‘Gaps’ in how council informs about personal info
THERE are still "gaps" in how Ipswich City Council informs residents and visitors that it collects their personal information through its network of surveillance cameras.
This comes from a report by the Office of the Information Commissioner, which was tabled in parliament last week.
The report highlights the council's progress in implementing the 12 recommendations of a 2017-18 compliance audit, which it committed to implementing by November last year.
A particular focus of the report is the council's camera surveillance systems.
As at August 2017, the council operated 545 fixed surveillance cameras and 83 portable audio recording devices.
In 2018, the OIC reported that the Safe City system was a "mature system" with policies, procedures and organisational strategies that had built-in protections for privacy and data security.
But it found the council had not conducted a privacy impact assessment to identify privacy risks, and set up proportionate controls, for its corporate surveillance security system and portable audiovisual recording devices.
The OIC reported the council was not fully compliant with the privacy principles to inform people that it collected personal information via these systems.
"In 2018, we found that (the council) had well structured policies and procedures that supported how it operated and managed its Safe City camera network," the report notes.
"However, it did not operate its corporate surveillance camera system and portable audiovisual recording devices with the same level of maturity."
The council adopted two new policies in response to these issues.
At the time of the original audit, the council advised the OIC that it was redeveloping the mall and it intended to increase camera surveillance signage as part of the redevelopment.
"We recommended that ICC installs physical signs and notices, including for public spaces, buildings and vehicles, to make people generally aware that it is using cameras to collect personal information in the vicinity," the report notes.
"The council has collection notice signage for its Safe City and corporate surveillance security camera networks. The signs display the council's name and logo. They clearly state the purpose of collection.
"(The council) has strengthened its operation and management of its surveillance cameras and portable audiovisual devices.
"However, there are gaps in how it makes people generally aware that it collects their personal information through surveillance cameras."
Overall, the OIC reported that the council has "made progress" on implementing the recommendations of the original compliance audit.
The council has fully implemented six recommendations, partially implemented two others and is in the progress of implementing three more.
"There is more work to do to improve the council's information governance and management, and its systems to process access and amendment applications," the report notes.
"We urge (the council) to continue its efforts to fully implement all recommendations. This will enhance its openness, transparency and accountability, and support legislatively compliant processes."