Businesses wanting to keep a close eye on their customers by using closed-circuit television must follow a set of stringent guidelines under the Privacy Act.
Some of those guidelines, provided by the Privacy Commissioner, include positioning cameras in a way that will not intrude "to an unreasonable extent" on the privacy of individuals.
Signs should also be placed where people can see them, notifying them that there are cameras in use. Staff should also be able to answer questions from the public about the system that is recording them.
Assistant privacy commissioner Katrine Evans said the signs should make it clear how to contact whoever is operating the camera.
The purpose of this is in case people have queries about how the cameras are used or in case they want to gain access to the footage.
"Organisations using cameras should also have a clear policy that sets out things like who will see the footage, what it will be used for and how long the footage is kept," she said.
"Anyone should be able to ask to see that policy."
The guideline also notes that the hours the CCTV camera is in use should be limited, mainly to opening hours, or days and times during the week when crime peaks.
Images must be used or disclosed only for the original purpose they were collected for.
Footage from a CCTV camera can be kept only for a specified length of time.
The business manager or owner must determine what that time frame is. Storage time should be kept to a minimum.
Ms Evans said organisations usually used CCTV responsibly.
"But we do occasionally get complaints or queries about CCTV.
"Some of the problems that can crop up include lack of signs for the public, filming in changing areas, having inadequate security over who can see the footage, refusing to let people see footage that they feature in, or posting CCTV footage on Facebook or YouTube."
She said unlike some countries, New Zealand did not have fines for breaches of privacy.
"But breaching someone's privacy tends to make an organisation look stupid. It can cost money because customers get so annoyed they don't come back. And in cases where someone has been seriously embarrassed by a breach of their privacy, the organisation can end up having to pay them compensation."
- The Timaru Herald