19 Dec 2016, 09:00

In May 2013, the complainant was seriously assaulted while in Mt Eden Corrections Facility, then under the management of Serco. The assault left the complainant with a traumatic brain injury which has significantly impacted on his life. The complainant has no memory of the assault or its aftermath up to the time he woke up in hospital.

He advised our Office he was seeking legal advice about whether the Department had failed to provide him with the necessities of life by not providing medical assistance sooner.

In 2015, the complainant wrote to the Department of Corrections and asked for copies of the CCTV footage recorded just before, during, and after the assault. He also asked for copies of footage showing how he returned to his cell; prison staff finding him unconscious in his cell, and him being taken by ambulance to hospital. He said he needed this footage to assist with preparing a legal case against the Department.

The Department declined to give the complainant a copy of the footage on the grounds that staff and other prisoners could be seen in the recordings, and releasing it would breach their privacy. The Department was also concerned that releasing the footage could pose security risks, and risks to staff and prisoner safety. It advised it has limited capability to edit the footage to satisfactorily mitigate those concerns.

The Department did allow the complainant and his lawyer to view the footage on Department premises on numerous occasions.

The Privacy Commissioner formed a view that this was an exceptional case. This is because the measures designed to protect an individual’s safety had failed, resulting in the serious assault which has had a significant impact on the complainant. The complaint’s injuries limited his ability to travel to view the footage, and affected his ability to recall what he had viewed. His lawyer also advised our Office that receiving a copy of the footage would assist with their application for legal aid.

The Commissioner found the Department did not have a lawful basis to decline to provide the complainant with his own copy of the footage. The Commissioner also found that some footage had been lost or deleted, which was contrary to the policies applying to such material and breached principle 5 of the Privacy Act.

Principle 6

Principle 6 says individuals have the right to access information held about them by an agency. The presumption of access is strong and is limited by the withholding grounds in sections 27-29 of the Privacy Act. Principle 6 is also subject to the procedural provisions in part 5 of the Act, including section 42(2).

Section 27(1)(c)

Section 27(1)(c) allows an agency to withhold personal information if releasing it would likely prejudice the maintenance of the law, including the prevention, investigation, and detection of offences, and the right to a fair trial.

The Department submitted that it could rely on this section because releasing a copy of the footage could reveal the locations of CCTV cameras which may disclose operational procedures and the layout of the facilities. The Department said this could severely compromise the safety and security of the prison.

We accepted the legitimacy of these concerns and that very serious risks to safety are present in a prison environment. We also accepted that it is important for the Department to be able to withhold footage on that basis where it is justified. We noted that in previous cases we have accepted the need to withhold CCTV footage to avoid prejudicing the security of a prison facility. However we are obliged to assess each case on its merits, and did not believe that releasing the footage in this case would in fact prejudice the security of the facility. One of the reasons for this finding was that photographs of the space in which the assault occurred, showing the position of the cameras, had been published online when the facility was opened.

Section 29(1)(a)

This section allows an agency to withhold information if releasing it would be an unwarranted disclosure of the affairs of another individual.

The Department identified that other prisoners and staff could be seen in the footage the complainant requested. We agreed that releasing an unedited copy of the footage would be an unwarranted disclosure of those individuals’ affairs.

However, the Commissioner was not satisfied that the Department had demonstrated it would be too onerous or costly to edit the footage in a manner that would satisfy the complainant’s right to access it, with the Department’s obligation to protect other individual’s identities.

The Commissioner advised that as agencies collect more and more information via CCTV cameras, it is to be expected the number of access requests an agency receive for CCTV footage will increase. Therefore, we expect an agency collecting CCTV footage to have considered how it can make that type of information available while also meeting their obligations under section 29(1)(a). Agencies must also treat each request for CCTV footage on a case-by-case basis. The Privacy Act does not permit agencies to create classes of information which, based on internal policies, it can withhold.

Section 42(2)

Section 42(2) says an agency should make information available in the way preferred by the requestor, unless to do so would impair efficient administration; be contrary to any legal duty of the agency; or prejudice the interests protected by sections 27-29.

The Department said allowing the complainant to view the footage at its premises was sufficient to satisfy his right to access the footage it held about him, and in any case it considered it had good grounds to withhold the footage.

For it to be acceptable for an agency to satisfy a principle 6 request by providing the information in another form, we must be satisfied that providing the information in the form requested would meet an exception in section 42(2).

In this case, the Department said providing a copy of the footage would be too difficult because it did not have sufficient capability to edit the footage, and if the footage was not edited, then releasing it would prejudice interests protected by sections 27(1)(c) and 29(1)(a).

We were not satisfied that it would be administratively onerous to edit the footage to mask the identities of other individuals. Therefore, the Department did not have a good reason not to give the complainant a copy, as he had requested. We also formed a view the Department should provide an edited copy of footage requested by the complainant.

In addition, allowing the complainant to view the footage on the Department’s premises raised other difficulties for the complainant in view of his ongoing assault-related health issues.

Principle 5

Principle 5 requires an agency holding personal information to ensure that information is protected by such security safeguards as are reasonable in the circumstances to prevent the loss, misuse, or disclosure of personal information.

In this case, there was evidence that immediately following the incident, Serco saved footage from a number of CCTV cameras operating in the vicinity of the assault. Serco provided most of that footage to Police so they could investigate and prosecute the assailant.

Sometime after the assault at Mt Eden Corrections Facility, some footage from a camera was deleted and footage from another camera also appears to have been lost.

The Department provided us with a copy of its information retention and management policy. That policy clearly stated that when a serious incident occurs, the Department must gather and retain all information relevant to the incident.

The Commissioner considered that the Department had failed to keep information safe and prevent against its loss, and that the policy designed to protect particular information was not followed. The Commissioner formed a view that the Department had breached principle 5 of the Privacy Act.

Resolution

Our Office attempted to resolve this complaint by suggesting that the information could be released to the complainant’s lawyer, or directly to the Legal Services Commissioner, to assist with their consideration of the application for legal aid. The Department was not satisfied that releasing the information to those agencies would negate its concerns about the security risks posed by releasing the footage.

Conclusion

The Privacy Commissioner’s final opinion was that the Department had interfered with the complainant’s privacy by:

• refusing to provide him with a copy of footage which showed him immediately before, during, and after the assault on him;
• deleting footage from a second camera which also recorded the assault on the complainant; and
• deleting or losing footage which showed the complainant being removed on an  ambulance stretcher.

As we were unable to resolve this matter, the Commissioner decided to refer this complaint to the Director of Human Rights Proceedings.

This case raised important matters which require public discussion. It is important for agencies deploying surveillance technology to consider in advance the implications of that technology, such as how they will store and secure the information, and how they will meet legitimate requests by the individuals for access to that information.

The footage has subsequently been provided to the complainant by the New Zealand Police who had a copy of the footage following the police investigation.

The Department has now agreed to modify its position to take a case by case approach to any future requests for CCTV footage.

December 2016

Corrections -  harm - access - CCTV - deletion - interference with privacy - Privacy Act 1993; section 27(1)(c), section 29(1)(a), section 42(2), principle 5, principle 6