Administrative Decisions Tribunal New South Wales Medium Neutral Citation: SF v Shoalhaven City Council [2013] NSWADT 94 Hearing dates: 21 May 2012, 20 June 2012 and 9 August 2012 Decision date: 02 May 2013 Jurisdiction: General Division Before: S Montgomery, Judicial Member Decision: 1. The Council is to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice; 2. The Council is to render a written apology to the Applicant for the breaches, and advise him of the steps to be taken by the Council to remove the possibility of similar breaches in the future. Catchwords: Privacy - personal information - information protection principle - Collection - lawful purpose - relevant to purpose - excessive - retention and security - law enforcement purpose Legislation Cited: Administrative Decisions Tribunal Act 1997 Privacy and Personal Information Protection Act 1998 Cases Cited: AF v Minister for Health; Minister for Health v AF [2012] NSWADTAP Department of Education and Communities VK [2011] NSWADTAP 61 GA v Department of Education and Training and NSW Police (No 3) [2005] NSWADT 70 HW v Commissioner of Police, New South Wales Police Service and Anor [2003] NSWADT 214 JD v Department of Health [2005] NSWADTAP 44 at [42] JD v Medical Board (NSW) [2005] NSWADT 247 at [79]. KJ v Wentworth Area Health Service [2004] NSWADT 84 MT v Department of Education & Training [2004] NSWADT 194 SB v Roads & Traffic Authority [2010] NSWADT 255. SF v Shoalhaven City Council [2011] NSWADT 6 ZR v Department of Education and Training (GD) [2010] NSWADTAP 75 Category: Principal judgment Parties: SF (Applicant) Shoalhaven City Council (Respondent) Representation: SF (Applicant in person) C Tipene, Sparke Helmore Lawyers (Respondent) J McAteer, Deputy Privacy Commissioner File Number(s): 113171 reasons for decision 1GENERAL DIVISION (S MONTGOMERY, (JUDICIAL MEMBER)): These proceedings arise from an application for Internal Review under Part 5 of the Privacy and Personal Information Protection Act 1998 ("the PPIP Act") brought by SF ("the Applicant") against the Shoalhaven City Council ("the Council). 2The matter relates to conduct which allegedly contravenes various Information Protection Principles ("IPPs") under the PPIP Act. The 'conduct' occurred on 5 March 2011 and 7 March 2011, when CCTV cameras ("the cameras") installed in the Central Business District of Nowra captured the Applicant's image. 3It is common ground that under a program operated by the Council ("the Council's CCTV program"), the cameras record images and those images are retained on a computer hard drive located at the Nowra Police Station. The cameras and computer equipment is owned and operated by the Council however Police officers at the Nowra Police Station are able to view live feed footage captured from the cameras. The monitor where the live footage is displayed is located in a position where members of the general public cannot view it. 4There are signs indicating the presence of CCTV camera coverage in the area. The signs state that cameras are in operation 24 hours a day, contain the Council logo and a contact phone number for anyone wishing to contact Council for further information. Not all cameras have a sign near them. There have been times when the technical problems have meant that there have been periods when no data was collected at all notwithstanding that the signage states that cameras are in operation 24 hours a day. 5Under an agreement between the NSW Police and the Council, the NSW Police can apply to the Council for copies of the captured images. Evidence was led of nineteen formal requests that have been made under this agreement. 6The Applicant requested that the Council conduct an internal review in relation to the alleged conduct. The Council's internal review was completed in May 2011. In June 2011 the Applicant commenced these proceedings in the Tribunal under section 55(1) of the PPIP Act. 7No criticism can be levelled at the Applicant in regard to the time taken in concluding the matter. He has been pursuing his rights under the PPIP Act since the Council commenced testing the system. In 2009 he brought an application in relation to the same issue: SF v Shoalhaven City Council [2011] NSWADT 6. 8The Applicant requested that the Council carry out an internal review of conduct under the PPIP Act shortly after the Council's CCTV program commenced in 2009. However, the Council refused on the grounds that the cameras had not been activated and no personal information had been acquired. Following further investigations the Council acknowledged that in fact the cameras had been activated when they were functionally tested during two separate periods from 29 October 2009 to 15 December 2009 and 13 January 2010 to 19 January 2010. 9The Council subsequently carried out internal reviews in relation to the conduct. It conceded that it is probable that the cameras captured the Applicant's image at the time they were in operation. However, the Council had disposed of any potential evidence of personal information and so no evidence was available to confirm that this was the case. Similarly, there was no evidence to confirm whether the Applicant was identifiable from any of the data that had been captured. The threshold in section 4 of the PPIP Act was not met and consequently that application was dismissed. 10The present matter came before me for a contested hearing and the hearing extended over three days between May 2012 and August 2012. The Applicant appeared on his own behalf and Ms Tipene appeared on behalf of the Council. The Privacy Commissioner exercised her right of appearance and was represented by Mr McAteer, the Deputy Privacy Commissioner. Following the hearing each of the parties provided detailed written submissions. 11In the current proceedings, a preliminary threshold issue arose in regard to whether there is evidence of personal information for the purposes of section 4 of the PPIP Act. The Applicant relies on images of himself that he obtained from the Council by way of an application under the Government Information (Public Access) Act 2009 ("the GIPA Act"). Much of the material is of such poor quality that the Applicant is not easily recognisable. However, the Applicant is clearly recognisable in other images and I am satisfied that the material satisfies the definition of personal information under the PPIP Act. In this regard, I am satisfied that the preliminary threshold issue has been satisfied. 12A further preliminary issue arose in regard to whether the Council's use of the cameras to record images of members of the public in a public place contravenes section 8 of the PPIP Act i.e. IPP 1. Section 8 provides: 8 Collection of personal information for lawful purposes (1) A public sector agency must not collect personal information unless: (a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and (b) the collection of the information is reasonably necessary for that purpose. (2) A public sector agency must not collect personal information by any unlawful means. 13In regard to the collection of his personal information the Applicant argued that: (a) it is not lawful for the Council to record or retain CCTV images of him in a public place and transfer those CCTV images to Nowra Police Station; (b) the policing and the collection of evidence for prosecuting alleged offenders is a State responsibility and, on that basis, it is not lawful for the Council to have a role in evidence collection by way of the cameras; and (c)in the alternative, if the use of the cameras by the Council is lawful, the recording of images is not directly related to the Council's functions. 14The Council argued that local government authorities, such as the Council, have an express statutory power to develop local crime prevention plans which make provision for crime prevention and open space planning and management. It contends that it is authorised by statute to collect personal information in the implementation of its crime prevention plan, and that use of the cameras is "reasonably necessary" for the effective implementation of the crime prevention plan. 15The Council relies in particular on section 24 of the Local Government Act 1993 ("LG Act") which states: A the Council may provide goods, services and facilities, and carry out activities, appropriate to the current and future needs within its local community and of the wider public, subject to this Act, the regulations and any other law. 16I determined the preliminary issue in the Council's favour. I found that section 24 of the LG Act allows the Council to install and operate CCTV in public places for crime prevention reasons, if the process as outlined in the NSW Government Policy Statement and Guidelines for the Establishment and Implementation of Closed Circuit Television (CCTV) in Public Places (2000) is followed. 17This overcomes the initial privacy threshold issue of whether by doing so the Council has acted in contravention of section 8 of the PPIP Act. 18An issue for determination by the Tribunal is whether the Council's CCTV program achieves its crime prevention objective. I did not find that section 24 of the LG Act allows the Council to install and operate CCTV in public places for law enforcement reasons. 19The question arises as to whether the evidence shows that the Council's CCTV program is 'crime prevention' based or whether in practice the program is more appropriately described as 'law enforcement' in nature. The evidence requires consideration in order to enliven and interpret the meaning of the words in the statutory provisions. 