Security Systems & Biometric Privacy
Security Systems & Biometric Privacy
Overview
CustomLink supplies, installs, configures and supports security and automation systems, including CCTV, access control, number plate recognition, facial recognition and other intelligent detection functions.
Some advanced systems may process recordings, facial images, biometric templates, number plates, access records or other security-related information.
Facial images and biometric templates used for identification are sensitive information under Australian privacy law and require a higher level of privacy protection.
Customer-Operated Systems
In most installations, recordings and system data are stored within equipment or services operated by the customer.
The customer generally determines:
- why the system is used;
- which cameras and functions are enabled;
- how long information is retained;
- who can access the system;
- who may approve watchlist entries;
- who may search or export information; and
- what action is taken following an alert.
The customer is responsible for determining whether its intended use is lawful and appropriate and for maintaining any required signage, privacy notices, procedures and staff training.
CustomLink Access
CustomLink may access system settings, recordings, images or related security-system information where authorised by the customer for purposes such as:
- installation;
- configuration;
- commissioning;
- testing;
- troubleshooting;
- remote support;
- maintenance; or
- customer-requested system changes.
Access is limited to the authorised technical purpose.
CustomLink does not use customer recordings, facial images or biometric information for advertising, marketing, unrelated analytics or customer profiling.
Facial Recognition and Watchlists
Where facial-recognition or watchlist functions are included, the customer is responsible for:
- defining the security purpose;
- approving the cameras and areas where facial recognition will operate;
- confirming temporary face-capture and CCTV retention periods;
- appointing authorised users;
- approving watchlist additions;
- reviewing and removing watchlist entries;
- training staff to respond appropriately;
- maintaining entrance notices and privacy information; and
- managing complaints, access requests, exports and disclosures.
A facial-recognition match is an alert only. It should not be treated as conclusive proof of identity, wrongdoing or involvement in an incident.
Human review is required before any action is taken.
Retention
CustomLink recommends that recordings, face captures and other personal information be retained only for the minimum period reasonably required for the approved purpose.
Where the Privacy Act applies, organisations generally need to take reasonable steps to destroy or de-identify personal information once it is no longer needed, unless retention is otherwise required or authorised.
Ordinary CCTV footage, temporary face captures, watchlist records and preserved incident evidence may require different retention periods.
Watchlist Changes and Data Exports
CustomLink will not, without authorisation from the customer’s nominated representative:
- add a person to a facial-recognition watchlist;
- remove or materially change a watchlist entry;
- export facial or biometric information;
- disclose recordings to another party; or
- materially change facial-recognition retention settings.
Where CustomLink performs an authorised change, the customer remains responsible for approving the purpose and ongoing use.
Security
Customers should use:
- individual user accounts;
- strong passwords;
- appropriate access restrictions;
- secure network and remote-access settings;
- current firmware and software;
- controlled export procedures; and
- regular review of users and watchlist entries.
No security system can guarantee complete protection against unauthorised access, misuse, equipment failure or data loss.
Privacy Enquiries
For information stored within a customer-operated security system, enquiries should normally be directed to the organisation operating that system.
For questions about information held directly by CustomLink during installation, support or administration, contact:
CustomLink Pty Ltd
Phone: 1300 122 520
Email: sales@customlink.com.au
Postal address: PO Box 4330, Forest Lake QLD 4078, Australia
Important Information
CustomLink provides security-system products, configuration, installation and technical support.
CustomLink does not provide legal advice and does not warrant that every proposed use of facial-recognition or biometric technology will be appropriate or lawful in every situation.
Customers should obtain suitable professional advice where required.