Office of the Privacy Commissioner | Police well on the way to compliance; one critical step remains
Police have completed all but one of the original requirements that were set out in a Compliance Notice issued by OPC in December 2021.
The notice was issued to require Police to stop unlawfully collecting photographs and biometric prints from members of the public, particularly young people, and to delete unlawfully collected material stored on their systems, including mobile phones.
Privacy Commissioner Michael Webster says, “I’d like to acknowledge the significant work Police has done in the past two years to complete most of the notice requirements.
“I know from their regular reporting that they’ve improved training and now have procedures and policies that help officers understand how sensitive these photos are.
“I’ve seen that they also know they need to have a clear lawful purpose and rationale to take and retain them and have put guardrails in place to help frontline officers make good decisions about what they collect in real-time.” says the Commissioner. These steps should help ensure that unlawful collection no longer occurs.
However, ensuring that photos and biometric prints are collected lawfully was not the only focus of the Compliance Notice. Police were also required to find and delete all unlawfully collected material currently stored on their systems. This final important requirement is proving difficult to achieve in practice given the scale and organisation of Police’s information collections. “As a result, we have granted the Police an extension until June 2025 to complete the critical task of finding and deleting unlawfully collected images,” says Mr Webster.
A key problem is that many images have historically been stored on Police systems without the labels that would allow them to be searched automatically. In these cases, Police can’t tell what an image is of without opening each image file manually, and unless key information has been recorded with the photo it may be difficult know the purpose and rationale for collecting and retaining it.
It’s like going to the pantry and realising that all the labels and use-by dates have been taken off the cans of food. You can’t tell what something is until you open it and even then, you may not be able to tell if it is safe to use.
“I am concerned that the current state of Police’s information management systems and the extremely large number of stored images make it very hard to find and delete images in a practical way,” said Mr Webster.
"These same issues may make it difficult for Police to find and use the information they have collected and retained to fight crime and keep communities safe.”
“The development and implementation of a digital evidence management system was presented to us as a potential solution to these issues. We are concerned that investment in such a system has not proceeded. Had they had that, Police could have stored and identified photos and linked them to specific cases, which would have also meant staff would have documented the lawful purpose for taking the photo.”
“I am encouraged that Police are continuing to look for solutions to these challenging issues. Resolving them will be fundamental to public trust and confidence in Police use of personal information and their ability to turn it into actionable intelligence that helps keep communities safer,” said Mr Webster
About the Compliance Notice to Police
The December 2021 Compliance Notice was the result of a joint Inquiry by OPC and the Independent Police Complaints Authority into the police practice of taking, using, and retaining photos when they didn’t have a lawful purpose for doing so.
The Inquiry found that thousands of photographs of members of the public have been kept on the mobile phones of individual officers or, if transferred to the Police computer system, not destroyed when there is no longer a legitimate need for them.