20Once the Council has established the authority to implement CCTV programs, then the other IPPs in the PPIP Act govern the Council's 'conduct' in respect of the personal information aligned with the operation of CCTV systems. Nothing in the lawful basis for the operation of CCTV provides an exemption from those other IPPs. Unlike NSW Police, the Council does not have any broad exemptions from the IPPs. 21The NSW Police are exempt from compliance with any of the IPPs in respect of all their function other than their educative and administrative functions. Arguably, if the NSW Police operated the CCTV system, then the conduct of which the Applicant has complained would be permissible under the PPIP act. 22As Mr McAteer noted, there are also matters relating to consent of not only the Applicant but also other individuals whose personal information is captured in the Council's CCTV program. The broad argument of the Council is that by placing the cameras prominently in the CBD, and by placing signage at the perimeter and within the area where the cameras operate, the consent of members of the public is both sought and obtained. Presumably the granting of consent is based on the continuing presence of the individual persons within the camera scope area. 23The Applicant does not give his consent to be subject to CCTV surveillance, and argued that the process is intrusive and coercive in nature. 24Further, as Mr McAteer noted not all persons give consent (implied, express or otherwise), nor are all persons in a position to provide consent: for example the illiterate, intellectually disabled, minors, etc. 25Further, he submitted that even if someone gives consent on the basis that their images are captured for 'crime prevention' purposes, an issue arises in regard to whether the consent extends to its use for a secondary or different purpose. 26The Applicant contends that it is not lawful for the Council to collect personal information indiscriminately, in circumstances where a very small proportion of the collected information may be of assistance to the Police. 27Further, he alleges various contraventions of the IPPs in sections 9 - 16 of the PPIP Act. Those sections provide: 9 Collection of personal information directly from individual A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless: (a) the individual has authorised collection of the information from someone else, or (b) in the case of information relating to a person who is under the age of 16 years-the information has been provided by a parent or guardian of the person. 10 Requirements when collecting personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following: (a) the fact that the information is being collected, (b) the purposes for which the information is being collected, (c) the intended recipients of the information, (d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided, (e) the existence of any right of access to, and correction of, the information, (f) the name and address of the agency that is collecting the information and the agency that is to hold the information. 11 Other requirements relating to collection of personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that: (a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and (b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. 12 Retention and security of personal information A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information. 13 Information about personal information held by agencies A public sector agency that holds personal information must take such steps as are, in the circumstances, reasonable to enable any person to ascertain: (a) whether the agency holds personal information, and (b) whether the agency holds personal information relating to that person, and (c) if the agency holds personal information relating to that person: (i) the nature of that information, and (ii) the main purposes for which the information is used, and (iii) that person's entitlement to gain access to the information. 14 Access to personal information held by agencies A public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information. 15 Alteration of personal information (1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information: (a) is accurate, and (b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading. (2) If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought. (3) If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the public sector agency. (4) This section, and any provision of a privacy code of practice that relates to the requirements set out in this section, apply to public sector agencies despite section 25 of this Act and section 21 of the State Records Act 1998. (5) The Privacy Commissioner's guidelines under section 36 may make provision for or with respect to requests under this section, including the way in which such a request should be made and the time within which such a request should be dealt with. (6) In this section (and in any other provision of this Act in connection with the operation of this section), public sector agency includes a Minister and a Minister's personal staff. 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 28Section 23 of the PPIP Act provides for an exemption in relation to some of the IPPs. The section provides: 23 Exemptions relating to law enforcement and related matters (1) A law enforcement agency is not required to comply with section 9 if compliance by the agency would prejudice the agency's law enforcement functions. (2) A public sector agency (whether or not a law enforcement agency) is not required to comply with section 9 if the information concerned is collected in connection with proceedings (whether or not actually commenced) before any court or tribunal. (3) A public sector agency (whether or not a law enforcement agency) is not required to comply with section 10 if the information concerned is collected for law enforcement purposes. However, this subsection does not remove any protection provided by any other law in relation to the rights of accused persons or persons suspected of having committed an offence. (4) A public sector agency (whether or not a law enforcement agency) is not required to comply with section 17 if the use of the information concerned for a purpose other than the purpose for which it was collected is reasonably necessary for law enforcement purposes or for the protection of the public revenue. (5) A public sector agency (whether or not a law enforcement agency) is not required to comply with section 18 if the disclosure of the information concerned: (a) is made in connection with proceedings for an offence or for law enforcement purposes (including the exercising of functions under or in connection with the Confiscation of Proceeds of Crime Act 1989 or the Criminal Assets Recovery Act 1990), or (b) is to a law enforcement agency (or such other person or organisation as may be prescribed by the regulations) for the purposes of ascertaining the whereabouts of an individual who has been reported to a police officer as a missing person, or (c) is authorised or required by subpoena or by search warrant or other statutory instrument, or (d) is reasonably necessary: (i) for the protection of the public revenue, or (ii) in order to investigate an offence where there are reasonable grounds to believe that an offence may have been committed. (6) Nothing in subsection (5) requires a public sector agency to disclose personal information to another person or body if the agency is entitled to refuse to disclose the information in the absence of a subpoena, warrant or other lawful requirement. (7) A public sector agency (whether or not a law enforcement agency) is not required to comply with section 19 if the disclosure of the information concerned is reasonably necessary for the purposes of law enforcement in circumstances where there are reasonable grounds to believe that an offence may have been, or may be, committed. The Applicant's case Section 9 29The Applicant alleges that the Council has breached several IPPs in relation to his personal information that was collected and stored under the Council's CCTV program. 30Generally speaking, section 9 of the PPIP Act requires that a public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates. 31The Applicant concedes that the cameras record directly from his image, however he asserts that this does not mean that the Council has complied with section 9. He contends that the placement of the camera between the Council and the personal information collected renders the collection indirect and this can only be overcome with accurate signage that is proximate to each camera; easily viewable by pedestrians and commuters; and indicates the location of the camera. Section 10 32Sections 10 and 11 of the PPIP Act are intended to ensure that individuals know when agencies are collecting information about them, for what purposes and who it will be disclosed to; as well as protecting individuals from irrelevant or excessive collection of information and collection that intrudes unreasonably on the individual's personal affairs. 33A 2011 survey showed that 23% of respondents didn't know of the presence of the cameras. This was after had been given to this issue. The Applicant contends that signs should be placed near or below each camera as recommended by the New South Wales guidelines on the implementation of CCTV in public places. 34Section 23(3) of the PPIP Act provides that a public sector agency is not required to comply with section 10 if the information concerned is collected for law enforcement purposes. Similar exemptions apply in regard to sections 17 and 18 of the PPIP Act. The issue arises as to whether or not the Council is therefore exempt from sections 10, 17 and 18 of the PPIP Act where personal information is recorded on the cameras and disclosed to the Police for law enforcement purposes. 35The Applicant contends that it would be an extraordinary outcome if technology that collects personal information, far less than one per cent of which has any relevance for the purpose claimed, did not have to comply with these IPPs. He submits that such an outcome would provide public sector agencies with a blank cheque to ignore this section by attributing a law enforcement purpose no matter how remote. He submits that as a matter of public policy this should not be seen to be the intent of section 23(3). Section 11 36The Applicant does not contest that the Council has a role to play in crime prevention. However, he disputes that it has a role to play in the investigation of crime and the collection of evidence for the purposes of prosecuting crime. Much of the evidence and argument centred on the issue of whether the Council's CCTV program is 'fit for purpose'. This argument can be aligned to section 11 (a) of the PPIP Act which place an obligation on the Council to take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete. 37The Applicant contends that the Council's CCTV program primarily collects footage and, after the fact, uses it to assist with prosecutions. He submits that this is not an appropriate activity for the Council in terms of best meeting the needs within its local community and the wider public. 