Biometric data collection – any business/agency

Copy, paste into your own email/document, edit [fee] (in section 5) and anything else you wish to edit and send to your local council CEO and elected members. Their email and postal addresses will be on their website.

On this page:

• Brief letter to any business/agency
• Initial letter to a local council
• Letter to your Minister for Local Government if council fails to provide substantive reply.
• Notice to a council to remove RFID tracking from bins

Brief letter of inquiry

To: [Privacy Officer / General Manager / Director]
[Business or Agency Name]

Dear Sir/Madam/name,

Formal Request for Disclosure – CCTV and Data Collection Practices

I write to formally request full and clear disclosure regarding the current status and operation of CCTV, tracking, and related data collection systems at premises operated or controlled by [Business/Agency Name].

This request is made to ensure transparency in relation to surveillance and information-handling practices affecting members of the public.

Please confirm in writing:

1. Whether CCTV systems are currently installed and operational at your premises, including entrances, internal areas, external perimeters, and carparks;

2. Whether any system incorporates facial recognition capability, biometric template extraction, automated identification, behavioural analytics, or automated alert functionality;

3. Whether any Automated Number Plate Recognition (ANPR) or vehicle tracking systems are in operation;

4. The categories of data collected (including video footage, still images, biometric identifiers, plate numbers, timestamps, metadata, or behavioural logs);

5. The purposes for which such data is collected, used, analysed, or retained;

6. The applicable retention periods for each category of data;

7. Whether any third-party vendors host, manage, process, or have administrative access to the systems or stored data;

8. Whether data is shared with external parties, including law enforcement or affiliated entities, and under what conditions.

If a Privacy Impact Assessment or equivalent risk assessment has been conducted in relation to these systems, please confirm whether such an assessment exists and whether a summary is available.

Withdrawal of Consent

To the extent that your organisation relies upon consent—whether described as express, implied, implied by entry, or otherwise—I formally withdraw and withhold consent to:

• The recording, filming, or logging of my image or movements;

• The extraction of facial images into biometric templates;

• The indexing or tracking of my vehicle through ANPR systems;

• Any profiling, analytics, behavioural monitoring, or automated identification processes.

Entry into publicly accessible premises does not constitute informed consent to biometric processing, tracking, or data analytics beyond what is strictly necessary and proportionate.

Please confirm whether your systems are capable of recording and operationalising such an objection.

This correspondence is provided in the interests of transparency and informed awareness. I request written confirmation addressing the above matters within a reasonable timeframe.

Yours faithfully,

[Your Name]
[Your Contact Details]

To the Chief Executive Officer, Executive staff, and Elected Members of Council

To the Chief Executive Officer, General Counsel, Executive Leadership Team, and Elected Members of Council,

I write to place Council on formal notice regarding surveillance and data-collection systems operating within this municipality, including but not limited to:

• Cameras and sensor systems located in streets, civic spaces, transport corridors, shopping precincts, and other public-facing environments;
• Automated Number Plate Recognition (ANPR) systems;
• Facial Recognition Technology (FRT) and biometric template systems;
• Smart-city sensor networks; and
• RFID (Radio Frequency Identification) tracking devices embedded in or affixed to municipal waste bins or other Council-issued property.

This notice applies to systems:

• Installed and operated by Council;
• Operated under Council contract;
• Installed by third parties on Council-controlled land;
• Approved, facilitated, or sanctioned through Council planning, regulatory, or service arrangements.

1. Withdrawal of Consent to Biometric and Tracking Processing

To the extent that any surveillance or tracking framework within this municipality relies upon consent – whether described as express, implied, implied by presence, implied by service participation, or otherwise – I formally withdraw and withhold consent to:

• The collection of my biometric information;
• The extraction of facial images into biometric templates;
• The creation of embeddings, vectors, or other biometric identifiers;
• Automated number plate indexing linked to identifiable individuals;
• Any profiling, classification, watchlisting, or automated matching processes;
• The tracking, logging, or monitoring of my movements, property usage, or waste disposal patterns through RFID-enabled bins or similar tracking devices linked to identifiable individuals or households.

Movement through public space does not constitute informed consent to the collection of sensitive biometric identifiers.

