The investigation - carried out by the Privacy Commission and Independent Police Conduct Authority (IPCA) - had determined practices were unlawful, and policies and training had been missing for years, she said.
"Police do need to change their practices.
"It is the hope ... that police take that opportunity to change, and take it now."
National and ACT have expressed sympathy for police.
The government said it was open to any advice police might have about where to strike the balance between privacy and evidence gathering.
Deputy Privacy Commissioner Liz MacPherson. Photo / Mark Mitchell, File
However, MacPherson said her office was not under political pressure.
"What we've said very clearly in the report is that there are some current practices that are unlawful.
"We've also said that if the police feel and have evidence that the collecting of information about young people who haven't committed a crime, or who haven't been convicted, is a deterrent in some way, shape or form, then they need to provide the evidence for that," MacPherson said.
"And they need to take that through a policy process and put it in front of Parliament."
For at least 15 years, police took duplicate fingerprints of young people in custody, including young Māori. Though this was unlawful, it had even become a training requirement for new officers to do.
A Privacy Commission compliance notice nine months ago ordered a stop to it.
There is also pressure on police to stop routinely taking photos of drivers at traffic stops and checkpoints, or using these to collect intelligence on gangs, unless it is justifiable.
Police have said complying with the notice was causing them "significant" challenges in fighting crime.
That initial reaction from police was "disappointing", MacPherson said.
"It will not stop fighting crime.
"If the police were investigating a ram raid, the Privacy Act would not stop them doing that. Same goes for gangs.
"The threshold that we've set in the report is that there only needs to be a reasonable possibility that that photograph is relevant for either a current investigation or a likely investigation," she said.
"So from that perspective, there is nothing stopping the police from undertaking that lawful intelligence gathering.
"The Privacy Act will, in fact, support them in securing information in a lawful way, and also help build trust with the very communities that they're trying to keep safe."
The first three progress reports on deleting photos and stopping taking them, are now on the police website.
These raised further questions.
For instance, Police Commissioner Andrew Coster earlier told RNZ they had deleted 6000 photos nine months after the Office of the Privacy Commissioner (OPC) told them to.
But the first report said that by March this year they had already deleted almost twice that - 11,000.
RNZ has queried the discrepancy.
The latest one said four out of 14 tasks had been completed: Stopping taking "casual" photos or fingerprints from rangatahi in public or in custody, and deleting photos of rangatahi in custody taken unlawfully.
However, one of those 10 requirements, that officers stopped using devices, including smartphones not connected to the National Intelligence Application (NIA) to take photos of adults in custody, had been completed only "as far as reasonably practical".
The OPC said this allowed for letting officers use smartphones if police station equipment broke down, but in that case any photos had to then be uploaded to the NIA and deleted from the phone.
The NIA has an automated system for purging photos that are not needed for investigations, but thousands of photos lie scattered in other police systems, or simply on their phones, out of reach of periodic purges.