38The Applicant relies on his own evidence and that of expert witnesses. He contends that the collection of his personal information is not reasonably necessary for the purpose of assisting with crime prevention. Professor Paul Wilson provided an affidavit and report and oral evidence. The Applicant specifically relies on the research by Professor Wilson showing that public CCTV, particularly in cities and town centres, has a statistically insignificant effect on crime reduction. Professor Wilson's research indicates that the cameras may assist with crime detection as opposed to preventing any type of crime. 39The Applicant contends that the Council's examination of the efficacy of CCTV schemes was based on anecdotes and press releases from Councils such as Toowoomba, which had installed actively monitored CCTV schemes, while failing to examine any council that had installed passively monitored systems or had rejected CCTV, like Wagga Wagga and Albury City Councils. Nor did the Council examine any councils or local government areas where CCTV had not been successful in reducing crime or where displacement was noted. He noted for example that a report from Lismore City Council (Report of the Lismore Safety Camera Taskforce 27/1/97) indicated that specific councils "have not been as successful in deterring crime and have reported a dispersement of crime to other areas." A May 2006 report by Senior Sergeant Simpson Safer by Design Crime Risk Evaluation for Junction Street Mall also indicated those concerns. 40The Applicant contends that the 2010 review of the Council's CCTV program failed to examine the evidence regarding efficacy of cameras in reducing crime. He submits that the Council has not demonstrated that filming people in the Nowra CBD is reasonably necessary to prevent crime. He contends that merely asserting that CCTV is one strategy for dealing with an identified hot spot does not show it is reasonably necessary for that purpose. 41The Applicant relies on concessions made by witnesses for the Council in support of his submission. 42Mr Alan Blackshaw is the Council's Community Development Co-ordinator and is the Council officer who was responsible for the implementation of the Council's CCTV program. The Applicant contends that Mr Blackshaw's Review of the Trial Period 5 Nov. 2010 - 31 Mar. 2011 of Nowra CBD CCTV Project failed to provide any evidence the system was meeting its purpose of assisting with crime prevention. Mr Blackshaw conceded this in his evidence before the Tribunal. The Applicant submits that the only evidence regarding efficacy of the cameras is anecdotal assertions based on feedback from the Police. The survey comparison between 2008 and 2011 is the only piece of primary research dealing with how users of the CBD feel. That survey indicates an increase in the proportion of respondents who felt the streets, where the cameras are located, are not safe during the day or night. 43The Council relies on the evidence given by Sergeant Ian Pitkethly and Inspector Johannes Behrendt of the NSW Police Force. Their evidence is that the Council's CCTV program assists Police with both the detection and prevention of crime. The Applicant contends that their evidence fails to provide any basis for concluding this CCTV system is reasonably necessary for the purposes of crime prevention. 44He says that mere assertion does not constitute evidence and that the cases referred to by the officers demonstrates that the footage is mainly used for identifying overt acts, after the fact, rather than identifying offenders. The Applicant submits that Inspector Behrendt provided only one example out of 25 applications where the victim was identified from the footage, and as his and Sergeant Pitkethly's testimony demonstrates, the offender and victim were well known to the Police. 45The Applicant contends that Mr Blackshaw's reviews include incident data showing crime has increased in the Nowra CBD in 2011 in the categories of assaults, break and enters and malicious damage and decreased in relation to street offences. Despite the increase in crime in the categories identified by the Council, there has been a dramatic decline in 2011 and the first half of 2012 in the number of applications by Shoalhaven Police for Nowra CBD CCTV footage. 46It is not in dispute that the quality of the footage shown at the hearing was very poor. Some aspects of the image are unrecognisable, some are blurred and some frames are omitted. Dr Peter Kovesi, a Research Professor at the University of Western Australia, analysed the Applicant's footage and concluded that it would be impossible to identify any person from that footage. He was of the view that one of the reasons for the poor quality of the footage is the excessive compression. That is, the level of compression that is being applied to the footage is excessive and that is resulting in moving objects on the screen being rendered blurred. 47Dr Kovesi stated that frames being dropped caused jerky motion and jumps in sequences of the footage. He believes that the loss of frames would be due to two things: the wireless transmission equipment having insufficient bandwidth to transmit all of the images at the rate of which they have been generated; and/or the network video recorder not having the capacity to record the images at the rate at which they are being received. 48The Applicant submits that the purpose of the Council's CCTV program is to assist with crime prevention. It does that primarily by allowing Police to view footage after the fact in order to identify persons of interest. Prevention in this case is indirect and the Applicant contends that it can only occur if the risk to offenders of being caught and prosecuted is increased to the extent that they are deterred from engaging in crime in the CBD. He further contends that to achieve this end the standard of accuracy of the CCTV footage must be sufficient to significantly increase the likelihood of the offender being reliably identified. 49The Applicant contends that the Council's CCTV program fails its primary purpose because of the poor quality of the footage. 50He submits that this fact renders identification almost impossible except in those rare cases where the offender is well known and conditions are ideal. He contends that a system where the accuracy of the footage can only identify overt acts such as the crime itself; the way the perpetrator ran; or the sequence of events is not sufficient for the purpose of crime prevention. 51The Applicant says that despite 22 months of operation; intense media scrutiny of the system; and claims of substantial repairs, the footage quality is worse than ever. He submits that poor resolution, high compression and omission of frames render the footage from the Council's CCTV program incomplete, inaccurate and unfit for the purpose intended. 52The Applicant criticised the management of the Council's CCTV program and lead evidence to show that there were issues in relation to every stage of the program. 53He argues that at no time prior to the commissioning of the Council's CCTV program on 5 November 2010 did the Council demonstrate that it was reasonably necessary to prevent crime. The Council did not consider the independent research. Further, the Applicant submitted that the tender process was flawed. 54The Council's Legal Services Co-ordinator Ms Clarinda Campbell gave evidence that the Council received technical advice regarding the specifications and set up of the CCTV system from its communications business unit, Shoalcom, and SME Telecommunications. The Shoalcom staff who provided advice on the technical specifications, set up and installation of the CCTV system included Mr Derek Sheppard and Mr David Warwick. 55The Council also relied on advice provided in a White Paper submitted to the Council by Robert Black, CEO of SME Telecommunications, as part of its successful tender for the Council's CCTV program. 56However, the Applicant asserts that the Council failed to comply with Australian Standards notwithstanding the requirement of adherence in the Council's Tender Specifications. The Applicant relies on the evidence of Dr Kovesi as confirmation that none of the Applicant's footage complies with Australian Standard AS4806.2. 57The Applicant also asserts that the Council did not comply with its own tender specification in relation to the installation of Pan, Tit, Zoom ("PTZ") CCTV cameras - as opposed to a digital zoom camera cameras. 58The advice that the Council received from Mr Black indicated digital zoom was superior. Dr Kovesi's evidence indicates that this is not true. The Applicant asserts that digitally zooming in or out only enlarges or decreases the size of the image using the existing pixel count. To enhance the quality of the image it is necessary to change the focus of the optical lens, thereby reducing temporarily the amount of the streetscape being covered. A remotely controlled PTZ option at the Police monitor would have allowed for this. The cameras are unable to achieve this outcome. 59Further, based on Dr Kovesi's research, the Applicant asserts that the cameras have not been set up to allow for reliable facial identification. He says that this conclusion is also supported by the footage released to him following a GIPA application. All of the images of his vehicle, located approximately 15-20 metres from the camera, are too blurred to allow for identification of the number plate. He submits that Dr Kovesi's evidence makes it clear that to reliably recognise a face it would be necessary to be able to read lettering much smaller than that of a number plate. 