Responding to requests to access to CCTV Footage
How should you respond to requests for access to closed circuit television footage?
The use of Closed Circuit Television (CCTV) is becoming widespread. This includes use by government departments, agencies and councils.
We have noticed an increasing number of requests to such bodies for access to CCTV footage. How should you respond to such requests for access? This article looks at this question, which involves a consideration of privacy and freedom of information (FOI) laws.
Nature of the information
If CCTV footage is of sufficient quality, it is likely that a person with the necessary knowledge will be able to reasonably ascertain the identity of an individual from the footage.
The footage may also reveal information about an individual, for example, that they were present in a particular location at that time.
Accordingly, it would be 'personal information' under relevant privacy laws and 'information about the personal affairs of any person' under FOI laws.
There have been cases that have considered the privacy implications of CCTV systems.
- in Victoria, the Victorian Civil and Administrative Tribunal (VCAT) held that a school's CCTV system and use of its CCTV footage was not in breach of the Information Privacy Act 2000 (Vic), but
- in New South Wales, the Administrative Decisions Tribunal found that a council had breached the Privacy and Personal Information Protection Act 1998 (NSW) through its operation of CCTV cameras, which led to legislative reform.
From a privacy perspective, disclosure of CCTV footage is governed by the 'Use and Disclosure' Privacy Principle. So, whether or not CCTV footage may be disclosed needs to be assessed in accordance with that principle.
For example, in the Victorian privacy case, it was held that accessing CCTV footage from a computer classroom to assess the applicant's teaching and classroom management was permissible. This was because it was 'related' to the primary purpose for which the personal information was collected (e.g. student misbehaviour and inappropriate conduct) and should have been 'reasonably expected' given the inextricable link between inappropriate behaviour by students and the quality of teachers' management of that behaviour.
If you are going to disclose CCTV footage outside of an FOI request, you need to ensure that it is permitted by the privacy laws. All of the circumstances will need to be considered, including the person or organisation who is making the request for access.
Generally speaking, relevant privacy laws permit the disclosure of personal information to law enforcement agencies, like the Police, if it is reasonably necessary for a law enforcement activity.
Each request must be assessed on a case-by-case basis. Records need to be kept of requests for, and provision of, CCTV footage. Where footage is provided on a regular basis, it is worth considering developing an agreement that sets out how both agencies will meet their privacy obligations.
Another example is where an agency receives a subpoena or other court order to produce CCTV footage. In these circumstances, the agency must generally comply with the subpoena or court order. This will not breach the relevant privacy laws as it is a disclosure that is required or authorised by law.
Access under FOI
Where a request is made by someone other than the Police or another government body or pursuant to a subpoena or court order, the usual course is to consider the request in accordance with the relevant FOI laws of the jurisdiction.
If an individual requests access to CCTV footage, and the footage shows only that individual, you may be able to release the footage administratively.
However, if there are other identifiable people in the footage, it may not be possible to release the information administratively unless the footage can be securely redacted to remove personal information and you are willing to do this at the outset. More commonly, a formal FOI application will be required.
From an FOI perspective, the issues that arise are whether the CCTV footage is exempt for being an unreasonable disclosure of an individual's personal affairs information and, if so, whether it is possible to give access to an edited copy of the footage with the exempt matter deleted (e.g. identities obscured through pixilation).
These issues have been considered in a number of cases.
There have been a number of cases before VCAT that have considered the release of CCTV or video footage. In some, the footage has been released, while in others it has not. This demonstrates how each case needs to be considered on its own facts.
- in Brygel v Victoria Police  VCAT 1199, the applicant sought CCTV footage from two security cameras that showed him being escorted from a building by two security guards. VCAT determined that it would be unreasonable to disclose this footage, noting in particular how the people in the footage had objected to its release because they were concerned with the applicant's behaviour.
- in Horrocks v Department of Justice  VCAT 241, the applicant, a long term prisoner, sought CCTV footage of an assault on him by prison security officers from a camera in a prison cell placed for prisoner welfare and security purposes. He sought the footage for the purposes of obtaining legal advice with a view to commencing civil proceedings. The footage disclosed images of the applicant and prison staff, including prison security officers and medical staff. VCAT noted that there were considerations for and against release. For example, the applicant had a legitimate interest in the footage and there was no specific basis for the prison officer's fearing physical retribution from the applicant or others following release of the information. However, its release would make available without restriction a permanent record of the image and identity of prison officers. Accordingly, VCAT determined that its disclosure would be unreasonable.
