A joint inquiry last month told police to set up audits and time limits for deletions of the unlawful images. File image Photo: Richard Tindiller
Police will be monitored to ensure they are deleting unlawfully taken photos of people from their powerful new image processing system.
A joint inquiry released in September found "systemic" flaws with the photo-taking.
But it did not explicitly look at the system called ABIS 2, which has been newly upgraded for more than $23m to run more facial recognition and to hold thousands more photos.
The inquiry established police were storing tens if not hundreds of thousands of photos across a half dozen systems, instead of only in the far more controlled National Intelligence Application.
The Office of the Privacy Commissioner (OPC) said its deletion notice covered ABIS 2, and the IMS Photo Manager system alongside it.
"OPC will be monitoring police compliance with this requirement."
ABIS 2 is used for facial recognition, but police have repeatedly said they do not use it on live CCTV feeds.
Under sustained pressure over where the photos of rangatahi police had been taking for years were stored, and whether they were being put through facial recognition, Police Commissioner Andrew Coster last year asserted: "That technology is used for identifying suspects of offences, it is not used randomly on young people."
Police Commissioner Andrew Coster. Photo: RNZ/ Samuel Rillstone
Police have to report back quarterly to the OPC on deleting the photos and they face deadlines for strengthening their controls.
So far, they have deleted about 11,000 files and are now checking back through individual officers' smartphones, their primary on-duty tool.
Biometric systems like ABIS 2 offered many benefits but also risks "relating to surveillance and profiling, lack of transparency and control, and accuracy, bias and discrimination", the OPC said in a statement to RNZ.
Asked why the public should trust police to delete all the images they should, the OPC said it would not stop at that.
A key finding of the photos inquiry was police did not have routine review or audit processes, it said.
"This meant that it was impossible to identify how many copies of an image were maintained across multiple systems."
A result is that images of regular people of no crime-fighting use have been retained indefinitely.
The inquiry told police to set up audits and time limits for deletions.
The OPC told RNZ it would also set up its own compliance and monitoring strategy of police.
The police annual review to mid-2022 shows the second phase of ABIS 2's upgrade, worth $2.4m, was delayed due to problems around technical infrastructure and resources, and Covid-19.
A privacy impact assessment in 2020 - well after police had already signed up with a US firm to run ABIS 2 - said the public must be kept in the loop on how the image system is used.
It is meant to have only three uses: To identify a suspect in a crime, locate better images of a lost or missing person, or to establish the identity of someone who has died.
The assessment warned it could be abused without careful oversight, and if access was not tightly controlled.
By contrast with tight access, another of the police's privacy-impinging systems - the camera networks that can read number plates - is accessible to 6000 officers via two apps on their smartphones.
Police in their 2022 technology capabilities list said ABIS 2 "cannot be used for facial recognition of live streaming or within a public-facing context" - meaning they used it only to search their own databases of still photos.
Internal documents from several years ago suggest police foresaw adding many thousands more photos.
The reach of cameras, too, is growing apace. The latest can see inside vehicles and supply identifiable images of occupants - NZTA has been trialling such cameras, while blanking out faces.
The OPC is in the middle of asking people for feedback on biometrics, and said one result might be a code of practice with the force of law.