Despite a damning investigation, the police have not been given a directive to stop taking photos of adults in public, and they question where the line on unlawful practices has been drawn.
An 18-month-long inquiry by the privacy and police watchdogs, triggered by RNZ reporting, found police for years have been routinely and illegally taking tens of thousands of photos of ordinary New Zealanders.
They have now stopped taking such photos of young people and adults in custody, and deleted 6000 photos, said Police Commissioner Andrew Coster.
But the compliance notice issued nine months ago that forced them to does not cover older adults in public.
"I have not given any fresh direction off the back of the report yesterday because we have to understand it and it's going to take us a little while to do that," Coster told RNZ in an interview on Friday.
"We have complied with the notice issued to us but, as I say, we don't necessarily accept entirely the implications of the report we received."
The investigation found people's biometric images were being captured principally by officers on their smartphones, despite not being linked to any particular investigation, sometimes on a "hunch", or in contravention of the Privacy Act; that the photos have been kept for far too long by police and stored in such a scattered way that investigators were unable to gauge the full extent of the breach.
"The inquiry team heard that these photographs were routinely retained, culminating in some officers reporting they have thousands of images on their phones," it said.
"Officers interviewed by the inquiry team reported that both personal and work-related photographs were kept on the same mobile devices.
"Images include scenes when attending a variety of incidents including vehicular crashes and sudden deaths. There are no apparent guidelines around how long photographs are to be retained on phones or what to do with them."
Findings curb tackling crime - Coster
Coster said the inquiry was already putting a curb on his officers tackling crime, and that photo taking was important to investigations.
Since complying with the OPC notice this year, staff were reporting "significant challenges around detecting and resolving crime, particularly involving young people", he added.
The fact the report exposed how the photos were stored across multiple systems and in masses of smartphones, without categorisation, had not impacted on any investigations, he asserted.
"I'm very confident that staff, where photos are relevant, have been using them for those purposes and attaching them to the relevant cases.
"But we need to automate that.
"As anyone who has an iPhone knows, you get an accumulation of material on it, and it requires the user to get rid of what's no longer required. We need to systematise that, and that's the piece that's presently been missing in our systems."
The Office of the Privacy Commissioner - OPC - issued the compliance notice on police last December.
Asked by RNZ why the notice does not cover photos of adults taken in public - either to stop taking them, or to delete those in police systems - the OPC said it had other priorities early on.
"The compliance notice has a specific focus on the photographing and duplicate fingerprinting of young people, and the use of mobile phones to photograph adults in custody," the OPC said.
Coster said they were fully complying.
Some practices needed to change around some of the circumstances of photo-taking, he said, but added:
"We accept some of that, but there are aspects of it that we don't - because of where the line has been drawn in terms of that threshold for collection for crime prevention, detection purposes."
The report's recommendations posed "quite significant" implications, he said, going on to mention gangs and ram raids.
"And that's where we'll be taking further legal advice."
The report said gang members have been part of the illegal photo capture, but so were many ordinary people stopped by police, such as at checkpoints and traffic stops.
The main union, the Police Association, has said the findings were wrong and officers should carry on taking photos.
Amnesty International said the report raised serious concerns of police profiling young Māori.
Half the photos among tens of thousands in just one database were of Māori or rangatahi, and it was complaints by rangatahi in Wairarapa that exposed the police practices.
The police have been making bimonthly reports back to the Privacy Commissioner about making changes and deleting photos. Neither entity has provided these reports in response to RNZ requests on Thursday.
RNZ has further asked the OPC if it would issue a new compliance notice to put a stop to adult photo collection and storage.
It said no decision had yet been made on further enforcement action.
"It is our expectation that inappropriate collection and retention of photographs of adults will be addressed through the implementation of the inquiry report," Deputy Commissioner Liz MacPherson said in a statement, adding they will be monitoring it.
Anyone with concerns could complain to the OPC or IPCA, she said.
The OPC said that its existing compliance notice already required police to develop photo deletion procedures by the end of 2023, and set up an audit system by the end of this year, which would benefit both young people and adults.
The report found police officers were not aware of their obligations under the Privacy Act in taking photos.
Coster said both that his officers were "generally" compliant with the Act - but also needed more educating.
The report describes how iPhones rapidly became officers' go-to frontline tool after they were issued in 2013.
Nine years on, the report found: "Officers almost universally described a lack of training or guidance focused on when it is lawful and appropriate to photograph or video record members of the public for the purpose of non-crime scene identification."
It found no policy around the iPhones.
The phones link directly to the National Intelligence system - where photos can be put, and which purges them if they are not relevant.
But officers have been circumventing that by not sending pictures through, or keeping duplicate copies on their phones, or putting them in other systems.
"We didn't develop processes," Coster said.
"We've got a lot of work under way to fix that situation."