Kia ora koutou,

In my 30 Sept. 2022 Notes from the APAC Region, I discussed the joint inquiry by the privacy commissioner and the Independent Police Conduct Authority into police conduct when photographing members of the public. The inquiry report was highly critical of police practice, finding there was a general lack of awareness among police officers of their obligations under the Privacy Act, which resulted in the unlawful collection and retention of fingerprints and photographs of young and often vulnerable Māori. The report also found police could not rely on consent to collect personal information in ways that would otherwise be unlawful or unnecessary.

Police privacy conduct has again come under scrutiny, this time in a landmark decision from the NZ Court of Appeal relating to police photography during a random traffic stop. The decision related to an appeal against conviction. While the appeal was dismissed, the court discussed a range of privacy law, including the Privacy Act 2020 and the New Zealand Bill of Rights Act 1990, which includes protection of a person's "reasonable expectation of privacy" under the right to be free from unreasonable search and seizure (Section 21 of NZ BoRA).

The appellant had been convicted of aggravated robbery. The police identified the appellant by cross-referencing CCTV footage with close-up photographs taken of him prior to his arrest, when the vehicle he was traveling in was involved in a random traffic stop. The car was impounded and while the occupants were waiting on the side of the road, the police took photographs of the appellant, one of which was attached to an intelligence note on the police’s system.

The appellant claimed the taking and retention of the photographs breached his right to be secure against unreasonable search and seizure under Section 21 of the NZBoRA, and the photographs should not have been admitted as evidence against him. The court held that the appellant had a reasonable expectation of privacy in the circumstances. The police had taken his photograph simply on the basis that it might be useful in the future; they were not at the time investigating the possibility the appellant had committed any particular offense. The court found that by taking the appellant’s photograph without legal authorization, the police's actions were unreasonable for the purposes of Section 21 of the NZBoRA. However, the photographs were still admissible as evidence against the appellant because the intrusion was not very serious, and the evidence was real and important.

What was particularly interesting in this case was the court's consideration of the Privacy Act's information privacy principles in paragraphs [78] to [83]. Noting the joint report from the privacy commissioner and Independent Police Conduct Authority had emphasized the need for police to comply with the IPPs when taking photographs outside the specific authority contained in other statutes (such as the Search and Surveillance Act 2012), the court held the IPPs must be relevant to the judgment of a court considering what reasonable expectation of privacy ought to encompass in accordance with modern societal expectations. The court noted that IPP 1 (purpose of collection), IPP 3 (transparency) and IPP 9 (retention) were particularly relevant in this case and stood against the "casual taking and retention of photographs on the basis that, some day, they might be useful."

As well as reinforcing the importance and relevance of the IPPs, this case is a helpful reminder for privacy professionals — and organizations — of the fundamental principle of data minimization. It's also an excellent segue to our next virtual KnowledgeNet session 6 June, in which former Chief Archivist for Archives NZ Stephen Clarke, will discuss data retention and disposal policy. We hope to see many of you there.

In the meantime, enjoy the digest, stay safe and be kind.