CCTV Surveillance Policy

Print Version

Application

1. This policy applies to all staff, students and visitors to the University of Waikato and any other person or property captured in CCTV footage.

Scope

2. This policy applies to all CCTV systems operated by the University on University premises.
3. This policy does not apply to:
   1. CCTV systems operated by tenants or other occupiers of University premises
   2. the video recording of lectures and other teaching and learning activities and the subsequent use of such recordings, e.g. via Panopto
   3. video recordings made for research and other academic purposes
   4. video-conferencing, including the recording of video conferences
   5. live web-streaming cameras installed for public interest viewing, i.e. web cams.

Purpose

4. The purpose of this policy is to:
   1. provide information on the use of CCTV systems to deter and reduce the incidence of crime and disorder on University premises
   2. provide information on the use of CCTV systems to assist with investigations and other enquiries into staff, student, visitor and other persons’ activities and conduct
   3. outline the CCTV system monitoring processes in place that enable preventative or responsive actions to be taken as appropriate
   4. assure staff, students and visitors to University premises of the safety measures that operate across those premises within the context of applicable New Zealand legislation and industry best practice
   5. set out principles, operational rules and responsibilities with respect to the collection, use, access and disclosure of CCTV footage.

Related documents

5. The following documents set out further information relevant to this policy:
   • Code of Student Conduct
   • Crimes Act 1961
   • Drone Policy
   • Health and Safety at Work Act 2015
   • Human Rights Act 1993
   • Personal Information and Privacy Policy
   • Private Security Personnel and Private Investigators Act 2010
   • Privacy Act 2020
   • Privacy and CCTV: A guide to the Privacy Act for business, agencies and organisations (Privacy Commissioner)
   • Staff Code of Conduct
   • University of Waikato Privacy Statement

Definitions

6. In this policy:

   access control means an electronic or manual process used to control access to a building or site

   agency means the New Zealand Police and other appropriate public sector agency having jurisdiction in relation to the subject matter of the relevant CCTV footage

   CCTV (closed circuit television) means a camera surveillance system that transmits and records images

   CCTV footage means images captured by a CCTV system

   CCTV system means the system operated by the University of Waikato

   Privacy Officer means the Privacy Officer of the University of Waikato or delegated authority

   University premises means the land and buildings owned or leased by the University, including it Hamilton and Tauranga campuses and other satellite premises, and University student accommodation and recreation facilities

   University student accommodation means a hall of residence, apartment or other student accommodation owned and/or operated by the University

   visitor means any person who is not a staff member or student of the University who is on University premises or grounds,whether or not invited onto those premises or grounds.

Principles

7. The purpose of CCTV systems on University premises is to:
   1. enhance the safety of staff, students and visitors to the University
   2. enable monitoring and surveillance to assist with the prevention, detection and investigation of criminal behaviour, including the identification and apprehension of persons committing offences on or around University premises
   3. monitor and protect University owned and/or operated property, buildings and critical infrastructure and other assets
   4. assist with the monitoring, review and enforcement of traffic related incidents on University premises
   5. assist in the investigation of suspected breaches of University policies and/or codes of conduct by staff, students and visitors
   6. prevent, detect and/or assist in the investigation of complaints or incidents involving, staff, students and visitors
   7. verify identification for the purposes of access control to University buildings and to alert authorised security personnel of persons of interest who could potentially present as a threat to the safety and wellbeing of staff, students and visitors
   8. provide data analytics to enhance the operational effectiveness of the University including improved building management systems, energy consumption, environmental best practice, resurface allocation and management, and
   9. monitor the assembly and movement of people around University premises to assist with campus development planning.

CCTV systems

8. CCTV systems in use on University premises comprise a range of fixed-position cameras, pan tilt and zoom cameras, motion-activated recorders, monitors, digital recorders and public information signs.
9. CCTV footage is stored on secure servers in a secure location and is directly accessible by authorised security personnel only.
10. CCTV systems operate 24 hours per day, 365 days per year.