Participation in municipal waste services does not constitute informed consent to tracking, profiling, or behavioural monitoring through RFID systems where such data may be linked to identifiable residents.

Biometric information constitutes sensitive information under the Privacy Act 1988 (Cth). Signage, generalised policy statements, or embedded service terms cannot, of themselves, convert ordinary civic presence or waste service usage into informed consent for biometric or behavioural tracking processing.

2. Demand for Full Disclosure

Council is required to provide full and specific disclosure of:

A. Surveillance and Tracking Register

A complete register of all public-space camera, sensor, ANPR, biometric, and RFID-enabled systems within the municipality.

B. Data Collection and Control

For each system:

• Who collects the data;
• Who controls and determines its use;
• Who stores the data;
• Whether third-party vendors host or process the data;
• Whether data from RFID bin systems is linked to individual households or ratepayer records.

C. Data Type and Processing

For each system:

• Whether facial recognition capability exists (live or retrospective);
• Whether biometric templates are created;
• Whether ANPR systems extract and index plate data;
• Whether RFID bin systems record collection frequency, timestamps, location data, contamination events, weight metrics, or other usage analytics;
• Whether automated analytics, alerts, behavioural scoring, or compliance systems are used.

D. Retention and Deletion

• Retention periods;
• Deletion procedures;
• Whether de-identification occurs and how it is verified;
• Whether RFID bin data is retained beyond operational logistics purposes.

E. Access and Sharing

• Who has access (roles and entities);
• Whether police have direct system access;
• Whether data is shared with state, federal, or private entities;
• Whether vendor personnel have remote administrative access;
• Whether any data leaves Australia.

F. Governance Instruments

• Privacy impact assessments;
• Council resolutions authorising deployment;
• Vendor contracts relevant to data control and access;
• Oversight and audit mechanisms specific to RFID waste tracking systems.

2A. Privacy Impact Assessment Requirement

Council is required to confirm whether a Privacy Impact Assessment (PIA) was conducted prior to:

• Deployment of any facial recognition capability;

• Deployment of any ANPR indexing system;

• Deployment or embedding of RFID tracking devices in municipal waste bins;

• Expansion of analytics, automated alerting, profiling, or cross-database linkage.

If a PIA was conducted, please provide:

• The date of commencement and completion;

• The scope of assessment;

• Identification of stakeholders consulted;

• A mapping of personal information flows;

• The identified privacy risks;

• The mitigation strategies adopted;

• Evidence of implementation and review.

If no PIA was conducted prior to deployment, please state that expressly.

The absence of a PIA in circumstances involving biometric processing or household-linked RFID tracking would raise serious questions as to whether Council properly assessed necessity, proportionality, risk, and community expectations prior to implementation.

Failure to undertake adequate privacy risk assessment may be relevant to questions of governance, foreseeability of harm, and exposure to liability.

2B. Ongoing Review Obligation

Council is further required to confirm whether any PIA (if conducted) has been reviewed and updated following implementation, including:

• Any expansion of data categories;

• Any change in vendor arrangements;

• Any integration with external systems;

• Any enforcement or compliance application.

A PIA is not a one-time formality. It is an ongoing governance instrument. Failure to monitor and review privacy impacts following deployment may indicate systemic governance deficiency.

3. Public Space, Municipal Services, and Proportionality

Public streets and civic areas are not private premises entered under a revocable licence. Conditioning movement through public space on acceptance of biometric scanning is fundamentally different from ordinary CCTV recording for post-incident investigation.

Similarly, access to essential municipal services – including waste collection – is not a voluntary commercial transaction. The embedding of RFID tracking technology in bins linked to identifiable households raises distinct concerns where such systems extend beyond logistical management and into behavioural monitoring, compliance tracking, or profiling.

Where systems extract biometric identifiers, enable automated identification, facilitate persistent indexing of individuals, or monitor identifiable household behaviour, materially heightened standards of transparency and accountability apply.

4. Procedural Fairness and Automated Classification

If any system:

• Flags individuals or households;
• Links individuals to watchlists or compliance registers;
• Generates automated alerts;
• Enables tracking across locations;
• Influences enforcement, intervention, penalty notices, or service restrictions;

then procedural fairness concerns arise.