60He further submits that it is only possible to ascertain his identity in one image and the one piece of footage that the Council released to him. He stated that in both cases the only camera that is located below the awning took the image. In each case, sufficient resolution to reasonably identify him was not reached until he was within 5 metres of the camera. The Applicant submits that the remaining footage and images confirm the inability of the cameras to obtain footage that is either fit for purpose, accurate or complete. Section 12 61Section 12 of the PPIP Act provides that an agency holding personal information must ensure that it is protected by taking reasonable security safeguards against loss, unauthorised access and misuse. 62The Applicant contends that there are no reasonable safeguards in place to protect the personal information gathered under the Council's CCTV program. He submits that one such safeguard would be a register of authorised users with the name, username and password of each authorised user of the live monitor at Nowra Police Station. The Council's Memorandum of Understanding with Police and the program's Standard Operating Procedures contemplated this. 63However, the Applicant contends that the Register of Authorised Persons does not exist. There is no log for those Police officers that login and out of the system. 64He relies on the evidence of Sergeant Pitkethly to refute the Council's assertion that "at the commencement of their shift, the duty officer enters a user name and password to log into the 'live feed' monitor." Sergeant Pitkethly indicated that often when there is a change of shift the live monitor is already on and continues to be viewed. Even if the new duty officer does log in, it is with a generic password rather than an individual user name and password for each authorised user. The Applicant submits that the failure to have a list of authorised users and a login - logout system means there can be no traceability back to the person viewing the monitor. 65He further submits that general duty Police Officers in the Shoalhaven have received no training in the Council's CCTV program policies and procedures. They are not aware of their duties and obligations with respect to the personal information being viewed on the live monitor or recorded footage applied for and obtained. This opens the Council's CCTV program to misuse, even if inadvertent, and because the system cannot be effectively audited there is no way of identifying and correcting such misuse. 66Accordingly, he submits, as there is no way of checking who is and isn't using the live monitor at the Nowra Police Station, and there is no way of knowing whether those who are accessing the monitor have been appropriately trained, the Council's CCTV program is open to unauthorised access and misuse and therefore fails to comply with section 12(c) of the PPIP Act. Sections 13 and 14 67Section 13 provides that an agency that holds personal information must take such reasonable steps to enable any person to ascertain details in relation to the holding of that information. Section 13 provides that the agency must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information. 68The Applicant contends that he was denied access to the footage from which the snapshots were drawn because they contained the personal information of others and the Council did not have the technology to pixelate the footage. He stated that he was never given the opportunity to pay for the pixilation. He submits that this denial of the footage constitutes a breach of section 13(c)(i) and section 14 because a snapshot was not the personal information that he requested. He argues that the footage contains thousands of frames and that drawing one frame out of these thousands denies him access to the other personal information collected and prevents him from ascertaining the nature of that information. Section 16 69Section 16 provides that an agency must check the accuracy of the personal information before it is used. 70The Applicant contends that the Council has used his personal information by downloading it to a hard drive at Nowra Police Station for the specific purpose of allowing Police to review the footage. He says that the storage of it on the hard drive constitutes a use and that the Council has also disclosed his personal information to Police by forwarding the CCTV images to a live monitor in the Police reception area. 71He submits that this amounts to more than mere retrieval and disclosure because Police use live footage to determine whether crimes are being committed. Police are using their skills and knowledge to view footage for a purpose. 72He contends that the Council has breached section 16 by holding visual images of him and his vehicle on a hard drive at Nowra Police Station and simultaneously disclosing these images to Nowra Police via a live monitor located in the reception area of the Police station. Conclusion and Orders Sought 73The Applicant contends that the Council has recorded, stored and transferred to the NSW Police CCTV footage of the Applicant and other law-abiding citizens while they are going about their lawful business in Nowra CBD. He submits that this footage is irrelevant to the purposes enunciated by Council for collecting it. 74He submits that the Council has exceeded its powers under section 24 of the LG Act by acting as a proxy for the NSW Police in the collection of evidence, something it has neither the resources nor expertise to carry out. 75He further submits that the Council has failed to review a substantial body of independent research which has a direct bearing on the question of whether CCTV cameras in public places, particularly city and town centres, has any effect whatsoever on crime reduction. Further, he submits that the research strongly suggests that CCTV cameras in city centres have no effect on crime. Since Council's primary purpose for introducing these cameras is to assist in the prevention of crime, the research suggests this purpose cannot be fulfilled. 76He further submits that the Council has failed in its duty to assess diligently whether the cameras are fit for purpose. As a result the footage collected by the cameras is of such poor quality that facial recognition is impossible in most cases. Not only are the cameras incapable of doing the job asked of them, the hardware used to transfer/receive the digital data is incapable of handling it, resulting in significant proportions of the footage being omitted. 77The Applicant strongly objects to the State engaging in indiscriminate surveillance of him when he drives or walks about his local shopping centre. He submits that such a database is unnecessary and delivers little or no public benefit. 78The Applicant contends that the Council has breached sections 8, 9, 10, 11, 12(c), 13, 14 and 16 of the PPIP Act. He seeks an order under section 55(2) that the Council turn the cameras off and remove them. The Council's case 79The Council submits that the collection of personal information by way of the cameras is lawful and consistent with its obligations under the PPIP Act. It submits the use of the cameras is entirely consistent, and reasonably necessary, for the exercise of its function to provide crime prevention and community safety services. 80To the extent the personal information recorded by way of the cameras may be used for a law enforcement purpose there is an agreement between the Council and the Police that provides a process for the Police to obtain access to the CCTV images. 81In respect to the effectiveness of the cameras in crime prevention, the Council submits the use of the cameras is part of a larger strategy for crime prevention and that the cameras are effective as part of that crime prevention strategy. 82The Council submits that issues raised by the Applicant in relation to the conduct of the tender process are irrelevant to the Tribunal's consideration of whether the Council's collection and use of the Applicant's personal information comply with the IPPs. Section 9 83The Council submits in circumstances where the Applicant's image is being recorded directly by the CCTV cameras installed, the Applicant's personal information is necessarily being collected directly - as opposed to collection from a third party. It relies on the evidence of Mr Blackshaw that the cameras operate on a 24 hour a day and 7 days a week basis with a movement sensor so that if there is no movement on the observed area no recording will be made. Section 10 84The Council relies on the evidence of Mr Blackshaw in relation to the signage that is in place and says that the signage covers the entire perimeter of the area that comes within the CCTV coverage area. It submits that this signage is reasonable in the circumstances and satisfies the requirements of section 10 of the PPIP Act. 85The Council also relies on the evidence of Mr Blackshaw which sets out other measures the Council has taken, in conjunction with the signage, to ensure people know that their information is being collected and how to access that information including information on the Council's website and the community consultation undertaken by the Council. Section 11 86In respect to section 11 of the PPIP Act, the Council submits that the collection of information from the cameras is directly relevant to the purpose for which the information was collected: to assist with the prevention of crimes against a person and in the prevention of serious criminal offences. 87The Council submits, when considering whether collection is "reasonably necessary", the Tribunal is required to be satisfied that collection of the Applicant's personal information is "something less than essential", giving the words their natural meaning. While the test for determining whether collection is "reasonably necessary" is an objective one, the belief of the agency "as to whether or not the collection is reasonably necessary for the purpose is also relevant": SB v Roads & Traffic Authority [2010] NSWADT 255. 