Placement of CCTV cameras and field of view

11. CCTV systems are located at various places on University premises and may be relocated from time to time.
12. With the exception of temporary covert camera installations installed in accordance with clauses 19 to 22 of this policy, signs advising of CCTV cameras must be displayed at all key pedestrian and vehicular entrance points to the University and buildings where cameras are in operation to help ensure that staff, students and visitors to the University are aware that they are entering an area that is covered by CCTV surveillance (examples of CCTV signage are provided in the Appendix of this policy).
13. CCTV systems may be installed inside and/or outside University buildings and/or otherwise on University premises.
14. CCTV systems are sited to cover the University premises as far as is possible, including:
    1. roadways
    2. carparks
    3. buildings used for teaching, research and administrative purposes
    4. University student accommodation (entrances and communal areas only) and recreation facilities
    5. licensed premises and
    6. other public areas.
15. CCTV systems may cover (but are not limited to):
    1. emergency phone locations
    2. social learning spaces
    3. general circulation and communal areas, corridors, hallways, pathways and key entrances to University campuses
    4. areas where cash, high value equipment and high value information are stored or handled
    5. areas where staff interact with students and/or the public (but not in individual offices)
    6. areas with high risk equipment, processes or chemicals, e.g. laboratories, and
    7. car parks and bike racks.
16. CCTV systems must not be installed in any manner that will intrude to an unreasonable extent on the personal privacy of an individual; in particular, CCTV systems cameras must not be installed in:
    1. toilets
    2. showers
    3. individual offices, and
    4. private student residential rooms.
17. CCTV systems must not record sound or audio.
18. Where possible, CCTV systems must be installed in a manner that avoids the recording of information which is commercially sensitive or research sensitive.

Temporary covert camera installations

19. Where reasonable and appropriate, such as by way of example only, in connection with a criminal investigation or to investigate issues that may pose a threat to the operations of the University, the Vice-Chancellor may authorise temporary covert camera installations on University premises.
20. In accordance with clauses 16 to 18 of this policy, covert camera installations must be positioned to that they will not intrude to any unreasonable extent on the personal privacy of an individual or on matters which are commercially sensitive or research sensitive.
21. The use of covert cameras for the purpose of monitoring staff performance is not permitted.
22. CCTV cameras that have been covertly installed will be removed or, if retained, disclosed with signage (where appropriate), immediately upon conclusion of the purpose for which they were installed.

Security of CCTV footage

23. CCTV installation, operation, monitoring and recording is undertaken by authorised security personnel (staff and a contracted service partner) in compliance with relevant legislation and University policies.
24. CCTV cameras are monitored from restricted control rooms and/or via University mobile devices by authorised security personnel.
25. All CCTV footage is the property of the University.

Access to and use of CCTV footage

26. The University may use CCTV footage and provide access to CCTV footage to third parties for any of the following reasons:
    1. any of the purposes set out in clause 7 of this policy
    2. any of the following purposes:
       1. for court or tribunal proceedings
       2. to assist a public sector agency to carry out an investigation or otherwise uphold the law
       3. to prevent or lessen a threat to public health and safety or the life or health of an individual
       4. to comply with the law or any lawful requirement
       5. to assist with any investigation of incidents captured by the University’s CCTV systems on University premises or properties that may neighbour the University premises, such as for example, but not limited to, acts of vandalism
       6. for the investigation or enforcement of any contractual right or obligation
       7. to investigate or provide evidence in relation to disputes involving staff, students, or visitors
       8. to assist with any review of traffic related incidents, for example, but not limited to, liability or insurance assessment purposes
       9. to assist with any investigation into concerns around the health or wellbeing of staff, students, or visitors
    3. where an identifiable individual captured in CCTV footage has consented to the use or disclosure.
27. Subject to clauses 31 to 34 of this policy, the viewing and/or provision of CCTV footage to a third party may only be carried out with the prior approval of the University’s Privacy Officer solely for a purpose recognised in this policy.
28. Any request for access to CCTV footage that are requests for personal information under the Privacy Act 2020 will be responded to within the timeframes determined in accordance with that Act.
29. In the event of a CCTV system capturing a suspected unlawful activity being carried out on University premises or any other place, the University may provide the relevant CCTV footage to an Agency.
30. Data analytics information obtained from CCTV systems, such as parking data, may be provided to authorised staff for further analysis with a view to understanding and improving logistical operational efficiencies.