Facial recognition technologies are probabilistic and subject to false matches. RFID-linked compliance or analytics systems may generate inaccurate or misleading inferences about resident behaviour.

Where probabilistic or automated outputs are operationalised in ways that affect individuals or households, fairness, reviewability, and accountability are essential safeguards.

5. Notice Regarding Non-Consensual Collection, Tracking, and Privacy Interference

If Council, its contractors, or any sanctioned third party has collected or processed my personal information – particularly biometric information or RFID-linked behavioural data – without lawful authority or valid consent, such conduct may give rise to causes of action including breach of confidence, misuse of private information, negligence, trespass to the person (where applicable), or other recognised wrongs.

Where surveillance or tracking systems are operated by contractors or vendors pursuant to Council authorisation or delegation, Council may bear vicarious liability or non-delegable responsibility for wrongful acts carried out in the course of those arrangements.

Further, I hereby give notice that a fee of [fee per trespass] shall apply to each future instance of non-consensual collection, processing, indexing, retention, or behavioural tracking linked to my person or household.

This fee is notified as a reasonable pre-estimate of administrative, reputational, and compliance costs incurred in addressing unauthorised processing.

Nothing in this notice limits my right to pursue remedies arising at common law, including damages, equitable relief, and injunctive relief, in a court of competent jurisdiction in respect of any unauthorised collection, use, disclosure, retention, or processing of my personal, biometric, or RFID-linked data.

Such remedies may include claims sounding in tort, breach of confidence, misuse of private information, trespass, negligence, vicarious liability, or other applicable causes of action recognised at common law or in equity.

Council is hereby placed on notice to preserve all records, audit logs, vendor contracts, system configurations, and related documentation concerning surveillance and RFID tracking systems.

6. Required Response

Please provide written confirmation within 28 days:

1. Whether any system within the municipality performs biometric template extraction or automated facial matching;
2. Whether RFID-enabled bins are linked to identifiable households and what data is recorded;
3. Who collects and controls all such data;
4. What safeguards and review mechanisms exist;
5. What steps will be taken to ensure that non-consenting individuals are not subjected to biometric or behavioural tracking.

If Council declines to provide this information, please specify the statutory basis for refusal and the appropriate pathway for formal access.

7. Reservation of Rights

All rights are expressly reserved arising from or connected with the collection, creation, storage, indexing, profiling, matching, disclosure, retention, behavioural tracking, or security of personal information, whether such conduct is asserted to be authorised, permitted, consent-based, or otherwise justified.

Nothing in this notice constitutes acceptance of any purported waiver of privacy rights through mere presence in public space or participation in essential municipal services.

This notice is issued in the interests of transparency, accountability, and lawful governance within the municipality.

Yours faithfully,

[Your Name] [Your Address] [Your Contact Details]

 

Letter to the Minister for Local Government

 

To the Hon. [Full Name] MP
Minister for Local Government
[Ministerial Address]

Dear Minister,

Formal Notice: Council Failure to Provide Substantive Disclosure Regarding Municipal Surveillance and RFID Tracking Systems

I write to formally notify you of serious governance concerns arising from surveillance and tracking systems operating within [Name of Municipality], and the failure of the relevant Council to provide a substantive and complete response to formal requests for disclosure.

This matter concerns surveillance and monitoring infrastructure operating in public streets, civic spaces, transport corridors, precincts, and municipal service systems, including RFID-enabled waste bins linked to identifiable households.

1. Background

A detailed written notice was served on Council requesting disclosure of:

• A complete register of all public-space surveillance systems;
• Identification of any systems capable of facial recognition or biometric template extraction;
• Identification of any Automated Number Plate Recognition (ANPR) systems;
• Identification of RFID-enabled waste tracking systems and whether such systems are linked to identifiable households or ratepayer records;
• Clarification of the entity that collects, controls, stores, and accesses the data;
• Disclosure of retention and deletion policies;
• Details of vendor hosting and administrative access arrangements;
• Copies of privacy impact assessments and authorising instruments.