88The Council refers to Professor Wilson's agreement that the effectiveness of CCTV as a crime prevention measure was not settled and that his report did not consider the effectiveness of CCTV as part of a series of crime prevention measures in the prevention or detection in crime. It submits that the recording of an individual's image in a public area does not intrude "to an unreasonable extent" on that individual's personal affairs, for the following reasons: (a) the information is collected for a lawful purpose directly related to the Council's functions to provide crime prevention and public safety; (b) the information is provided to the Police, as a law enforcement agency, solely for the purposes of crime detection and prevention; (c) the cameras record public places (being areas of the Nowra CBD) and specifically public areas identified by the Police as high-crime areas; (d) the Applicant, and other members of the public, are notified at the time their information is being recorded; (e) the recording of the Applicant's image does not affect or restrict his movements or lawful activity in those public places; (f) the Council has consulted with the local community throughout the implementation of the Council's CCTV program; and (g)access to the information recorded is restricted and the proposed use of the CCTV footage is limited 89In support of this submission the Council relies on the evidence of Mr Blackshaw; Ms Campbell; Sergeant Pitkethly and Inspector Behrendt. 90Ms Campbell undertook a Review of the Council's CCTV program. The Council relies on her February 2010 report Review Closed Circuit Television Project Nowra CBD. Ms Campbell evidence is that the Council's audit monitors the effectiveness of the Council's CCTV program with a view to making whatever changes need to be made to ensure that effectiveness. 91Mr Blackshaw's evidence was that the installation of cameras, in areas identified as crime hot spots, is reasonably necessary for the provision of crime prevention activities. His evidence was that the Council's CCTV program is one or a number of crime prevention strategies being carried out by the Council in the Nowra CBD. The Council further submits that use of a camera system is consistent with the Crime Prevention Guidelines developed under the Children (Protection and Parental Responsibility) Act 1997 which encourage Councils to develop evidence based systems for crime prevention. 92Sergeant Pitkethly and Inspector Behrendt both gave evidence that the operation of CCTV cameras generally, and the cameras installed in the Nowra CBD specifically, assist Police with both the detection and prevention of crime. Both gave examples of how footage had been obtained and used by Police to further investigate crimes and relied on in briefs of evidence for the prosecution of those crimes. 93The Council contends that the cameras enable Police to respond to incidents as they are occurring and to monitor trends in behaviour and increase Police presence to anticipate criminal behaviour. 94The Council submits that there is no evidence before the Tribunal of a standard, law or policy, that requires a PTZ camera, as opposed to a digital zoom camera, to be installed for the purposes of undertaking streetscape surveillance. 95In relation to the Australian Standard relied upon by the Applicant and the evidence of Dr Kovesi regarding the level of accuracy required for CCTV images collected for the purpose of facial recognition, the Council notes that the Council's CCTV program is not designed to collect images for the purpose of facial recognition. Rather, it is installed to assist the Council and the Police in the prevention and detection of crime as part of a series of crime prevention measures adopted by the Council in its Crime Prevention Plan. 96The Council relies on the evidence of both Sergeant Pitkethly and Inspector Berhandt that the images recorded by the Council's CCTV program are of sufficient standard to be useful to the Police in the further investigation of crimes and in the prosecution of an alleged offender. 97The Council also submits that the use of the cameras assists with crime prevention, even if the faces of the alleged offenders cannot be identified to a 'facial recognition' standard. It contends that the CCTV system enables the Council and the Police to monitor crowd behaviour and patterns, which assists with crime prevention. 98The Council also points to the evidence of Mr Warwick in relation to the interference with the recording of the Applicant's images and the steps taken by the Council to continue to monitor and remedy that interference. 99His evidence was that the omission of frames occurred in regard to both the retrieved footage and the live footage and that the omissions of frames was caused by frequency interference. The Council's CCTV program uses an unlicensed frequency band and interference results from the fact that there are many other users in the same band. His evidence was that it has been corrected. While he conceded that it is still not perfect he said that it is a lot smoother flowing than what it was before. 100The Council contends that the Applicant's personal information is accurate, when regard is had to the purpose for which the information was collected. 101The Council submits that the benefit of the cameras (being crime prevention and safety) strongly outweighs any disadvantage the Applicant perceives he suffers from the recording of his image in a public space and that any intrusion into the Applicant's personal affairs is reasonable and justified in the circumstances. Section 12 102The Council relies on Mr Blackshaw's evidence in relation to the steps the Council took to ensure reasonable safeguards are in place with respect to the information having regard to the nature of the information, its sensitivity, and the consequences of loss, unauthorised access, use or disclosure. 103The Council submits it has not "used" the Applicant's personal information, other than to respond to the Applicant's GIPA Act request. Determination made by the Application. 104In relation to access to personal information recorded by way of the cameras more generally, the Council relies on Mr Blackshaw's evidence and contends that access is limited to authorised Council staff and contractors for the purposes of responding to requests from the Police for access to certain information for law enforcement purposes or for other lawful purposes. Officers of the Council do not otherwise have access to the information. 105The Council accepts that the Code of Conduct and MOU which set out the protocols for the Police's access to the 'live feed' and procedures for seeking access to the recorded images refer to a 'Register of Authorised Users', and that no such list is in evidence before the Tribunal. However, the Council submits that there is a list of authorised users who are senior Police officers authorised by the Council to seek access to recorded images. 106The Council submits that it has taken steps to ensure reasonable safeguards are in place with respect to the information, having regard to the nature of the information, its sensitivity, and the consequences of loss, unauthorised access, use or disclosure. The Council relies on the evidence of both Mr Sheppard and Mr Blackshaw that only Shoalcom employees can access the recorded image to extract images 107The Council also relies on the evidence of Mr Blackshaw, Sergeant Pitkethly and Inspector Berhandt in relation to the location of the monitors in the Nowra Police Station and notes their evidence about the practice for logging into the live feed to monitor the system. The evidence before the Tribunal confirms that only uniformed Police officers have access to the live feed monitor, which is located so as not to be able to be viewed by members of the public. Requests for access to a recorded image must be made in writing to the Council's Privacy Officer, and an authorised Police officer must sign the request. 108The Council submits that even if the Tribunal considers that the Police have not complied with the procedure set out in the Code of Practice and MOU about access to the live feed monitor, the Tribunal should nevertheless conclude that the Council has developed sufficient safeguards, as are reasonable in the circumstances, to protect the personal information collected. The Council notes that the system automatically deletes all information recorded after a period of 30 days. 109The Council submits this evidence is sufficient for the Tribunal to be satisfied, having regard to the nature of the personal information collected, that the Council has put in place adequate safeguards to ensure the security of the personal information collected. Sections 13, 14 and 15 110The Council submits that the Applicant's request for access to the Images was made by way of an application under the GIPA Act and not the PPIP Act. The GIPA Act provides a forum for the Applicant to seek a review of the form of access in which information is given. On that basis, it says that section 14 of the PPIP Act is not enlivened for the purposes of this Application. 111In the alternative, if the Tribunal considers the Applicant's application extends to access under section 14 of the PPIP Act, the Council contends that the Applicant was provided with access to still copies under the GIPA Act on the basis that the Council determined there to be an overriding public interest against the disclosure of the CCTV images because the images contained the personal information of other persons. The Council accepts that access was not given to the CCTV recordings and relies on Mr Blackshaw's evidence about the technical capacity of the CCTV system to pixelate images recorded and the costs involved in undertaking pixilation. 