The police are a long way off completing the reforms they started after a damning inquiry into their practice of photographing the public, including children.
The latest quarterly stocktake shows some progress, but at the halfway point there remains a significant amount of work to do ahead of the December 2023 deadline.
Police say they are going as fast as they can.
Earlier this year a joint investigation by two watchdogs found officers were routinely and illegally photographing and filming young people and adults.
The Independent Police Conduct Authority (IPCA) and the Office of the Privacy Commission (OPC) launched their investigation after RNZ reporting which showed the practice appeared to be widespread.
The inquiry found systemic problems with the way police take, store, and use people's private biometric information.
The new update, released earlier this week, shows of the 23 recommendations from the joint inquiry, 21 remain in the earliest stage of completion - and only two have been finished.
Only six of the 14 specific changes required from the OPC enforcement action (more on what that means below) have been completed.
Six are still at the earliest stage of work, while better progress is being made in two areas.
Police remain in the earliest stages of coming up with a consolidated and comprehensive policy for how to lawfully take photographs of the public for intelligence and investigative purposes.
They say they are making changes as quickly as possible but are still considering the broader findings of the joint inquiry, which will have implications for their ability to effectively investigate and prevent crime.
Several areas of progress on compliance notice requirements, but much left to do
The OPC launched enforcement action against the police in December 2021 for breaching privacy obligations relating to some practices.
The action, called a 'compliance notice', requires, among other things, that the police stop unlawfully collecting duplicate photographs and fingerprints from young people on a "voluntary" basis at police stations, and delete unlawfully collected material.
Police said earlier this year they had stopped unlawfully gathering information and were working on destroying records.
The latest update notes progress in several areas, but also a large number of actions that remain at the earliest stage of being reviewed and implemented.
Since October it has completed two requirements related to deleting photographs - it has developed a decision-making framework for how to do this; and has come up with and implemented a regular audit.
It is making strides on identifying and deleting all pictures and fingerprints of young people taken unlawfully.
It is in the the very early stages of progress in other areas.
These include:
- Reviewing policies and procedures for how police collate, store, share and delete photographs and fingerprints of adults.
- Starting talks across departments at police head office about how to collate, store, share and delete photographs. Further talks with front-line officers are planned.
- Only six of the 14 specific changes required from the OPC enforcement action have been completed.
- Six are still at the earliest stage of work, while better progress is being made in two areas.
Progress on other recommendations from the report
Police remain in the early stages of work to:
- Stop taking photos with smartphones of adults in custody, and delete photos taken unlawfully. (Officers have been asked not to take photos with devices which are not connected to its internal system for taking notes on a case - the National Intelligence Application.)
- Develop police-wide, routine and systematic practices for deleting old photos and prints
- Develop and give officers training on privacy issues
The report notes that earlier this year police stopped indiscriminate photography of rangatahi in public.
It has implemented a framework to help officers decide when it can be done lawfully, and when photos need to be deleted.
It is working through storage to identify all non-compliant photos and delete them.
A previous update on progress showed police had deleted 11,000 files of young people.
Police said in a statement that the public could be confident of their commitment to balancing operational requirements with the public's right to privacy.
They said they would continue to work with OPC and the communities they serve.
The intention is to ensure each of the compliance notice requirements are fully completed by December 2023.