If police think this is lawful and ethical, why did they try to hide it?

RNZ has a major scoop this morning: the New Zealand Police are trying to set up a live facial recognition system:

Police have been quietly setting up a $9 million facial recognition system that can take a live feed from CCTV cameras and identify people from it.

This would push New Zealand into new territory for tracking citizens.

It will be run by a non-police contractor - US firm Dataworks Plus - and collect 15,000 facial images a year, with that expected to expand up to 10-fold.

[...]

Both said they did not tell the public as these are mere upgrades, and neither did a Privacy Impact Assessment - though Internal Affairs told the Privacy Commissioner about NeoFace, while the police did not.

That last bit is a giant red flag. The Privacy Commisisoner has said explicitly that any use of facial recognition needs a high level of scrutiny, which for a government agency, effectively means their approval. Police deliberately avoided doing that. From the article, they also explicitly lied in earlier OIA responses, saying that the system was only about analysing static images in their database, while redacting information showing that it was intended to work with live video feeds. Why did they do this? The natural conclusion is that despite all their claims to be lawful and ethical, they know that this project is not. So instead they spent $9 million of public money on it, in secret, while lying to us about what they were doing. And that shows us that we have an unethical agency, completely out of control, which has complete contempt for the people it is supposed to serve.

Unmentioned in the article: this sort of use of facial recognition has recently been ruled unlawful in the UK, precisely because the police force using it ignored their privacy obligations and their obligations to not discriminate on the basis of race. And on this point, the New Zealand Police appear to be making exactly the same mistake:

The tender that Dataworks won for police here, does not mention "Māori" or "public" or "privacy" - in relation to specific safeguards on the public's privacy - a single time in scores of pages.

Which I guess is the usual level of care the police show for their legal obligations. As far as they're concerned, laws apply to other people, not to them.