112Section 15 of the PPIP Act requires a public sector agency to make appropriate amendments to personal information "at the request of the individual". The Council submits that the Applicant has not made a request for amendment to his personal information under section 15 of the PPIP Act and therefore section 15 of the PPIP Act is not enlivened for the purposes of this Application. Section 16 113The Council submits it has not used the Applicant's personal information, other than to review the information and provide the Applicant with copies of the CCTV images in responding to his GIPA Act request. 114The Council relies on Mr Blackshaw's evidence and contends that its role in respect to the personal information recorded on the cameras is to disclose that information to the NSW Police Force in response to a request for access from the Nowra Police Station. The Council does not otherwise "use" the personal information collected. 115The Council submits that its role in respect to the personal information is no more than "mere retrieval" in response to a request from the Nowra Police Station. It submits that "mere retrieval" is not "use" for the purposes of section 16 of the PPIP Act and accordingly, if the Council retrieves information and discloses it to a third party, no use has occurred. 116In support of that submission the Council relies on the decisions in MT v Department of Education & Training [2004] NSWADT 194; JD v Department of Health [2005] NSWADTAP 44 at [42]; and JD v Medical Board (NSW) [2005] NSWADT 247 at [79]. 117On that basis, the Council submits section 16 of the PPIP Act is not enlivened for the purposes of this Application. Conclusion and Orders Sought 118The Council submits that the Tribunal should find as follows: (a) the CCTV images are the Applicant's personal information under section 4(1) of the PPIP Act; (b) the Council's collection of personal information is reasonably necessary for the lawful purpose; (c) the Council's collection, use and disclosure of the information comply with the relevant IPPs; (d) the security measures implemented by the Council to ensure the security of the personal information are appropriate and in accordance with section 12 of the PPIP Act; and/or (e) in the alternative, the Council's collection, use and disclosure of the information to the Police: (1) is exempt from sections 10, 17 and 18 of the PPIP Act under section 23 of the PPIP Act, because it was collected, used and disclosed for law enforcement purposes; and (2)is exempt from sections 18 and 19(1) of the PPIP Act, because non-compliance is reasonably necessary to assist the Police to exercise their investigative functions. The Privacy Commissioner's Submissions 119As noted, Mr McAteer provided written submissions on behalf of the Privacy Commissioner in regard to matters that go to the public interest. 120Mr McAteer observed that it is understandable that, from a privacy perspective, some individuals will have significant concerns about any proposal that introduces surveillance measure to open public spaces. The right of an individual to ingress and egress through an open public place, beyond the realm or reach of scrutinised observation, intrusion, or some other method of observational tracking/recording is considered a fundamental notion of the broad right to privacy. 121However, he submits that the fundamental test from a privacy perspective is that: (a) the 'surveillance' is overt (i.e. the cameras are clear and obvious to all users/occupiers); and (b)meaningful consent is able to be given, be it implied or express. 122He submits that one of the arguments concerning CCTV in public places is that the society needs to examine whether there is a real and necessary need to waive individuals general right to privacy in order to address a competing need. No CCTV should ever be 'covert' unless sanctioned by some lawful instrument such as a warrant under the Surveillance Devices Act 2007. A public sector agency must demonstrate a lawful basis for its installation and use of CCTV in public spaces. 123As noted above, Mr McAteer raised some issues relating to consent. It is not in dispute that the Applicant has asserted that he did not give his consent to the recording of his personal information. The Applicant argues that his liberty and/or freedom has been somewhat curtailed in that he has been required to change his patterns of movement in the Nowra CBD. 124Mr McAteer queries what value can be placed on consent where persons are consenting on the basis that the Council's CCTV program captures their images for 'crime prevention' purposes if the personal information is used for a secondary or different purpose? 125Mr McAteer submits that whilst there is clearly a public interest based purpose for the implementation of the Council's CCTV program and the Council's and the Police's use of the CCTV data, there appears to be a major tension between the stated intentions of the Council's CCTV program and section 11 of the PPIP Act. 126It is common ground that the vast majority of the personal information collected is not used for any law enforcement or crime preventative related purpose ("the collateral information"). It is merely information captured by the nature of the program. 127Mr McAteer submits that the evidence as to whether the system was 'fit for purpose' can only be aligned to section 11 (a) of the PPIP Act. Matters relating to section 11 of the PPIP Act are enlivened due to the collateral information collected by the Council's CCTV program. He says that if the preconditions of section 8 (b) of the PPIP Act are met, in that the collection of the some personal information is reasonably necessary in respect of the Council's CCTV program, then there may still be some work to be done in respect of the requirements under section 11. That is, ensuring that the 'collateral information' is relevant to that purpose, and does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. 128He notes that whilst the Council contends that the scheme is 'pro-active' in its operation and function, the evidence provided to the Tribunal suggest a 'reactive' use, which is more law enforcement than crime prevention in nature. He further submits that it is clear, from a general assessment of the evidence, that the Council's CCTV program was of lesser value than was originally anticipated; was general used re-actively rather than pro-actively; and for the time frames canvassed during the hearing, Police made minimal use of the collected information. 129Police have made nineteen formal requests for copies of the captured images. Sergeant Pitkethly gave evidence that no figures were kept in regard to whether Police had observed an incident from viewing the live feed to the monitors in the Police Station and had attended the incident whilst still in progress as a result of looking at the monitor. 130The vast majority of research data indicates that CCTV does little to prevent crime, however where crime is reported it is useful in making the subsequent investigation more efficient. In this way Police resources may have a higher efficiency, and in some instances it results in certain offenders being prevented from committing further crime during their period of sentence (custodial or conditional) etc. This is the main 'Crime Prevention' product of CCTV. Much CCTV equipment is not really fit for purpose in that the equipment is of poor quality, is faulty, not working, or unable to provide any meaningful data to assist in a general 'law enforcement' context. 131Mr McAteer observed that most use of CCTV is reactive rather than active. The very few active systems are resource intensive, requiring trained operators staffing control rooms with audio links to law enforcement officers. Due to financial and other resource issues, very few 'active' Council run CCTV systems operate in NSW. One example Mr McAteer gave of an 'active' system was in respect of the area surrounding the precincts of the Cabramatta railway Station and street shopping strip mall, in the period from 1997/98 following NSW Police operation 'Puccini'. 132Mr McAteer submits that it could be argued that where there is a proper evidence based demonstration of the need for CCTV in a certain area, the only effective approach is to resource an 'active system' as was the case with Cabramatta. Such an approach maintains an arguable operational link between crime prevention and law enforcement. 133The Council's CCTV program was never contemplated or considered to be an 'active' system. Mr McAteer observed that coupled with this is the need for the system to be of sufficient quality so as to be an effective tool, rather than merely a general surveillance device. 134Mr McAteer also observed that the use of CCTV in public places by public sector agencies requires compliance with the whole suite of the PPIP Act IPPs. This can be onerous for agencies and therefore compliance with the law can be problematic. These obligations and responsibilities need to be properly considered by any agency wishing to install CCTV in public places. However, if an agency has a broad or specific exemption under the PPIP Act, then the above issues may be somewhat less complex for that agency. Consideration 135This matter concerns the Applicant's personal information. I have previously determined that I am satisfied that the Council collected and held the Applicant's personal information for the purposes of this matter. That information was his image captured on cameras operating in the Nowra CBD under the Council's CCTV program. The information was stored on a computer located at the Nowra Police Station. Officers at the Police Station are able to view a live feed of data from the cameras and could have viewed the Applicant's image in that manner. There is no evidence that any Police Officer in fact viewed the Applicant's image. 136The Applicant applied to the Council under the GIPA Act for access to his personal information and was given a copy of some material through that process. 