- in Katz v Victoria Police  VCAT 2046, VCAT granted access to CCTV footage from Caulfield Racecourse that had been sought by a person who was considering taking civil action against Victoria Police. VCAT found that the CCTV footage disclosed the appearance of the people who appeared in it, as well as their location at the time the footage was taken and, as such, where they were employed. As a result, it was considered to disclose personal affairs information. However, VCAT did not regard such disclosure as being unreasonable in the circumstances. VCAT accepted the applicant's interest was a valid one that would be used for that purpose and not more widely distributed.
In the case of Katz v Victoria Police, Deputy President Lambrick observed that:
The use of CCTV recording has escalated rapidly in recent years. There is now a real likelihood that any member of the public may be captured on CCTV footage as he/she goes about his/her daily activities. There is also then the real possibility that such footage may, in certain circumstances, become public. The release may come about through a myriad of means, not confined to requests for information under the [FOI] Act.
This does not mean that all CCTV footage will, or should be, released to the world at large without good reason. The release of a person's image will in some circumstances amount to an evident intrusion into their personal privacy. In such circumstances, the exemption may readily apply. Each case must however be examined on its own merits.
Three more relevant cases were determined this year, namely Willner v Department of Economic Development, Jobs, Training, Resources  VCAT 669 (May), Tsamis v Victoria Police  VCAT 1080 (July) and Willner v City of Port Phillip [VCAT No. Z5/2015] (August).
In the case of Willner v Department of Economic Development, Jobs, Training, Resources, VCAT refused to grant access to 24 hours of CCTV footage from a train carriage that had been sought for the purposes of using it in a public artistic exhibition.
VCAT emphasised a number of concerns associated with releasing CCTV footage showing members of the public, even though the people were aware of the operation of a surveillance camera. Amongst others, these concerns included that:
- the public display of such images might be embarrassing or very harmful to the individuals concerned
- the individuals featured on the footage are entitled to believe that they are being filmed for the purpose of surveillance and detecting wrongdoing and would have no expectation that the footage would be made public; in fact, in his view, their expectation would be that it would not be made public
- the individuals featured on the footage have not consented to the public display of their images
- it would be a 'serious matter' to release the images in circumstances where it was not possible to notify each or possibly any of the individuals featured on the footage.
Given this conclusion, VCAT then went on to consider whether it was 'practicable' for the Department to give access to an edited copy of footage. This did not mean that, because the task of deletion could be done, that it followed that it must be done. It was relevant to consider the ease of undertaking the deletions and the efficacy of the outcome. VCAT found that requiring a small team responsible for maintaining the CCTV footage to identify and edit 24-hours of CCTV footage (so as to pixilate images for privacy concerns) would unreasonably divert the team’s resources. Senior Member Davis stated that he did not believe the taxpayer should have the burden of having this done. He also stated that it was difficult to understand how pixelated CCTV footage could be in the interest of art or those visiting the applicant’s exhibition.
We understand that the applicant, Mr Willner, has sought to appeal this decision to the Supreme Court of Victoria.
In Tsamis v Victoria Police, VCAT granted access to five minutes of video footage taken inside a nightclub by Victoria Police. The nightclub owner sought the footage as she was considering taking defamation proceedings against the Police as a result of their conduct. The footage contained images of patrons drinking, dancing and smoking but no evidence of any offending (such as drug dealing). In reaching its decision, VCAT noted how the Police had not concealed the filming, that the footage was innocuous, the applicant's interest in the footage and that it would not be released publicly or to inappropriately pursue patrons.
In the second case involving Mr Willner, Willner v City of Port Phillip, VCAT refused to grant access to 24 hours of CCTV footage from an external camera located at the St Kilda Town Hall, which had again been sought for the purposes of using it in a public artistic exhibition. We appeared for the respondent council in this matter.
In finding the footage exempt, VCAT noted that the factors supporting exemption outweighed those not supporting exemption, giving VCAT a high degree of confidence that disclosure would involve the unreasonable disclosure of information relating to the personal affairs of the persons whose images appear in the footage. In particular, VCAT noted that the footage was obtained in confidence for security related purposes, it was not available to the public, it was likely that the majority of people would object, and it was unlikely that the applicant would achieve his objectives.
