This article outlines the process for staff members or authorized third parties to request and obtain access to CCTV footage for legitimate business purposes. This procedure ensures the privacy and security of individuals captured on recordings while adhering to relevant NSW legislation, such as the Workplace Surveillance Act 2005 and the Privacy and Personal Information Protection Act 1998.

1. Legal Framework and Access Criteria

In accordance with Australian Privacy Principles and NSW law, CCTV footage is considered "Personal Information." Access is strictly controlled and granted only when the following criteria are met:

• Legitimate Business Purpose: Access is restricted to seeking approval for actions such as investigating specific incidents

• Proportionality: Requests must be limited to the specific information required to enable the Executive team to make an informed decision

• Prohibited Areas: Surveillance and footage access are strictly prohibited in private areas to ensure the security and integrity of the environment

• Misconduct: Requests related to employee misconduct or disciplinary matters may require additional executive oversight

2. Data Retention

• Standard Storage: Our cameras capture and store approximately 30 days of footage.

• Extended Retention: Footage retrieved for specific investigations or other purposes may be retained for longer periods on a case-by-case basis.

3. How to Request Access

The "CCTV Footage Access Request Form" has been decommissioned. Please follow the updated process below:

For Facility-Based Staff

1. Report to Facility Manager: All staff seeking access to footage (or requesting on behalf of a third party, such as the police) must report their request directly to their Facility Manager.

2. Manager Assessment: The Facility Manager will assess the request for legitimacy and necessity.

3. UAM Submission: If the request is valid, the Facility Manager must submit an approval request via the User Access Manager (UAM) app

For Corporate Services Staff

• All requests for footage must be directed to the Privacy Officer (at the time of writing, the CEO) or their designated delegate for assessment.

4. Submitting via UAM (Facility Managers or Corporate Services Staff Only)

1. Access UAM: Open UAM from your Google Dashboard

2. Navigate to Approvals: Select 'Approvals' from the left-hand side menu

3. Create New Request: Select 'Add' in the top right-hand corner

4. Assign Request: Assign your request to the relevant person, normally the Privacy Officer/CEO or their delegate (e.g., the COO)

5. Select Request Type: Choose 'User Specific'

6. Related User: Select the relevant user to whom the access applies

7. Select Request Category: Choose 'One-Off Access to CCTV Footage' from the dropdown menu

8. Detailed Rationale: Enter a detailed explanation as to the changes required and the reasons why
   You must include:

   • Specific reason for the request (e.g., resident fall investigation)

   • Date and time of the incident

   • Location of the relevant camera(s). Please advise which camera footage should be retrieved as relevant to your enquiry. Our intercoms also operate as fully functioning Cameras and can have footage retrieved if needed.
     

   • Please refer to the Camera Floor Plans: Strathdale | Willowood | Oberon
     

9. Save: Select 'Save' in the top right-hand corner
   

Note that not all options will be relevant to every site and you should refer to the floor plans above to select the correct cameras.

---

5. Approver's Checklist (UAM Guide)

• Detailed Rationale: Does the "Rationale" field clearly describe a specific incident with a date, time, and location to allow for an informed decision?
  

• Proportionality: Is the amount of footage requested limited to only what is needed to investigate the incident?

• Compliance with Notice: Were the individuals in the footage notified of surveillance via clear signage at the facility?

• Authorised Receiver: Is the Facility Manager the appropriate person to handle this specific footage?

6. Accountability and Logging

The Workplace Surveillance Act and best-practice standards require that all access be logged.

• UAM as a Record: By using the UAM app, the organisation maintains a digital audit trail and record-keeping of who requested the footage, why it was requested, and who approved it.

• Link Expiry: The IT department's use of secure, expiring links ensures that footage does not remain accessible longer than necessary, meeting "data minimisation" requirements.

7. Approval and Secure Delivery

• Executive Review: The Privacy Officer (CEO) will review the request based on legal necessity and privacy principles.

• IT Notification: If approved, the IT Department or COO will be automatically notified

• Secure Delivery: The relevant footage will be sent to the Facility Manager via a secure link.

  • No specialised software is required by the receiver to view the footage.

  • All links sent should be temporary and will expire after a limited time to ensure data security.