Council has failed to provide a substantive response. Material questions remain unanswered or have been addressed in generalised terms that do not permit meaningful public scrutiny.

The absence of clarity concerning both public-space surveillance and RFID-linked municipal service tracking undermines transparency, public confidence, and democratic accountability.

2. Nature of the Concern

The concern extends beyond conventional CCTV recording for post-incident investigation.

It includes whether systems operating within public space or municipal services:

• Extract facial images into biometric templates;
• Perform automated facial matching;
• Generate searchable vehicle indices through ANPR;
• Extract and log behavioural data through RFID-enabled bins;
• Link individuals or households to watchlists, compliance registers, or alert databases;
• Enable tracking, profiling, or automated classification;
• Share data with external agencies or private vendors.

Biometric information constitutes sensitive information under the Privacy Act 1988 (Cth). While RFID bin systems may not involve biometric data, they may involve behavioural data linked to identifiable households, raising proportionality and privacy concerns where such data is retained, analysed, or operationalised beyond logistical necessity.

Public streets and civic areas are not private premises entered under a commercial licence. Likewise, essential municipal services such as waste collection are not voluntary commercial arrangements. Residents cannot reasonably be treated as having provided informed consent to biometric processing or behavioural tracking by mere presence or participation in compulsory local services.

3. Procedural Fairness and Automated Classification

Where surveillance or tracking systems:

• Flag individuals or households;
• Generate automated alerts;
• Link persons or properties to watchlists or compliance systems;
• Influence monitoring, intervention, penalty notices, or enforcement decisions;
• Enable tracking across multiple locations;

fairness and accountability considerations arise.

Facial recognition technologies are probabilistic and subject to false matches. RFID-linked analytics may generate inaccurate inferences regarding household conduct or compliance.

Where probabilistic or automated outputs are operationalised in ways that affect individuals or households, the absence of notice, accessible review mechanisms, and independent oversight raises serious rule-of-law concerns.

The issue is not that Council exercises judicial power, but that opaque automated classification systems may materially affect residents without transparency or procedural safeguards.

4. Withdrawal of Consent

To the extent that any surveillance or tracking framework within the municipality relies upon consent – whether described as express, implied, implied by presence, implied by service participation, or otherwise – I formally withdraw and withhold consent to:

• The collection of my biometric information;
• The extraction of facial images into biometric templates;
• The creation of biometric identifiers or embeddings;
• Automated number plate indexing linked to identifiable individuals;
• The logging, profiling, or behavioural tracking of my household through RFID-enabled municipal service systems;
• Any automated classification, compliance scoring, or watchlisting processes.

Movement through public space and participation in essential municipal services do not constitute informed consent to such processing.

5. Potential Liability and Vicarious Responsibility

If Council, its employees, contractors, agents, or sanctioned third parties have collected or processed personal, biometric, or RFID-linked behavioural information without lawful authority or valid consent, such conduct may give rise to causes of action including breach of confidence, misuse of private information, negligence, trespass to the person (where applicable), or other recognised wrongs.

Where surveillance or tracking systems are operated by contractors or third-party vendors pursuant to Council authorisation, contract, or delegation, Council may bear vicarious liability or non-delegable responsibility for wrongful acts carried out in the course of those arrangements.

The engagement of external vendors does not necessarily extinguish governance responsibility where Council has authorised, facilitated, or sanctioned the surveillance or tracking activity.

Further, I hereby give notice that a fee of [fee] shall apply to each future instance of non-consensual collection, processing, indexing, retention, or behavioural tracking linked to my person or household.

This fee is notified as a reasonable pre-estimate of administrative, reputational, and compliance costs incurred in addressing unauthorised processing.

Nothing in this notice limits my right to pursue remedies arising at common law, including damages, equitable relief, and injunctive relief, in a court of competent jurisdiction in respect of any unauthorised collection, use, disclosure, retention, or processing of personal, biometric, or RFID-linked data.

Such remedies may include claims sounding in tort, breach of confidence, misuse of private information, negligence, trespass, vicarious liability, or other applicable causes of action recognised at common law or in equity.

