The compliance regime written into most Australian privacy laws is “complaint” based. That is if a person becomes aware of a breach of privacy, there are then avenues of complaint. This leads to the perception within organisations that the lack of complaints probably means there are no privacy problems.
While privacy commissioners might be interested in undertaking spot audits and reviews, resources are limited and activities of this kind are rare.
What can show up when an audit is undertaken is illustrated in this report by the Victorian Privacy Commissioner on surveillance cameras in taxis. Even though no complaints had been received the Commissioner found that the Victorian Taxi and Tow Truck Directorate and the Department of Infrastructure who were responsible had neglected to establish safeguards for the handling of downloaded images from cameras in taxis. Even where some systems were in place they had significant weaknesses.
While the primary purpose for the installation of cameras was security, downloaded images had been accessed for a wide range of other purposes; proper records of access were not maintained; and there was not sufficient oversight to guard against misuse and to detect it swiftly when it did occur.
In Victoria responsibility for the system rested with the Directorate which was subject to the Information Privacy Act. Who knows what happens in other jurisdictions?
In NSW the Department of Transport has published guidelines which seem to be a significant improvement over what the Privacy Commissioner found in Victoria) but the Department doesn’t seem to be responsible for handling camera images. That seems to rest with each taxi network. The networks aren’t subject to the NSW Privacy and Personal Information Protection Act but may be subject to the private sector provisions of the Federal Privacy Act.
Does anyone audit taxi camera surveillance? Should we be concerned about what will happen to the images from those silently rolling cameras while we are in the back seat?
No comments:
Post a Comment