Last month in “Video surveillance and the workplace – Part 1,” we reviewed some recent legal cases and developments related to video surveillance and privacy in the workplace. The common thread running through these (and many other) legal decisions is the tendency for Canadian employers to install video surveillance cameras with little or no consideration of the privacy implications.

This second instalment looks at the issue of compliance with privacy legislation. We introduce recent research on compliance in the private sector and suggest actions that employers can consider in implementing and operating effective, privacy-compliant video surveillance systems.

Recent developments in British Columbia

The collective awareness of privacy obligations related to video surveillance tends to be quite high amongst public-sector employers and organizations. In contrast, a mixture of incognizance and apathy often prevails in the private sector when it comes to understanding and applying legal privacy considerations in the installation and use of video cameras.

British Columbia’s Information and Privacy Commissioner (BCIPC), in recognizing this general lack of awareness, recently launched a high profile public education initiative on video surveillance in the private sector. In explaining the rationale behind its public outreach campaign, the BCIPC, Elizabeth Denham, stated:

We’re focusing on the private sector—and the retail sector in particular—because we believe many such businesses are unaware of the obligations created by their use of video surveillance, including their obligation to notify customers about surveillance and its purpose, and to minimize the impact on personal privacy.… Under the Personal Information Protection Act [PIPA], companies must have a defined problem that the surveillance is designed to address, and customers must be notified before they are captured on camera.

The first step in the BCIPC’s campaign was a research study of British Columbia-based retail businesses to ascertain the level of awareness and compliance with obligations under BC’s privacy legislation, PIPA. According to local media reports, the research study found that only three percent of downtown Vancouver and Victoria businesses using video cameras were complying with PIPA. At almost the same time as the BCIPC conducted its study, a University of Toronto research team published findings from a similar study conducted in Toronto.

University of Toronto research study

In publishing “Private Sector Video Surveillance in Toronto: Not Privacy Compliant!,” the U of T research team reported its findings from field research conducted on 144 private sector video surveillance camera schemes operated by major service providing corporations within the Greater Toronto Area. (A PDF copy of the report can be downloaded for a nominal fee.) The objective of the research was to ascertain the level of awareness and compliance with legal privacy obligations under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) in the operation of video surveillance systems.

The U of T researchers sought to address the following questions:

1. How extensive is video surveillance in the private sector in the GTA?
2. Are private sector video surveillance operators aware of PIPEDA? Are they compliant with PIPEDA requirements?
3. What notification do video surveillance operators provide, both publicly and on request, about their use of such surveillance?
4. What can an individual expect in terms of the collection of their personal information? If an individual attempts to exercise her or his rights under PIPEDA, will an organization respect the person’s rights to request and access that information (i.e., video surveillance images)?

The researchers began by identifying legal compliance standards against which to benchmark each of the 144 video surveillance systems. The following legal standards were identified:

• Earlier determination made by the Office of the Privacy Commissioner of Canada (OPC) that both video recordings and live video monitoring constitute the “collection of personal information” and are governed by PIPEDA
• Requirement within PIPEDA to notify the public of the presence and purpose of video surveillance prior to the capture of personally identifiable information by video cameras
• “Guidelines for Overt Video Surveillance in the Private Sector” developed jointly by the OPC and the privacy commissioners of BC and Alberta

Research findings

Both PIPEDA and the Guidelines for Overt Video Surveillance in the Private Sector identify a need to provide visible notification of the presence of video surveillance. In Phase 1 of the U of T study, only 16 of 45 business locations (35 percent) using video surveillance provided any form of public notification that video surveillance was in effect. In Phase 2, only 26 of 99 store locations (26 percent) in two major shopping centres within the GTA gave any public notification that cameras were in use. As noted by the researchers, “The high percentage of video surveillance in use without any corresponding notification—65 percent in Phase 1 and 74 percent in Phase 2—clearly violates PIPEDA.”

In addition to establishing whether the required notification signage was in place, the researchers also took steps to identify the size, placement and verbiage associated with any video surveillance signs in existence. As explained in the research report:

Under PIPEDA, organizations collecting private information must clearly state the purpose of such collection, and must do so before actually collecting it. In the case of video surveillance, this means the presence and purpose of video surveillance on an easily readable sign before individuals enter the surveilled space.

Of the 42 business locations providing notification of video surveillance, none were judged to be in full compliance with PIPEDA. Either the wording was very basic with insufficient detail as to the purpose of the camera system or the signs were so small or inconveniently placed that they served no practical purpose.

The U of T researchers concluded:

A major factor than can help explain the current low level of PIPEDA compliance is what can be called a “security override,” in which claims of security trump all other concerns, including personal privacy and the privacy rights to which all Canadians are legally entitled.

Guidelines for overt video surveillance in the private sector

The federal, Alberta and BC privacy commissioners came together to issue joint “Guidelines for Overt Video Surveillance in the Private Sector” in 2008 aimed at fostering compliance with provincial and federal privacy legislation. These guidelines have been referred to in cases decided by the OPC and they are regarded as a primary legal privacy standard in Canada.

The guidelines identify “10 things to do when considering, planning and using video surveillance.” The 10 steps are reproduced below with some practical considerations for organizations operating video surveillance systems and wishing to optimize compliance with legal privacy requirements.

