Police have been told to spell out if they are sticking to the rules over surveillance cameras that are continuously reading vehicle number plates.
The privacy commissioner has asked them for assurances following revelations this week police misused the cameras twice.
Police have admitted to triggering camera-tracking in two investigations by flagging cars as stolen, when they were not stolen.
They told Newshub this was the most straightforward way to activate the widespread camera networks, though also said the use of false flags was not "appropriate".
The Office of the Privacy Commissioner said these cases, along with the recent findings about systemic issues around police taking and storing masses of people's photos unlawfully, raised questions "regarding the robustness of police review and audit processes and practice".
The automated number plate recognition (ANPR) was "a powerful intelligence and surveillance tool ... providing police with information about vehicles and their drivers in real time as well as the ability to review the location of vehicles and track vehicles".
"We have asked police to provide us with assurance regarding the robustness of their ANPR access and use monitoring and auditing practice," the OPC told RNZ in a statement.
Police had just updated their policies and procedures manual on ANPR.
"However, it is unclear to us to what extent the new policy has been implemented ... with respect to appropriate use of ANPR platforms, both those owned by police and those provided by third parties," the OPC said.
It had asked police about training, and was "particularly interested" in the operational guidance for officers on the thresholds for when live tracking was appropriate.
The "third parties" refers to two companies, Auror and SaferCities, who between them host thousands of ANPR and CCTV cameras on their two platforms, and the cameras' actual owners.
These owners are typically businesses such as supermarkets and stores, councils, government agencies and the like.
Police policy states these owners are liable for breaches under privacy laws.
"Police acknowledges that it is important for third parties to understand their legal obligations in relation to the collection of CCTV and ANPR data," police said in a statement, referring them on to the OPC.
They themselves had set clear expectations for SaferCities and Auror to ensure that those providing footage were doing it lawfully, police said.
The OPC said it was maintaining a watching brief on aggregation, use and disclosure of ANPR data.
A police spokesperson said they would work with the OPC to address its request.
"We continue to work with the Office of the Privacy Commissioner, and are expecting to be able to provide them with requested clarifications and confirmations soon."