6. Ministerial Oversight Requested

Given Council’s failure to provide adequate disclosure regarding surveillance and RFID-enabled municipal tracking systems, I respectfully request that you:

1. Require Council to provide a complete and transparent surveillance and tracking system register;
2. Clarify whether State-level policy guidance exists concerning biometric surveillance and RFID-enabled municipal tracking by local government;
3. Confirm the oversight mechanism applicable where councils fail to provide substantive transparency;
4. Advise whether ministerial review or intervention powers may be engaged in circumstances of governance deficiency.

7. Preservation of Records

Council and any relevant agencies are placed on notice to preserve all records, contracts, audit logs, configuration documentation, privacy assessments, and vendor agreements relating to municipal surveillance and RFID tracking systems.

I request written acknowledgement of receipt of this notice and advice as to what steps will be taken to address the matters raised.

This correspondence is provided in the interests of transparency, accountability, and the preservation of lawful governance within the State.

Yours faithfully,

[Your Name] [Your Address] [Your Contact Details]

Notice to a council to remove RFID devices

To the Chief Executive Officer
[Name of Council]

Cc: General Counsel, Director of Waste Services, Elected Members

Dear Sir/Madam,

Formal Notice: Objection to RFID Tracking Devices (Installed or Proposed) in Relation to Waste Bins at [Your Address / Lot Description]

I write to formally notify Council that any RFID (Radio Frequency Identification) tracking devices that may be installed, embedded, affixed, activated, or proposed to be installed on municipal waste bins allocated to my property at [address / lot description] are not accepted.

If such devices are presently installed, embedded, or active, this notice applies immediately. If such devices are proposed, planned, or scheduled for installation, this notice applies prospectively and is to be treated as a clear refusal of consent.

The embedding or attachment of RFID devices capable of uniquely identifying bins assigned to my land, and potentially logging usage data linked to identifiable occupants or ratepayer records, constitutes a form of tracking and data collection to which I do not consent.

1. Withdrawal of Consent

To the extent that Council asserts that participation in municipal waste services constitutes consent to RFID-enabled tracking, logging, profiling, or behavioural monitoring, I expressly withdraw and withhold consent to:

• The logging of bin presentation dates or times linked to my property;
• The recording of bin weights, contamination events, or other compliance metrics associated with my address;
• The linking of RFID identifiers to ratepayer, occupancy, or personal records;
• Any profiling, analytics, enforcement flagging, or automated decision-making derived from RFID-collected data.

Participation in essential municipal services does not constitute informed consent to tracking technologies beyond what is strictly necessary for operational logistics.

2. Notice to Remedy Within Seven (7) Days

Council is hereby given seven (7) days from receipt of this notice to:

1. Confirm in writing whether any RFID devices are currently installed, active, or linked to bins allocated to my property;
2. Confirm whether any such devices are planned or scheduled for installation; and
3. If installed or planned, confirm that they will be deactivated and rendered inoperable, or that RFID-free bins will be provided in substitution.

If Council does not take one of the above steps within seven (7) days, I will treat the continued or proposed presence of RFID tracking devices on bins assigned to my land as an unauthorised data-collection mechanism imposed without consent.

In that event, any RFID devices identified on bins allocated to my property will be made available to Council for collection at a mutually convenient time, and all rights will be reserved in relation to any ongoing tracking or data processing linked to my property.

3. Disclosure Required

Please also confirm in writing:

• Whether RFID identifiers are linked to identifiable household or ratepayer records;
• What data is recorded and retained;
• Retention periods;
• Whether any analytics, compliance scoring, or enforcement triggers are applied;
• Whether any third-party vendors host, have access to, or process RFID data;
• Who has access to such data.

4. Reservation of Rights

All rights are expressly reserved in relation to any unauthorised collection, tracking, profiling, storage, or use of personal or household-linked data.

Nothing in this notice constitutes acceptance that participation in municipal waste services equates to consent to behavioural tracking or data analytics beyond operational necessity.

I request written acknowledgement of receipt of this notice and confirmation of Council’s proposed course of action within seven (7) days.

Yours faithfully,

[Your Name] [Your Address] [Your Contact Details]

 

Last Updated 7 months ago

Views: 235