{"id":142,"date":"2026-08-13T20:59:07","date_gmt":"2026-08-13T10:59:07","guid":{"rendered":"https:\/\/mallen.com.au\/blog\/?p=142"},"modified":"2026-08-13T20:59:08","modified_gmt":"2026-08-13T10:59:08","slug":"australias-privacy-sweep-is-your-cctv-system-compliant","status":"publish","type":"post","link":"https:\/\/mallen.com.au\/blog\/australias-privacy-sweep-is-your-cctv-system-compliant\/","title":{"rendered":"Australia’s Privacy Sweep: Is Your CCTV System Compliant?"},"content":{"rendered":"\n

The Office of the Australian Information Commissioner (OAIC) has kicked off 2026 with a targeted compliance sweep of business privacy policies, reviewing around 60 organisations across sectors that routinely collect personal information face-to-face. For strata committees, club operators, and facilities managers running CCTV on site, this is a useful prompt to check whether your surveillance practices actually match what your signage and privacy documentation claim \u2014 because for many sites, they don’t.<\/p>\n\n\n\n

Why CCTV footage falls squarely under privacy law<\/h2>\n\n\n\n

CCTV footage that captures faces, movement patterns, or timestamped activity can constitute personal information under the Privacy Act once an individual becomes identifiable. The OAIC’s sweep is focused on Australian Privacy Principle (APP) 1.4 \u2014 whether published privacy policies contain the required detail \u2014 but the underlying expectations for any organisation handling recorded footage are straightforward in principle and often messy in practice: notify people before recording, secure the footage appropriately, and destroy or de-identify it once it’s no longer needed.<\/p>\n\n\n\n

Enforcement isn’t hypothetical either. The OAIC has flagged infringement notices with penalties up to $66,000 for policies that don’t meet the required standard. That’s a modest figure for a large operator but a meaningful one for a strata scheme or club that hasn’t budgeted for compliance remediation.<\/p>\n\n\n\n

Where sites typically fall short<\/h2>\n\n\n\n

A sign at the entrance stating “CCTV in operation” is a start, but APP 5 requires organisations to take reasonable steps to make people aware of why information is collected, how it’s typically disclosed, and whether it might be disclosed overseas. In our experience auditing client sites, the gap usually isn’t the absence of signage \u2014 it’s a mismatch between what the signage says and what actually happens with the footage. A sign that says “security only” doesn’t cover a scenario where footage is later pulled for staff performance review or used to resolve a customer dispute.<\/p>\n\n\n\n

The practical failure points tend to cluster around three things:<\/p>\n\n\n\n