137With the exception of the Council having recovered the Applicant's image for the purposes of responding to the GIPA Act request, and the possibility that live footage of the Applicant was viewed by a Police Officer, there is no evidence to suggest that the Applicant's personal information has been accessed or used in any way. 138As noted, I previously determined that section 24 of the LG Act is broad enough to allow the operation of section 8(1)(a) of the PPIP Act. The lawful basis on which the Council's CCTV program is authorised is 'crime prevention'. It is common ground that the Council does not have a law enforcement role. 139The issue for determination is whether or not the Council has failed to comply with any of the PPIP Act IPPs. 140As noted above, the Applicant raised issues in regard to the conduct of the tender process for which the Council's CCTV program. I agree with the Council's submission that those issues are not relevant to the issue for determination in this matter. Section 9 141The Applicant alleges that the Council has not complied with section 9 of the PPIP Act because the placement of the camera between the Council and the personal information collected renders the collection indirect. I do not agree with that argument. 142The Macquarie Dictionary 3rd edition, The Macquarie Library, defines "collect" as "to gather together; assemble". 143The Council relies on the evidence of Mr Blackshaw that the cameras operate on a 24 hour a day and 7 days a week basis with a movement sensor so that if there is no movement on the observed area no recording will be made. It is not in dispute that the Council has clearly a structure in place for the receipt of that information: see ZR v Department of Education and Training (GD) [2010] NSWADTAP 75 at paragraph [52]. I find, that the Council "collected" or "gathered together" the Applicant's personal information. 144The Macquarie Dictionary defines "directly" as "in a direct line, way, or manner; straight." 145In my view, collection by the placement of the camera between the Council and the personal information collected is collection in a direct line. 146I agree with the Council's submission that in the circumstances where there is no collection from a third party, the Applicant's image is being collected directly. Section 10 147In AF v Minister for Health; Minister for Health v AF [2012] NSWADTAP 16 the Appeal Panel made observation about the equivalent Health Privacy Principle HPP 4 under the Health Records and Information Privacy Act 2002. The observation is equally applicable to section 10 of the PPIP Act. The Appeal Panel noted at paragraph [94]: "The aim of HPP 4 is to ensure that the subject of an information collection is made aware of the implications for their privacy of the collection process, and of any protections that apply prior to or at the time of collection. This is to be done in an accessible way to ensure transparency in the process." 148In KJ v Wentworth Area Health Service [2004] NSWADT 84 at paragraph [36] I stated: 36 The Privacy Commissioner has submitted, and I agree, that the type of personal information at issue is relevant in determining whether an agency has taken such steps as are reasonable in the circumstances to make an individual aware of the matters in section 10. ... 149Section 10 is explicit in regard to the details of which the individual to whom the information relates are to be made aware. In the circumstances of this matter, the Council has collected the Applicant's personal information, and that of other individuals, and provided some signage in an effort to make people aware that images were being collected. I accept that the signage is sufficient to inform a majority of individuals that the cameras are in operation and, by implication, that personal information is being collected. It is not sufficient to inform individuals of the purposes for which the information is being collected. 150Not all cameras have a sign near them. Increased signage would increase the likelihood that more individuals become aware that the cameras are in operation and that personal information is being collected. 151I am not satisfied that the signage is sufficient to ensure that individuals are made aware of all of the information addressed by section 10. 152It seems that the other measures taken by the Council to achieve this objective have had limited success. 153The Council contends that it is exempt from compliance with section 10 of the PPIP Act because section 23(3) of the PPIP Act provides that a public sector agency is not required to comply with section 10 if the information concerned is collected for law enforcement purposes. 154Judicial Member Robinson considered the expression "for law enforcement purposes" in GA v Department of Education and Training and NSW Police (No 3) [2005] NSWADT 70 at paragraph [67] and following: 67 It was submitted by the first respondent that section 23(5)(a) applied to the present. The first respondent was not required to comply with section 18 as the disclosure of the information "concerned" "law enforcement purposes". 68 It was submitted that the law enforcement purpose here was the enforcement of the Police Act 1990. Investigations under Part 8A of the Act might lead the Police Commissioner to take disciplinary action against the two officers who were the subject of the investigation (namely, the two officers who visited the girlfriend at her mother's home and at the applicant's home in November 2000) pursuant to Part 9 Division 1 of the Police Act 1990. In addition, enforcement of the Police Act by way of undertaking of a Part 8A investigation might well lead to the laying of criminal charges against those officers for, for example, neglect of duty pursuant to section 201 of the Police Act. 69 The Tribunal was invited to adopt the meaning of the expression "law enforcement" as determined by the Tribunal in JD v Director General, NSW Department of Health (No.2) [2004] NSWADT 227 at [79]. 70 In that case, the Tribunal was concerned, inter alia, with an alleged contravention of section 18 of the Act. A Departmental investigation report into alleged bad conduct of a medical practitioner involving use of narcotics was delivered to the NSW Medical Board for disciplinary purposes under the Medical Practice Act 1992 (NSW) and for possible breaches of the Poisons and Therapeutic Goods Act 1966 (NSW). The Tribunal held that the section 23(5) exemption did not apply (as the Medical Board was not a "law enforcement agency") and determined the matter by reference to a section 41 direction directed to the agency by the Privacy Commissioner under the Act. Section 41makes provision for the Privacy Commissioner to make, with the approval of the Minister, a written direction that an agency is not required to comply with one or more of the information protection principles set out in sections 8 to 19 of the Act or a privacy code of practice. The particular direction provided, inter alia, for "exchanges of information which are reasonably necessary for law enforcement purposes and are not covered by an exemption in Part 2 Division 3 of the Act [which included section 23(5)]." The Tribunal determined (at [79]): "In my opinion, the term "law enforcement" should be given its ordinary meaning and it should not be narrowly construed. The [FOI] decisions relied on by the Privacy Commissioner are in my opinion of no assistance. I am also of the view that disciplinary action, pursuant to an Act of Parliament, for breaches of professional standards comes within the term "law enforcement"." 71 Notwithstanding the Tribunal was dealing with the expression in a different context, I accept this definition of the expression and I would adopt it and apply it to the provision relied upon by the first respondent, section 23(5)(a) of the Act. 72 In the present case, the Chief Inspector was engaged in an investigation relating to numerous complaints made by the applicant alleging police misconduct and possible contraventions of the disciplinary and, more remotely, the criminal provisions of the Police Act 1990. I accept that the sole purpose of the provision of the Point 4 information by the Principal was in order for the Principal to assist (rightly or wrongly) that inquiry. However, as I have found, the Point 4 information provided was not directly relevant and the Chief Inspector did not rely on it at all. 73 It should be noted that the test in section 23(5)(a) of the Act is directed to the "purpose" of the disclosure. The statutory test is not directed to the quality or relevance of the information. The test is in contrast to other law enforcement tests in the Act, for example in section 23(4) or section 23(5)(d) which rely on a finding based on "reasonably necessary" or "reasonable belief". None of those tests are applicable here. 155The question arises as to whether the section 23(3) exemption applies. The exemption in relation to section 10 applies in circumstances where the information concerned is collected for law enforcement purposes. 156In the circumstances of this matter, Police Officers are able to view a live feed of the images collected from the cameras and an arrangement is place between the Police and the Council whereby an authorised Police Officer may apply for access to particular information. A small proportion of the information is used for law enforcement purposes however that is not the purpose for which it is collected. The information is collected for 'crime prevention' purposes. 157In my view the section 23(3) exemption cannot apply because the Applicant's personal information was not collected for law enforcement purposes. In the circumstances it is also doubtful that the Applicant's personal information was collected for 'crime prevention' purposes given that the Applicant was a private citizen going about his private business in a lawful manner. 158The Council must take such steps as are reasonable in the circumstances to ensure that the Applicant was made aware of the information provided for by section 10. The fact that an individual might take steps to inform themselves of the details does not relieve the Council of the need to comply with section 10. In my view, the signage that is in place and other action taken by the Council has not been sufficient to ensure that individuals are "made aware of the implications for their privacy of the collection process, and of any protections that apply prior to or at the time of collection". 