Speed camera in Wellington. Photo: RNZ / Samuel Rillstone
New Zealand Transport Agency (NZTA) is defending its controls around an expanding and more powerful highway speed camera system that privacy experts had told it lacked national oversight.
A new system that verifies offences and dishes out speeding fines, which links in three big American tech companies, went live 10 months ago.
New cameras are about to be added to it, that can measure your average speed between two points for the first time, at sites in Auckland and Waikato. Existing cameras should all be brought within the NZTA stable by June.
The transport agency's consultants told it in 2022 "there is little or no national oversight of the camera system" and "lack of centralised senior oversight".
Often a vacuum developed around protecting privacy at agencies, they warned.
"It is crucial that Waka Kotahi has adequate governance in place to create the best oversight" because it was creating a technical system involving third parties, they said. "Waka Kotahi must identify a national governance group."
An agency privacy impact assessment seven months ago repeated that advice.
"There are no current plans for a shared governance committee," NZTA said in the same report,
This week, the agency told RNZ it had had national governance in place since 2022 around setting up the system, and around taking over cameras from police.
It also now had an overall governance policy, governance groups for specific camera types and was "planning on establishing two governance groups to oversee our overall camera system" - one for operations and one for strategy.
'Controversial' cameras on way
The two assessments stress the agency's reputation was on the line for safeguarding masses of motorists' personal information.
"An effective governance group, and clearly assigned accountabilities will be crucial in ensuring proper privacy protections are in place around the growing roading management camera deployments, along with the growing responsibility to manage the personal information that flows through them."
The reach of 'smart' road cameras is growing in scale and power; they are in use, or will be, for red-light runners, spot speed, average speed, congestion charging, tolls, and a commercial vehicle safety programme.
The newest ones will be automated number plate recognition (ANPR) cameras to measure average speeds.
"ANPR tends to be controversial," the consultants told NZTA.
"A major concern... is that networks of cameras are capable not only of tracking individuals across a particular journey, but also that retaining that information may build up a database of vehicle movements over time."
At one stage, it was envisaged a network of 800 cameras would dish out three million tickets a year, but that has been cut back to just a quarter of that - 204 fixed and point-to-point cameras issuing up to 1.1 million tickets, about the same as now. Mobile speed cameras operated for NZTA by another private company are on top of that.
The public had to be assured NZTA was striking "a balance between automation and maintaining viable human oversight", the two assessments said.
The agency told RNZ on Wednesday that it supported the 2022 advice to establish governance across all camera types, "at the right time" - that is, after it had taken over all the existing police speed cameras by June, having begun last June.
"With the establishment and transfer nearing completion, it is our intent to move forward with combined governance across all NZTA-operated camera types."
'Little or no national oversight'
The consultants it used, Simply Privacy, interviewed Waka Kotahi staff as it embarked on the camera system overhaul in 2022.
"In general it became apparent that there is little or no national oversight of the camera systems," they told it.
"Evidence of that was apparent in the disassociated way various road management camera products have been viewed and assessed."
For instance, four "disassociated" privacy impact assessments were done on ANPR cameras, instead of combining them.
"Without adequate governance ... NZTA runs the risk of project and deployment risks not being adequately implemented and monitored over time and not being in a position to demonstrate adequate stewardship of the safety camera system."
Four "red"-rated risks to personal data were identified in the assessments - these are risks "almost certain to occur", with "severe" impacts - and another 11 high risks were found.
NZTA would suffer "scrutiny and repetitional damage" if it did not deal with them.
The reports list lots of mitigation measures to take.
They detail data encryption and its transfer between the camera and infringement system operator, Verra Mobility, the cloud-computing services run by Amazon and Microsoft in Australia the system uses, and NZTA.
Data sovereignty risks would be mitigated by this being temporary until a storage centre was built in New Zealand, the 2024 assessment said.
NZTA has been in talks with police about establishing a data-sharing agreement around the cameras.
The police used a company, Redflex, which was taken over in 2021 by Verra, the largest transport enforcement company in the US.
Verra won an expansion of a $1.5 billion-plus contract for cameras in New York City last month, and a big deal in San Francisco last year. In 2020 it settled a lawsuit for $2m, that accused it of over-billing in New York, without admitting any wrongdoing, according to US reports. RNZ approached Verra for comment.
