Police are tightening up the rules for how they use number plate information gathered through privately-owned CCTV cameras. The Herald’s David Fisher reports.
No one appears to know how many CCTV cameras feed into privately-owned number plate-reading surveillance networks accessed by police.
That includes our privacy regulator - the Office of the Privacy Commissioner - even though it says the number of cameras is a key factor in assessing the impact on people’s privacy.
Police were also unaware how many cameras collect data through the Auror and Safer Cities networks - platforms that allow police to access information collected by private camera owners and some councils.
There are believed to be thousands of cameras, worth tens of millions of dollars. The cameras belong to councils and business associations along with retailers, service stations, shopping malls and supermarkets - and are considered crucial in reducing and solving crime.
Through those platforms, police can search for vehicles by tapping in number plates, prompting the system to produce a record of any past sightings captured by connected cameras.
But police can also enter a number plate into the system which will send officers an alert if that vehicle drives past a camera in the future - a step that needs police to obtain a production order or, in certain cases, where someone’s life is at stake.
It comes amid questions over how open police have been about their use of the system, with the release of new documents - withheld by headquarters for a year - detailing how the camera system impacts on people’s privacy.
The documents include a view from Auror’s privacy specialists that “a reasonable person would not expect privacy” when using carparks at shops or service stations.
And it’s likely the number of cameras is about to increase, with NZ Transport Agency Waka Kotahi telling the Herald this month it was in talks with police about sharing information from its planned expansion of the traffic camera network from 150 to around 800 - all capable of reading number plates.
The issue of automated number plate recognition (ANPR) became fraught in September 2022 when it was discovered officers had falsely created stolen car alerts to bypass privacy safeguards when searching for women believed to have entered Northland with Covid-19.
The incident exposed a failure by police to set up an auditing process - and a subsequent review of use found a handful of officers had breached rules when using the system.
Lawyer Genevive Vear of the Public Defence Service, who has worked on a case involving a challenge to the police use of ANPR evidence, said we need better information about the systems being accessed by police, and that we should know the number of cameras collecting data.
She said it had so far not been possible to get that information. “The technology must exist for Auror to identify how many individual sources their ANPR data is coming from.”
She said the challenges to ANPR evidence was not an objection to it being used in principle. Rather, she said it was to ensure that access to such information was done in compliance with the law, particularly the Search and Surveillance Act, to allow external oversight and respect for citizens’ privacy and other rights.
“It must be unprecedented in New Zealand to have such huge amounts of personal data being accessed by the police from a private company on a daily basis with no oversight other than self-governance.”
Vear said the use of ANPR technology by law enforcement foreshadowed a range of other possible advances and it was important to get “guard rails” in place ahead of that new technology.
New technology horizons could be seen in, for example, the recent announcement of a facial recognition trial by Foodstuffs North Island across 25 supermarkets.
While police don’t currently have access to that technology, she said it was conceivable that may change, so it’s important to get the basics right now.
A police spokesman said it wasn’t known how many cameras they access information from and did “not oversee the number or location of cameras that are in the Auror (or Safer Cities) network”.
“To the best of our knowledge, police do not have specific numbers on how many cameras are currently on both networks.”
The spokesman said police were aware of “ballpark figures” in public reporting.
A spokeswoman for the Office of the Privacy Commissioner said it had not used its powers to require reporting of the number of cameras.
However, the office also said: “The greater number of cameras an organisation has, the greater its responsibility to ensure that they are only sharing information in a way that is lawful and proportionate.”
Herald inquiries have also revealed how police developed tightened-up practices as use of the system soared since it was introduced in 2020.
Back then, police were making dozens of requests of the system each month. Three years later, tens of thousands of searches were being conducted each year with no auditing, despite a 2017 privacy assessment saying it was a necessary component.
The first audit wasn’t carried out until late 2022 after the Herald reported that officers had falsely reported vehicles stolen to bypass privacy settings in the system.
Afterwards, police introduced a mid-2023 policy change that barred agreements with ANPR providers “unless that provider can provide controls on the level of access, approval and auditability”.
There was also a mid-2023 policy change after the Herald reported that “historical searches” by police not requiring a warrant included those made just seconds after CCTV footage had captured a vehicle’s number plate.
The change by police barred officers from pumping the same search repeatedly into the system, effectively tracking the vehicle.
The policy now said: “The review function is not to be used with the intent of obtaining numerous results on the same vehicle(s) within a 24-hour period in order to locate a person or evidence associated to a person. Such activity could be deemed to be a search and breach reasonable expectations of privacy.”
The new policy said using number plate data in this way to “predict where a vehicle is likely to be at a future point so it can be located” should have officers considering if a production order was necessary.
This month, police released to the Herald a copy of the Privacy Impact Assessment carried out for Auror in 2021. They had refused to release any part of the document a year ago, leading to a complaint by the Herald to the Office of the Ombudsman.
That led to a heavily-redacted version being released in October which the Herald rejected, leading to the entire document now being released without redactions. The release of the document showed Auror was urged to make a summary of the document public when it was first done.
Police said they had opposed release of the Privacy Impact Assessment because Auror claimed it was “the company’s intellectual property and was subject to ongoing confidentiality obligations”.
A spokesman said “any call to summarise the document for public release was one for Auror to make” - a position in contrast to the Office of the Ombudsman’s position on releasing information created by third parties, which says the decision rests with the public agency.
The Auror assessment included the company’s view that the organisations that provided number plate data “should have been transparent with individuals about the fact that, first, cameras are operating on their premises and, second, that they share personal information” with police.
Also, it said the information was “collected in public or semi-public places (roads, car parks, forecourts), in which a reasonable person would not expect privacy”.
“On this basis, it would be difficult to establish that individuals had a reasonable expectation of privacy in respect of ANPR data.”
The police spokesman said number plate data was a “valuable investigative tool for police in order to hold offenders to account and keep our communities safe”.
He said police were “committed to getting the balance right by using technology safely and responsibly” with their own policy setting out “reasonable expectations of privacy”.
A spokeswoman for Auror said the company considered the document confidential but “the Ombudsman believes it should still be released under the [Official Information Act], which has now occurred”.
In relation to what expectation of privacy people might have, the spokeswoman said the assessment carried out for Auror was “consistent with the fact that ANPR is already used globally for typical everyday activity like electronic toll collection, the management of traffic, and to help keep sites and employees safe”.
Council for Civil Liberties chairman Thomas Beagle said it was important to consider scale with “modern digital surveillance”.
“One shop or even a chain of shops using ANPR is one thing, but when multiple chains and other organisations all collect ANPR data and then allow that data to be searched in aggregate by someone else, it’s a synergistic effect where the whole is greater than the sum of the parts,” Beagle said.
“I don’t think we’d allow the police to set up a country-wide number-plate tracking system, at least not without a lot of debate about scope and how it can be used, but it seems that we’re going to end up with one anyway without that debate or Parliamentary or public oversight.”
Beagle also reviewed the Auror privacy assessment and the reasons it was withheld by police from public release. He said the reasons would be “very hard to justify on the grounds given” and he considered the heavily-redacted version released in October to be “our first ever example of black-washing, where only the fragments that sound good can be left visible to the public eye”.
“The document is a fascinating example of how officials can misuse the withholding powers in the Official Information Act to try to hide information for their own reasons.”
David Fisher is based in Northland and has worked as a journalist for more than 30 years, winning multiple journalism awards including being twice named Reporter of the Year and being selected as one of a small number of Wolfson Press Fellows to Wolfson College, Cambridge. He joined the Herald in 2004.
Luxon has now headed onward to Europe.