Surveillance and monitoring public records

Type of public record	Evidentiary value	To capture or not to capture?
Surveillance and monitoring activities by devices for a specific purpose and Continuous routine surveillance Note: This is for all surveillance and monitoring devices, technology and equipment	Provides evidence of an incident, crime or other information and is required for an investigation	Capture and send copy to law enforcement
Surveillance and monitoring activities by devices for a specific purpose (e.g. by drones, body cameras, mobile devices)	Provides evidence of, or for, a business activity	Capture
Surveillance and monitoring activities by devices for a specific purpose (e.g. by drones, body cameras, mobile devices)	Does not provide evidence of an incident or crime	Capture
Continuous routine surveillance and monitoring (e.g. usually by fixed surveillance devices such as CCTV cameras where the user cannot easily stop and start recording)	Not required as evidence or requested by investigative and law enforcement	No need to capture

How to capture

All footage and images must be complete and reliable public records and fit for purpose. The integrity of the public records must be managed when extracted or transferred to another device.

When extracting footage and images from the original device, there is a distinction between primary, original and working images.

Primary images

Primary images are identified as the first instances in which the image or footage is recorded onto any media (e.g. the recording of surveillance footage onto a device such as a DVD recorder or memory card of a body worn camera).

The primary image is generally overwritten after a specified period of time, when the footage could be considered to have no further administrative use.

Primary images must be exported in their native format and without any additional compression or alterations.

Original images

Original images are to be considered the 'master', and are the official public record. They are managed as exact copies of the primary image.

The integrity of the original image and appropriate audit trails must be maintained for the duration of the required minimum retention period.

The original image should not be subjected to processes that cause permanent alteration.

Working images

Working images are copies of primary or original images. Working images are made where enhancements or alterations of the primary or original image are required (e.g. compression, filtering, cropping).

In the case where proprietary hardware or software is required for video replay, and where this may not provide the required functionality to enable editing or processing, a format conversion will be required.

Metadata

Any required metadata that give the footage and images context and meaning must be attached to and retained with the public record to establish evidentiary audit trails.

Most surveillance devices will automatically generate metadata such as the date, the camera number (if applicable), location and other similar information.

Additional metadata may need to be attached to the public record to include when, where, why, and how the footage or images were taken as well as who, if relevant.

Any audit logs and associated information need to be captured and/or included as part of the metadata to ensure the footage or images are complete and reliable public records. It can also be necessary to establish the evidentiary audit trail and to provide contextual information in a secure manner.

For more information on metadata requirements see Metadata management principles.

Management and storage

All surveillance public records must:

• be stored securely
• be safeguarded from alteration to ensure their integrity and authenticity can be verified
• be managed so they remain accessible and usable for as long as they need to be kept
• have appropriate access controls in place.

You should avoid storing public records in a proprietary, non-standard format.

Surveillance public records should not be stored in a compressed format. Compression can reduce the quality of the image or video to a point where it becomes unusable and/or required information is obscured.

You can include information about the management of surveillance public records in your public authority's policies and procedures.

Find out more about choosing file formats for public records.

Security and privacy

The Office of the Information Commissioner has information privacy guidelines for both drones and camera surveillance. These provide guidance on managing personal information that may have been captured, or is contained within descriptive and technical metadata or user data.

Any public records containing personal information must be stored securely and have appropriate access controls in place.

How long to keep them

Surveillance public records must be retained for as long as specified under a current retention and disposal schedule. How long they need to be kept will depend on why the public records are needed.

The following table will help you determine which public record class to use based on the purpose and evidentiary value of the public record.

Evidentiary value	Sentence and record class
Provides evidence of an incident, crime, investigation and has been handed over to law enforcement.	1202 of the General Retention and Disposal Schedule, which states you need to keep them for 1 year after recordings sent to relevant law enforcement public auhtority
Provides evidence of a core business activity Note: This applies to both surveillance and monitoring activities captured for a specific purpose and continuous surveillance.	The relevant activity in your public authority's core schedule–that is, the activity or record class that all public records documenting that activity would be sentenced under.
Is part of surveillance and monitoring activities captured for a specific purpose and is not required for investigative purposes or evidence (e.g. drones, body cameras, mobile devices)	1284 of the General Retention and Disposal Schedule, which states you need to keep it for 90 days after the public record is made
Is part of continuous surveillance and is not required as evidence or requested by investigative and law enforcement public authorities (e.g. fixed surveillance devices such as CCTV cameras where the user cannot easily stop and start recording)	1277 of the General Retention and Disposal Schedule, which states you need to keep them until business action completed Note: Your public authority will need to decide when business use ceases

Note: Some surveillance public records required as evidence may need to be sentenced under a different record class depending on what is needed as evidence. See the section on surveillance and monitoring in the General Retention and Disposal Schedule for more information on exceptions and other record classes that can be used.

Note: As with all minimum retention periods in a retention and disposal schedule, these are the minimum amounts of time the public records need to be kept.

Legal obligations

All public authorities have a duty of care to ensure any public records that may be needed as evidence in a judicial proceeding, including any legal action or a commission of inquiry, are not disposed of.

Any public records which are subject to a request for access under the Right to Information Act 2009, the Information Privacy Act 2009 or any other relevant Act must not be disposed until the action, and any applicable appeal period, has been completed.

Check the record classes relating to information privacy and access in the General Retention and Disposal Schedule to find out if the public records must be kept longer than listed above.

When sentencing public records, consider:

• how surveillance systems and activities are carried out in your public authority
• the time it takes to actually identify what you need to capture (if anything)
• the time needed to retrieve the relevant image or section of footage.

Public records must also be retained longer if there they may foreseeably be needed for legal action, even if you haven't been notified of any legal action yet, for example, where a drone has injured a person.

Bring your own device (BYOD)

Your public authority should have policies and procedures in place for any staff who may use personal devices for work. This should cover the security, access and storage of the data, what public records need to be kept and how they are captured in the public authority's recordkeeping system.

Plan for use of surveillance and monitoring devices

Business planners need to be aware of the recordkeeping implications of using surveillance and monitoring devices (e.g. body cameras, drones, GoPros) and how they affect recordkeeping in your public authority (e.g. changes to policies, procedures, storage requirements).

Guidelines for the use of surveillance and monitoring devices should cover recordkeeping requirements, such as when recording devices should be turned on, if and when they should be turned off, how the images and footage are transferred from the device if necessary and how they will be stored.

Outsourcing surveillance activities

There are extra recordkeeping considerations to consider if you are outsourcing any surveillance activities.

The transfer of any surveillance public records between the service provider and your public authority must be done securely to ensure the public record, associated metadata and audit trails are maintained. How this is done and ways to mitigate any risks need to be included in the agreement.

Find out about the recordkeeping requirements when outsourcing.