Specific access requests: Agency

31. If an Agency believes that an unlawful activity or alleged offenders may have been captured on University CCTV systems, they may request that the University provide or view any footage for the purpose of an investigation
32. The University will fully cooperate with an Agency when an access request is accompanied by the relevant order (such as a production order or court order)
33. In the absence of a relevant order, an Agency will be required to complete an Agency Access Request CCTV Footage Form and submit it to the Campus Security and Emergency Manager who shall consider the request.
34. The Campus Security and Emergency Manager will decide whether to approve or decline the request having regard to the purpose for which it is sought in accordance with this policy and, where relevant, the requirements of the Privacy Act 2020.

Specific access requests: Individuals

35. Where an individual who has been recorded by the University’s CCTV systems seeks to access CCTV footage of themselves, they are required to complete an Individual Access Request CCTV Footage Form and submit it to the University’s Privacy Officer who shall consider the request.
36. Where required by the University for any staff related matter, the Director of People and Capability is required to complete an Authorised Person Access Request CCTV Footage Form and submit it via Kuhukuhu (Legal Services) and submit it to the University’s Privacy Officer who shall consider the request.
37. Where required by the University for any student related matter, the Director of Student Services is required to complete an Authorised Person Access Request CCTV Footage Form and submit it via Kuhukuhu (Legal Services) to the University’s Privacy Officer who shall consider the request.
38. Any other request must be made using the Agency Access Request CCTV Footage Form to the University’s Privacy Officer who shall consider the request.
39. The Privacy Officer will decide whether to approve or decline the requests made under clauses 35-38 of this policy having regard to the purpose for which is it sought in accordance with this policy and the requirements of the Privacy Act 2020.
40. Access to CCTV footage may be refused on the grounds set out in Part 4 of the Privacy Act 2020.
41. In an emergency, the Campus Security and Emergency Manager may provide access to footage, provided the access is requested by an appropriate person and is for one of the purposes set out in clause 26b of this policy.
42. Requests for access to CCTV footage that are requests for personal information under the Privacy Act 2020 will be responded to within the timeframes determined in accordance with that Act.
43. The Privacy Officer may delegate some matters to the Campus Security and Emergency Manager, including decision-making powers for access requests made by an Agency in accordance with clauses 31-34 of this policy.

Making recordings available

44. The Campus Security and Emergency Manager is responsible for making a recording available (whether as a viewing of the recording or by providing a copy of the recording) to the relevant person or agency whose request has been approved by the Privacy Officer or, where relevant, the Campus Security and Emergency Manager or where access is otherwise authorised in accordance with clause 26 of this policy.

Records retention

45. The normal length of storage of CCTV footage may vary between 30 and 90 days; information collected for evidential purposes or which is otherwise required to be kept may be retained and stored beyond this period.

Responsibilities

46. The Vice-Chancellor is accountable for the provision and maintenance of a safe and healthy environment, and delegates relevant responsibilities with respect to CCTV systems to the Director of Campus Operations and Risk Management, the Privacy Officer and the Campus Security and Emergency Manager as set out in clauses 47-48 of this policy.
47. The Director of Campus Operations and Risk Management is responsible for the overall management and operation of the CCTV systems, including the authorisation of staff for the monitoring of the CCTV systems and recorded data.
48. The Campus Security and Emergency Manager is responsible for:
    1. the installation, administration, monitoring and use of the University’s  CCTV systems
    2. deciding the operating hours and locations of CCTV
    3. ensuring that staff, students and visitors to the University are aware of the presence of CCTV, where it operates, and
    4. the training of authorised personnel in the implementation of this policy.
49. The Privacy Officer shall have oversight of compliance by the University in respect of its obligations under the Privacy Act 2020 as set out in the University of Waikato Privacy Statement, the Personal Information and Privacy Policy and this policy.
50. Authorised security personnel are responsible for taking the appropriate actions in relation to incidents captured by the CCTV systems.

Complaints

51. Any person who believes that this policy has been breached is encouraged to advise the Director of Campus Operations and Risk Management who will investigate the matter.
52. Nothing in this policy shall limit any person’s right to pursue a complaint with the Privacy Commissioner.

Responsibility for monitoring compliance

53. The Director of Campus Operations and Risk Management is responsible for monitoring compliance with this policy and reporting any breaches to the Vice-Chancellor.
54. Breaches of this policy by staff may result in disciplinary action under the Staff Code of Conduct.
55. Breaches of this policy by student may result in disciplinary action under the Code of Student Conduct.