CCTV Policy
This Policy governs Magic Tyres Limited (Magic Tyres) collection, use, access to, and disclosure of Closed-Circuit Television (CCTV) footage. It is intended to ensure Magic Tyres complies with its obligations under the Privacy Act 2020.
This Policy applies to all CCTV footage captured by Magic Tyres in the worksite and areas immediately in front of and behind the Magic Tyres building at 103 Port Road, Whangārei.
1Purpose and Scope
This Policy governs the collection, storage, use, access to, and disclosure of CCTV footage. It ensures that personal information captured via CCTV is handled strictly in accordance with statutory privacy principles under the Privacy Act 2020, subject only to lawful grounds for refusal.
This Policy should be read alongside the Magic Tyres Privacy Policy and any other relevant company health, safety, and security policies.
2Ownership and Operation of CCTV System
Magic Tyres owns and operates a CCTV surveillance system monitoring the worksite areas of the business (specifically, the workshop floor and areas immediately in front of and behind the Magic Tyres premises building).
CCTV footage may only be viewed or monitored by authorised Magic Tyres personnel, including Magic Tyres management.
3Purposes of CCTV Use
CCTV footage may be used only for lawful purposes, including:
4Placement, Operation and Signage
CCTV cameras will not be placed or operated in a manner that unreasonably intrudes on individual privacy. CCTV operation hours and activation methods will be documented and reviewed periodically.
Clear signage is prominently displayed to notify customers, visitors, and workers before they enter areas monitored by CCTV.
Audio Recording Disabled
Magic Tyres ensures that any audio-recording function on its CCTV cameras is disabled at all times to safeguard personal privacy.
5Access to CCTV Footage
CCTV footage constitutes personal information where it identifies (or is reasonably capable of identifying) an individual. Under Principle 6 of the Privacy Act 2020, individuals have a statutory right of access to their personal information.
Decisions about access to or disclosure of CCTV footage must:
- Be made on a case-by-case basis;
- Be based directly on the Privacy Act 2020; and
- Respect the privacy rights of other identifiable parties.
6Requests for CCTV Footage Under the Privacy Act
Where an individual requests access to CCTV footage of themselves, Magic Tyres will:
- Treat the request as a formal request for personal information under the Privacy Act 2020;
- Respond to the request within 20 working days; and
- Provide access unless a statutory refusal ground applies.
Statutory Grounds for Refusal & Third-Party Protection (Sections 49–53):
Access may be refused only where statutory grounds under Sections 49–53 of the Privacy Act 2020 apply. Under Section 53, a request may be refused if disclosure would involve the unwarranted disclosure of the affairs of another individual.
In assessing whether disclosure would be unwarranted, Magic Tyres will consider:
- The nature and context of the footage;
- How identifiable other individuals are;
- What those other individuals are doing; and
- Whether partial access can reasonably be provided.
Where full disclosure is not appropriate, Magic Tyres will consider alternative access methods, including supervised viewing of the footage without a copy being released, or providing redacted/pixelated footage where practicable.
Where access is refused or limited, Magic Tyres will provide formal written reasons referencing the relevant statutory grounds and advise the requester of their right to complain to the Office of the Privacy Commissioner.
7Police Requests for CCTV Footage
Police requests for CCTV footage may be made under a search warrant, or without a warrant where disclosure is lawful under Principle 11 of the Privacy Act 2020.
Magic Tyres may disclose CCTV footage to Police where Magic Tyres believes, on reasonable grounds, that disclosure is necessary to avoid prejudice to the maintenance of the law, including the prevention, detection, investigation, or prosecution of offences.
Police requests should be supported by sufficient information for a lawful assessment, including:
- • The incident or event under investigation
- • The exact location on our premises
- • The approximate date and time
- • The offence being investigated
- • The official date and officer details of the request
8Access Controls and Security
At present, the live CCTV camera feed is visible to all customers and employees within the office area.
Notwithstanding this live display configuration, access to the CCTV system — including the ability to view historical recordings, retrieve, download, copy, disclose, or manage stored footage — is strictly restricted to authorised Magic Tyres management and any other employees specifically authorised in writing by management for legitimate business purposes.
Strict Security Restriction
Any unauthorised access, retrieval, copying, deletion, or interference with CCTV footage is strictly prohibited and constitutes serious misconduct.
Remote access to live or recorded footage may be permitted only where robust cybersecurity controls are in place and approved by Magic Tyres management.
9Retention of CCTV Footage
CCTV footage will be retained for no longer than one month, unless specifically required for:
- An ongoing investigation (including employment or criminal matters);
- Legal proceedings;
- A pending privacy access request; or
- Another lawful purpose under this Policy.
Where the CCTV system is configured to automatically overwrite/delete footage when storage capacity is reached, footage will be deleted in accordance with that automated function.
10Records & Register
Magic Tyres maintains a formal register of:
- All requests for access to CCTV footage;
- Decisions to disclose or withhold footage; and
- Disclosures made to Police or other authorised third parties.
11Questions & Complaints
Questions or complaints about CCTV footage, surveillance practices, or this Policy may be directed to the General Manager:
External Privacy Complaints
Where relevant, complainants will be advised of their right to submit a complaint directly to the Office of the Privacy Commissioner at www.privacy.org.nz.
12Policy Governance & Review
Policy Owner: Magic Tyres Limited
Effective Date: August 2026
Review Frequency: This Policy takes effect from August 2026 and will be reviewed every three years, or earlier if required by legislative change.