Police automatic surveillance of number plates: New privacy, accountability rules mooted

A privately owned CCTV network of thousands of cameras for surveillance and tracking is expanding. Photo / 123rf

Police have been given new benchmarks of control and openness around their access and use of an expanding privately owned CCTV network of thousands of cameras for surveillance and tracking.

The fresh guidelines around the use of automatic number plate recognition technology come in the form of a Privacy Impact Assessment telling police they need “robust governance, policies, processes and controls” for using the surveillance system.

It says doing so would balance out the intrusion into people’s lives by ensuring police use of the systems is “appropriate and lawful and the potential for misuse is limited as much as possible”.

The assessment has prompted NZ Council for Civil Liberties chair Thomas Beagle to question the premise of the vast private-sector collection of number plate information.

“When we say we’re opposed to mass surveillance, this applies to privately run systems as much as it does to government ones.”

Police search - or set alerts in some circumstances - across the privately owned Auror and Safer Cities networks, which capture number plate information through cameras in service stations, shopping malls, supermarkets and main streets across the country.

The new assessment of the impact on privacy comes after the Herald revealed officers had falsely listed cars as stolen so as to engage an automatic detection capability in the system.

The “stolen car” exploit was used twice by police, once in 2020 and again in 2021 when police were attempting to track down three women believed to have travelled to Northland while positive for Covid-19.

The Herald also revealed police use of the systems had grown hugely, and there was no auditing carried out by police or inclusion of other rules suggested in a 2017 Privacy Impact Assessment into police access of the Auror system in the Counties-Manukau policing district.

When an audit was eventually carried out, it led to five police officers facing internal integrity inquiries after being found to have improperly used the automatic number plate recognition system.

Another 120 officers were found to have used the system to track their own vehicles although it was unclear if the use was improper or while learning how the system worked.

Privately-owned CCTV cameras vastly outnumber those owned by police. Photo / George Heard

The new privacy assessment told police the number plate recognition system was an intrusion into people’s privacy because it had the potential to build “a comprehensive picture of a particular motor vehicle or individual’s movements and location”.

The assessment was produced for police by a company called Simply Privacy, of which former police chief privacy officer Mike Flahive is a director. Flahive - a former assistant commissioner at the Office of the Privacy Commissioner - carried out the 2017 assessment for police.

It said the system had a clear benefit to police and the public through better crime detection and prevention and improved public safety through finding criminals but also those who were missing or at risk of harm.

While it was possible to search for the information manually, the automated system saved police resources and allowed officers to move quickly when using the “real-time” system that actively searches for a specific number plate.

The balance, the assessment said, was the possibility of inaccurate data and people being wrongly identified as a result, unreasonable use of the system and concerns - real or otherwise - over profiling and surveillance.

It said the Auror and Safer Cities systems had “substantial” number plate information showing “ordinary citizens going about their daily lives, including video footage of potentially both drivers and passengers”.

The assessment pointed to the police policy on its use which said the “vast majority” of the number plate information was “of no interest to police”.

It said it was “critical” that Auror and Safer Cities - the holders of the information searched by police - ensure they were told by police in every search instance why the system was needed and the possible offence to which it was connected.

Doing so would be in line with the Privacy Act, which allowed information to be shared with police to help with “maintenance of the law” if there were “reasonable grounds” to believe sharing it would do so.

The assessment said concerns about the use of automated number plate reading in the United States and United Kingdom led to legislation regulating its use and storage of information after concerns over “mass surveillance” and “improper data retention”.

Council For Civil Liberties chair Thomas Beagle. Photo / Supplied

It noted that no such legislation existed in New Zealand where concerns included mass surveillance and improper use of ANPR systems by police. It pointed to guidelines from the Office of the Privacy Commissioner over CCTV use which were produced in 2009 and made no mention of automatic number plate reading.

To balance out those concerns, the assessment said good controls and governance policies needed to be in place, including using real-time tracking only in limited circumstances and limiting access to the number plate data so police searching was forced to be targeted.

It also recommended deleting number-plate data after a successful “hit”, unless there were strong reasons to keep the additional information.

The assessment urged police to publish data on its use of the systems, along with detail about controls and governance of the system.

“In our view, police transparency around its use of ANPR data is likely to enhance public trust in police efforts, ultimately supporting notions of ‘policing by consent’, as well as potentially providing a general deterrence to those who commit crime.”

Beagle, of the NZ Council for Civil Liberties, said the assessment had ruled as “out of scope” the basic question he believed should be answered - whether private companies should be able to build databases of data that could be used to “locate and track people”.

He said the public should be asking if the privately-owned systems didn’t exist “would we let the police implement a large-scale national vehicle tracking system.

“I don’t think we would, as we’d see it as implementing mass surveillance and that this sort of invasive tracking of people isn’t compatible with a free and democratic society.”

Beagle said it appeared as if the third-party systems were being used to get around the issue of whether police should be allowed to run such systems at all.