159In my view, the Council has contravened the obligation imposed on it by section 10 of the PPIP Act. Section 11 160As noted above, much of the evidence and argument centred on the issue of whether the Council's CCTV program is 'fit for purpose'. I agree with the submission that this argument is aligned to section 11(a) of the PPIP Act. The Council is to take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete. 161I agree with Mr McAteer's assessment of the evidence as discussed above. 162In my opinion, the vast majority of the information collected under the Council's CCTV program is 'collateral information' and is not relevant to the 'crime prevention' purpose. All of the Applicant's personal information is 'collateral information' and is not relevant to the 'crime prevention' purpose. Further, there is no suggestion that Police made any use of the collected information for law enforcement purposes. 163In my view, the evidence is clear that the images and footage collected in relation to the Applicant are of such poor quality that, in any event, the information would be of little assistance for law enforcement purposes. Because of the poor quality of the footage it cannot be said that the information collected is complete. A high proportion of the frames were omitted giving the false impression that the Applicant was skipping rather than walking. 164The expert evidence suggests that CCTV does little to prevent crime. The data available for the Nowra CBD suggests supports the Applicant's argument that the Council has not demonstrated that filming people in the Nowra CBD is reasonably necessary to prevent crime. In fact, available data suggests that since the Council's CCTV program was implemented crime has increased in the Nowra CBD in the categories of assaults, break and enters and malicious damage. 165It seems to me that, at least at the time the Applicant's personal information was collected, the equipment used in the Council's CCTV program was unable to provide any meaningful data that would be able to assist in a general 'law enforcement' context. 166In my view, the Applicant's personal information that has been collected is not relevant to the purpose of crime prevention, and is excessive, inaccurate and incomplete. In the circumstances, I agree with the Applicant that the Council has not complied with the obligation imposed on it by section 11 of the PPIP Act. Section 12 167Section 12(c) of the PPIP Act provides that an agency holding personal information must ensure that the information is protected by taking reasonable security safeguards against loss, unauthorised access and misuse. 168The Applicant contends that there are no reasonable safeguards in place to protect the personal information gathered under the Council's CCTV program. 169For the most part I disagree with that argument. It is common ground that the collected data is only available to Council staff and Police Officers. In my view, the Council has developed sufficient safeguards, as are reasonable in the circumstances, to protect the personal information collected and are therefore sufficient to meet the requirements of section 12(c). The system as designed requires that the duty officer enter a user name and password at the commencement of their shift, to log into the 'live feed' monitor. However, the evidence suggests that this process has not been followed. 170I agree with the Applicant that the use of a generic password rather than an individual user name and password for each authorised user means that there is no way of checking who is and isn't using the live monitor at the Nowra Police Station. There is no way of knowing whether those who are accessing the monitor have been appropriately trained. Section 12(c) provides that the agency 'must ensure' adequate protection of the collected information. While the system design would achieve this objective, the Council has not monitored compliance with the safeguards that are in place. As a consequence, the Council's CCTV program is open to unauthorised access and misuse and therefore fails to comply with section 12(c) of the PPIP Act. At a minimum, compliance would require appropriate training and monitoring of the use of individual user names and passwords to provide an audit trail of users of the system. Sections 13, 14 and 15 171In HW v Commissioner of Police, New South Wales Police Service and Anor [2003] NSWADT 214 at paragraph [38] the Tribunal's President observed that section 13 has to do with a systemic obligation owed by agencies generally to the community. It is designed to achieve transparency about the personal information an agency holds. 172Section 14 is concerned with allowing individuals to gain access to their personal information that an agency holds. 173As I understand it, the Applicant contends that he was denied access to the footage from which the snapshots were drawn and that by that denial the Council has breached section 13(c)(i) and section 14 of the PPIP Act. 174There is no evidence before me to suggest that the Applicant made his request under the PPIP Act. His application was under the GIPA Act. An access application made under the PPIPA should not yield a different outcome to an application made under the GIPA Act where the facts and circumstances are not materially different. 175Relevantly section 20 (5) of the PIPA Act provides: (5) Without limiting the generality of section 5, the provisions of the Government Information (Public Access) Act 2009 that impose conditions or limitations (however expressed) with respect to any matter referred to in section 13, 14 or 15 are not affected by this Act, and those provisions continue to apply in relation to any such matter as if those provisions were part of this Act. 176Accordingly, I agree with the Council that the issue is not enlivened for the purposes of this Application. 177I also agree with the Council in regard to section 15 of the PPIP Act. There is no evidence before me to suggest that the Applicant made a request for amendment to his personal information under section 15 of the PPIP Act and therefore section 15 of the PPIP Act is not enlivened for the purposes of this Application. Section 16 178Section 16 provides that an agency must check the accuracy of the personal information before it is used. The term "use" refers to "action taken by the agency to use information for its own purposes": see Department of Education and Communities VK [2011] NSWADTAP 61 at paragraphs [20] and [21]. 179The Applicant contends that the Council has used his personal information by live feed to the Nowra Police Station and by downloading it to a hard drive at the Police Station for the specific purpose of allowing Police to review the footage. 180The Council submits it has not used the Applicant's personal information, other than to review the information and provide the Applicant with copies of the CCTV images in responding to his GIPA Act request. 181The Council submits that its role in respect to the personal information is no more than "mere retrieval" and that "mere retrieval" is not "use" for the purposes of section 16 of the PPIP Act. 182I agree with the Council in regard to this alleged breach. This matter is only concerned with the Applicant's personal information. In my view the evidence does not support the Applicant's argument that the Council has used his personal information. On that basis, section 16 of the PPIP Act is not enlivened for the purposes of this Application. 183Similarly there could be no breach of section 17. However, if there was in fact use of the Applicant's personal information, it is my view that there is considerable doubt as to whether the use would have been necessary for law enforcement purposes. 184It is my understanding that the Applicant no longer presses his case in regard to alleged breaches of the disclosure provisions of the PPIP Act. However, I note that it is my view that it is arguably that any disclosure to the Police would have been for law enforcement purposes. Findings 185As I have indicated, I have found that the Council has breached several provisions of the PPIP Act. In my view, the Council has contravened the obligation imposed on it by sections 10, 11(a) and 12(c) of the PPIP Act. 186Section 55 of the PPIP Act sets out the orders that the Tribunal can make in relation to an application for review. Section 55(2) relevantly provides: 55 Review of conduct by Tribunal (1) ... (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (h)such ancillary orders as the Tribunal thinks appropriate. 187The Applicant sought an order under section 55(2) that the Council turn the cameras off and remove them. 188I do not agree that the order that the Applicant sought is the appropriate order. However, I accept that the outcome may be the inevitable consequence of the order that I propose to make. 189As Mr McAteer has observed, the use of CCTV in public places by public sector agencies requires compliance with the whole suite of the PPIP Act IPPs. This can be onerous for agencies and therefore compliance with the law can be problematic. 190In my view, the appropriate order is one under section 55(2)(b), which requires the Council to refrain from any conduct or action in contravention of an IPP. It is a matter for the Council how it achieves that result. 191Mr McAteer has alluded to some options that are open to the Council. Alternatively, it could be achieved through the outcome that the Applicant has sought. 192In my view, an apology to the Applicant is also warranted. Orders 1. The Council is to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice; 2. The Council is to render a written apology to the Applicant for the breaches, and advise him of the steps to be taken by the Council to remove the possibility of similar breaches in the future. ********** DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 02 May 2013