In the dying days of December 2024, the NDIS Quality and Safeguards Commission commenced proceedings in the Federal Court against a registered provider in relation to alleged CCTV surveillance of a child participant in its care. Whilst the outcome remains to be seen, Lavan has noticed a significant uptick in queries and concerns raised by NDIS providers around the use of surveillance technology (either by providers or clients and their families).
The use of surveillance device technology in NDIS, Aged Care or any other setting is a fraught one requiring careful consideration of a raft of legislation including the NDIS Act 2013 (Cth), Privacy Act (1988) (Cth) and Telecommunication (Interception and Access) Act 1979 (Cth) as well as various state based legislative instruments dealing with surveillance devices and workplace privacy.
In the NDIS space, reference is often made to the NDIS Commission's Surveillance Technology Practice Guide, released in August 2022, which aims to clarify what constitutes surveillance technology, when its use might be restrictive, and highlight ethical, human rights, and privacy issues. It also outlines best practices and helps providers meet their obligations under the NDIS Act.
However, providers need to be very careful not to rely on it as a standalone guide. The guide makes passing references to relevant surveillance devices acts but doesn't thoroughly address the risks of committing crimes or breaches under state-based surveillance devices acts, the Telecommunication (Interception and Access) Act 1979 (Cth), or the Privacy Act 1988 (Cth). Some states also require certain disclosures to workers before conducting surveillance at a worksite (eg. Workplace Privacy Act 2011 (ACT)). The guide also only considers a binary situation where the participant is under surveillance, ignoring the complexities of third parties (eg. staff, contractors and visitors) who might be captured by surveillance systems.
For instance, in most states and in both Aged Care and NDIS spheres, consent is required from all individuals captured by a CCTV system in private settings. In a Supported Independent Living (SIL) house, how are all visitors (staff, cleaners, allied health professionals, other contractors, family members, friends) informed about the CCTV operation? How is their consent obtained? And what about individuals with limited or declining capacity?
These same questions, and more, arise in Residential Aged Care. We have seen a rise in consumer’s families wishing to instal CCTV devices in resident’s rooms. The installation by a third party (family) of CCTV devices which transmit over the provider’s WiFi systems potentially give rise to liability for both parties (sometimes unwittingly).
Audio surveillance adds another layer of complexity. Due to nuances in surveillance devices acts, capturing audio, even in public spaces, can be problematic.
The guide frequently mentions the 'right to privacy' and includes a checklist to ensure providers consider any 'impact on the person's privacy.' However, thanks to the Privacy Act 1988 (Cth), it's more complicated than that. Once data is collected, it becomes personal or sensitive information, requiring providers to have a privacy policy. Providers must also consider how they collect, store, and use the information in accordance with the Privacy Act. Non-compliance with privacy principles can result in a $62,600 fine per breach, with repeated breaches risking fines up to $50 million.
Surveillance devices legislation covers a wide range of devices, from cameras to GPS trackers (including apps on phones). The use or transmission of data captured by these devices is also regulated. Providers using such devices must tread carefully.
So, while the guide offers some direction, it's crucial for providers to stay vigilant and ensure they fully understand and comply with all relevant laws and regulations. How they comply or enable surveillance will depend on their given context and circumstances. The consequences of getting it wrong can be serious.
For full and proper guidance encompassing all aspects of surveillance in disability or aged care setting, contact Amber Crosthwaite on 08 9 288 6931 or amber.crosthwaite@lavan.com.au.