VCAT then went on to consider whether it was practicable to release a version editing out identifying material. It decided that it was not, given the cost burden on the council’s ratepayers.
In the Commonwealth space, a relevant case is that of 'BZ' and Department of Immigration and Border Protection  AICmr 55.
In this case, the applicant's representative applied to the Department for access to all video footage of the applicant at Villawood Detention Centre.
The Department granted access to video footage that depicted an incident in which the applicant was physically restrained by a detention centre employee. The Department decided to allow the applicant's representative to view the footage. It said this was appropriate, rather than providing a copy of it, as it contained the personal information of a third party and this ensured the Department maintained control of it.
The applicant's representative viewed the footage and then claimed that the third party was 'barely identifiable' and that 'measures could be taken to protect his privacy other than the refusal to grant full access, such as a blurring of his face to further de-identify him'.
The Commonwealth Freedom of Information Commissioner (FOIC) reviewed the matter and set aside the Department's decision.
The FOIC agreed that the disclosure of the footage would involve the unreasonable disclosure of a third party's personal information and that giving the applicant access would, on balance, be contrary to the public interest. So, the footage was properly to be regarded as exempt.
However, the FOIC found that it would be reasonably practicable for the Department to give the applicant an edited copy of the footage with the exempt matter (the personal information of the third party) deleted.
The Office of the Australian Information Commissioner (OAIC) had asked the Department to consider blurring or otherwise obscuring the face of the third party in the footage. The Department resisted on the basis that there was 'likely to be a significant amount of work involved to ensure that footage would be blurred in such a manner that the Department could provide a copy externally’. The Department advised that the cost for editing seven minutes and one second of the footage was $3,789, based on $9 per edited second of vision.
The OAIC did not accept this cost estimate on its face. Instead, the OAIC prepared an edited copy of the footage itself in which the third party’s face was obscured. This was achieved in-house, in under an hour, using software that cost less than $100 per user.
The FOIC viewed the OAIC-edited footage, and considered that it adequately obscured the face of the third party so that he was not reasonably identifiable in the edited footage. As a result, the FOIC did not accept the Department’s submissions that editing the footage would be costly and onerous.
The FOIC noted that there was no need for the Department to edit the footage itself. The Department could simply provide the footage edited by the OAIC.
CCTV systems will no doubt continue to be used as a means for security and crime-prevention and detection purposes.
If you receive a request for access to CCTV footage, relevant issues to consider include:
- what is captured by the CCTV footage? Specifically, does it identify individuals? Does it disclose any other kind of personal information?
- who is requesting access to the footage (e.g. the Police or an individual)?
- can you deal with the request informally or should you require an FOI request be submitted?
- can you consult with people identified in the footage?
- is disclosure of the footage unreasonable in all of the circumstances? For example, for what purpose is it sought? Will it be made publicly available?
- can/should you edit the footage (e.g. pixelate images to address privacy concerns)? What time/cost is involved?
- do you have a policy that deals with access to the footage? If so, what does it say?
- If CCTV has been installed for security purposes but is being sought for other purposes, then it may be appropriate to refuse access under FOI. This is so unless it is practicable to edit the footage so that people are de-identified (e.g. pixilate images).
 See Gloria Ng v Department of Education  VCAT 1054.
 See SF v Shoalhaven City Council  NSWADT 94 and the Privacy and Personal Information Protection Amendment (CCTV) Regulation 2013.
 For example, this could be a Memorandum of Understanding. In Victoria, it could be an Information Usage Arrangement under the Privacy and Data Protection Act 2014 (Vic).
 See Re Schubert and Department of Premier and Cabinet (2001) 19 VAR 35 and Vaughan v Department of Sustainability and Environment  21 VAR 307.
 See Honeywood v Department of Human Services  VCAT 2048.
 The task was estimated to take between 80 and 90 hours.
Managing climate change-related risks in the financial system
By Patrick Ibbotson & Jessica Dorricott
Risks posed by climate change to the stability of the US financial system.
GDPR decision slaps down Privacy Shield and imposes strict conditions on Standard Contractual Clauses – implications for Australian organisations
Impacts for Australian entities who are either directly subject to the GDPR or receiving personal data from the EEA.
What is in a name? The disclosure of public servants’ names and contact details under FOI
The OAIC has issued a position paper on the disclosure of public servants’ names and contact details in documents.