The system in Australia and New Zealand links thousands of cameras in an automated number plate recognition (ANPR) network. Photo: RNZ / Cole Eastham-Farrelly
A camera system for tracking vehicles used by police in New Zealand thousands of times a month has been suspended by police in Australia.
The Australian Federal Police (AFP) had been letting more than 100 staff use the system despite not doing a privacy assessment, media reports said.
The system links thousands of cameras in an automated number plate recognition (ANPR) web run by Auckland company Auror, aimed at combating retail crime.
New Zealand Police run a third of a million checks a year on the system, and more than 6000 staff can access it. They have done their own privacy impact assessment.
Police were also forced to do an audit earlier this year after admitting to twice tracking cars, in 2020 and 2021, when they should not have.
The audit found a very few instances of misuse by staff.
"Following this work we have made significant progress to further strengthen our controls, update relevant policies, and undertake regular auditing for use of this type of technology, so we do not currently have plans to suspend our use of Auror," Assistant Commissioner Mike Johnson told RNZ in a statement last week.
In Australia, it was reported AFP staff began using Auror before police leadership became aware of it, and without any formal partnership. Auror told RNZ formal partnership agreements were not required "given the platform's well-established safeguards".
"Only approved police members can be added to the platform," it said, though adding most state police forces did have a formal partnership agreement.
"The platform enhances police's privacy practices. If AFP wants to review their internal processes, we're happy for them to do so," the company said in a statement.
Johnson said local police would consider the findings of the AFP's assessment once it was completed.
"New Zealand Police has been working closely with Auror and the Privacy Commissioner around the safe use of this technology," he said.
The Privacy Foundation called for the police to think again.
"I am pleased the ad hoc, ill-considered use by Australian Federal Police of systems such as Auror has been suspended," spokesperson Gehan Gunasekara said. "I hope the NZ Police will take heed and follow suit."
ANPR systems could too easily morph into mass surveillance "as and when needed by police", he said, and it was crucial to know who was accountable for misuse - police or Auror.
"I would argue both ... under our Privacy Act there may be liability all-round," Gunasekara said.
Auror's website trumpets deployment by police forces in New Zealand, Australia and the US.
Emails within the AFP, displayed by news website Crikey, had the subject line: "Get started on Auror!" In South Australia, Auror said, a small retail crime team had made 489 arrests helped by its cameras.
In New Zealand, it had helped in laying 1000 charges against 178 people by the six-strong National Retail Investigation Support Unit set up last year, Auror said.
The Office of the Privacy Commissioner called ANPR "a powerful surveillance and intelligence tool" and a "high-risk" technology.
"The Australian experience reported here seems to indicate a privacy assessment had not been finalised," it told RNZ in a statement.
It had advised police in New Zealand about the commissioner's "clear expectations about how the police will use this technology", to collect personal information "in a way that has a clear, legal purpose and is proportionate".
"Access safeguards, audit processes and employee training are key."
NZ privacy impact assessment findings
The privacy impact assessment focused on police needing to introduce rigorous controls "that identify and prevent inappropriate behaviour before access occurs, as well as post-event audits".
The assessment was completed in April 2023, when police had routinely been accessing the cameras thousands of times a month.
Previously police had released only the front pages of the assessment, but now the whole [https://www.police.govt.nz/sites/default/files/publications/privacy-impact-assessment-police-use-anpr-platforms-simply-privacy.pdf 42-page document is on its website.
"ANPR data provides a significant record of a vehicle's - and by extension the owner/driver's - whereabouts at a given time or over time," the assessment stated.
Police had to "minimise the risks of unnecessary collection of personal information".
This was most important when the cameras were used to actually track a vehicle in real-time, as opposed to their much more common uses of flagging shoplifters' cars to retailers, raising immediate alerts about stolen cars, or letting police look through recorded footage to spot vehicles as part of investigations, it said.
Tracking requires a warrant, the other uses do not.
As so often with technology, ANPR's effectiveness is enhanced by data access 'creep'.
The police compare the footage with Waka Kotahi's vehicle and driver registers.
"Police therefore have access to a range of data sources that in various combinations provide information that is demonstrably information about individuals."
The assessment - echoing Gunasekara - said police and Auror were both liable to make sure ANPR's use was legal.
ANPR is controversial globally. Seventeen US states had laws expressly about ANPR prompted by concerns around racial impact bias, mass surveillance, inaccurate results, improper data retention and lack of regulation, the privacy assessment noted.
ANPR was part of a massive web of CCTV cameras in the UK, it said. There, the decade-old office of the Biometrics and Surveillance Camera Commissioner, and the country's Surveillance Camera Code, are poised to be abolished "with no suggestion about what might replace the code of practice, if anything". The Commissioner has accused government agencies of ignoring UK surveillance laws due a "culture of non-deletion".
By contrast, "unlike the US and the UK, New Zealand does not currently have any legislation specifically targeted at CCTV or ANPR usage", the New Zealand police privacy impact assessment said.
"Furthermore, guidelines issued by the Office of the Privacy Commissioner in 2009 entitled Privacy and CCTV: A guide to the Privacy Act for businesses, agencies and organisations do not reference ANPR. Key concerns associated with ANPR in a New Zealand context include mass surveillance and police misuse of ANPR data and systems."