop is not used for other purposes (e.g. general intelligence) unless lawfully collected for that other purpose, or it comes under a valid use exception under the Privacy Act; (d) photographs are taken for identification purposes at traffic checkpoints and other traffic stops when an infringement notice is being issued only when the driver’s identity is not able to be ascertained in other way (eg by examination of the driving licence and accompanying photograph); and (e) officers receive regular training on the limits of taking photographs at LTA checkpoints and traffic stops.
Protests and other large gatherings
R 10 Police should review the Demonstrations policy to reflect that: (a) an appropriate threshold for photography is where the officer believes, based on some articulable facts, that there is a reasonable possibility of disorder occurring; and (b) recording demonstrators for no reason other than their presence in an otherwise lawful and peaceful demonstration, with the aim of identifying them for potential future demonstrations, is not necessary for a lawful Police purpose. Issuing notices and proof of service
R 11 As part of a general review of policy and guidance relating to photographs of members of the public, Police should review and update policies and process relating to proof of service. This should make it clear that officers may photograph individuals holding a summons or infringement notice, as long as officers properly explain the purpose and use of the photograph, take it by fair and reasonable means, and limit the use of the photographs to demonstrating proof of service.
Responding to monitoring by members of the public
R 12 As part of a general review of policy and guidance relating to photographs of members of the public, Police should ensure there is guidance about the lawful basis for photographing or video recording members of the public monitoring Police. This should make clear that officers should do so only if the officer has reasonable concerns that the person’s behaviour poses a threat or is obstructing them in the performance of their duty.
Interaction with youth in Police stations
R 13 Police policy should reflect that “voluntary consent” - whether or not it is informed - does not make the otherwise unlawful or unnecessary collection of personal information lawful or compliant with the Privacy Act
R 14 Police should cease the practice of taking photographs of youth on a ‘voluntary’ basis where a youth has been uplifted or detained, except where a photograph is necessary for Police’s care and protection role to ensure the safety of the youth.
R 15 Police should cease the practice of taking biometric prints from youth on a ‘voluntary’ basis.
R 16 Police policy should identify: (a) the limits on taking ‘voluntary’ photographs of youth (and adults) present in Police stations on a voluntary basis under IPP 1; and (b) where a youth is concerned, the requirement for a parent, caregiver or other appropriate adult to be present to give informed consent for a ‘voluntary’ photograph.
R 17 Police should prioritise training for officers to improve understanding of: (a) Police’s functions under the Oranga Tamariki Act in the youth justice and care and protection contexts; and (b) the youth-specific protections due to vulnerability.
Use
R 18 Police policy should provide clear guidelines on the purposes for which lawfully collected personal information in the form of photographs and videos may be used under the Privacy Act (IPP 10).
Retention
R 19 Police policy and guidelines (including any relevant disposal schedule) should be reviewed and amended to ensure the technology policy is fit for purpose to support compliance with Police’s obligations under the Privacy Act (and other relevant legislation) and provide guidance for officers routinely using mobile devices for mixed personal and policing purposes including, in particular: (a) the consistent storage and uploading of images and associated data to secure locations, and minimising the retention of images on individual devices and the duplication of images across Police systems; (b) limits on using individual devices to capture images where other Police devices or technology is specifically set up for that purpose; (c) protocols on handling sensitive or traumatic images; (d) limits on the use and retention of images (and copies) in individual devices and in Police systems; (e) routine review and deletion of images from mobile and desktop devices; (f) protocols for purging and replacing devices.
R 20 Police should prioritise regular training for all officers on using mobile devices to ensure legal compliance.
R 21 Police should review systems and implement the ability to audit compliance with: (a) updated technology policy and the handling of photographs of individuals on mobile devices; and (b) the deletion of identifying particulars in accordance with statutory time limits.
R 22 Police should develop a strategy to improve its staff’s fundamental understanding of the application of the Privacy Act to the collection and protection of personal information with a particular focus on photographs as sensitive biometric information covering: (a) policies and processes; (b) training; and (c) methods for updating knowledge and practice on an ongoing basis.
R 23 In implementing the strategy, Police should establish a rolling programme of reviews and updates of key policies, and develop and deliver agency-wide training to its staff and relevant contractors on: (a) the decision-making framework and procedures to be followed to photograph individuals and youth in public; and (b) storage and deletion procedures.