1. Determine whether a less privacy-invasive alternative to video surveillance would meet your needs

All too often, video surveillance cameras are installed in a business or workplace with little forethought. In this scenario, organizations give little consideration to less privacy-invasive alternatives to video surveillance. Less privacy-invasive alternatives include:

• Developing or adapting existing policies or procedures
• Enhancing supervision and oversight
• Enhancing physical security (e.g., locks, intrusion alarms, panic buttons)
• Enhancing human security (e.g., patrols by uniformed security personnel)
• Conducting an internal investigation and interviewing potential witnesses

2. Establish the business reason for conducting video surveillance and use video surveillance only for that reason

Most video surveillance systems do not have a clearly identified purpose. In this situation, organizations may install new cameras to monitor activity in areas far removed from the original (and intended) scope of the system. Video surveillance should serve a clearly articulated purpose, examples of which include:

• Public/employee safety and security
• Combating unauthorized access
• Coordinating operational activities
• Preventing/deterring criminal and anti-social behaviour
• Supporting criminal investigation and prosecution
• Reinforcing customer/employee confidence

3. Develop a policy on the use of video surveillance

Video surveillance policies are a key component of legal compliance with privacy legislation. Unfortunately, video surveillance policies are relatively rare and often do not fully address legal privacy considerations. A good policy (or set of policies) should incorporate at a minimum:

• Clearly identified purpose of video surveillance
• Criteria to be met for new camera installation
• Acceptable use guidelines (e.g., instructions to those operating the system)
• Access restrictions to live or recorded images
• Physical protection requirements of recording and archiving media

4. Limit the use and viewing range of cameras as much as possible

Video cameras installed with one purpose in mind often end up encroaching on other (unintended) areas or activities. Some steps to minimize this type of “scope creep” include:

• Clearly identify the operational objectives of each camera (i.e., what is the camera intended to achieve/deter/provide/prevent?)
• Establish the type of observation required (e.g., broad area surveillance, verify an incident after an alarm, monitor/track individuals, capture facial details, etc.)
• Align camera specification with the intended use/purpose (e.g., do not specify a wide angle lens if taking this step will extend the field of view to capture unintended areas, do not specify a pan-tilt-zoom camera if taking this step will allow operators to rotate the camera to view areas where there is an expectation of privacy, etc.)

5. Inform the public that video surveillance is taking place

As the recent research studies in BC and Toronto seem to suggest, most camera surveillance systems are not properly identified. PIPEDA specifies that people must be notified of the presence of video cameras and should be able to request and gain access to their personal information (i.e., the video images). Some priorities to consider in setting up a notification system for video surveillance systems include:

• Provide notification (i.e., signs) stating that video surveillance is in effect and position such signs at the outer entrance points to the room/space/building/site
• State the purpose of video surveillance on the sign (e.g., for protection of persons and property on the premises, etc.)
• Use sufficiently large text/graphics on signs and place them in such a position that they are clearly visible to those approaching the location/area (i.e., prior to entry)

6. Store any recorded images in a secure location, with limited access, and destroy them when they are no longer required for business purposes

Most video surveillance cameras are connected to recording units that house a great deal of personally identifiable information and therefore fall under PIPEDA and PIPA protections. These video recorders are often located in poorly secured areas and may be susceptible to unauthorized access. Recorded images are also retained on the recorders for extended periods and this can become a privacy concern. Key considerations here include:

• Take steps to physically protect all locations where video recorders are located (e.g., secure the enclosure housing the video recorder, install secure locks or electronic card access to control/track entry to rooms containing the recorders)
• Only store recorded video for as long as it serves a valid operational purpose. The industry standard is often quoted as “30 days of storage.” In some cases, there is little justification to store video for this long. The cost of retaining 30 days of recorded video can also be prohibitive (i.e., data storage costs)
• A policy mandating immediate archiving (i.e., copying to a removable storage device) of video recordings associated with incidents or complaints can reduce the need to retain video for extended periods in some environments

7. Be ready to answer questions from the public. Individuals have the right to know who is watching them and why, what information is being captured, and what is being done with recorded images

Managers and supervisors often have little idea of the organization’s obligations under privacy legislation when it comes to video surveillance. Company privacy policies should contain a section on video surveillance (if cameras are in use) and managers and employees should know how to respond to questions/requests from the public.

8. Give individuals access to information about themselves. This includes video images

Deciding when and how to share recorded video images with the public or employees is a challenge. One significant obstacle is protecting the privacy of other people who may have been captured in the frame(s) at the same time as the person making the request for video. Rather than being caught unprepared when requests come in, organizations should consider the following options:

• Allow the requesting party to attend the organization’s office to view all or a portion of the video images in question
• Provide a still image of one or more relevant video frames to the requesting party
• Digitally “black out” the images of other persons and provide a copy of the recorded video to the requesting party

9. Educate camera operators on the obligation to protect the privacy of individuals

Anyone tasked with viewing, monitoring or operating a video surveillance system should be governed by clear procedural guidelines. Staff need to be trained in these guidelines. Unauthorized individuals should not be permitted in areas where cameras are displayed. Strict control must be maintained over the release of recorded video to third parties.

10. Periodically evaluate the need for video surveillance

Video surveillance systems have a habit of growing to meet different needs and demands. Organizations should avoid the all-too-common tendency to simply put up a camera any time a new security issue or access control challenge materializes. In some cases, changes in operating conditions or physical design/use of a space can lead to a need to re-evaluate the need for specific cameras. Video surveillance systems are a risk mitigation measure and risk is constantly changing. Therefore, video surveillance systems should be evaluated (perhaps annually) to ensure they remain fit for their intended and stated purpose.

Conclusion

Many organizations, institutions and public authorities have introduced video surveillance as a tool to improve operational efficiencies, elevate employee and customer confidence, and address crime. To effectively manage risk, it is essential that organizations approach video surveillance within a clear governance framework taking account of business objectives, operational requirements and obligations under privacy legislation.

Research suggests that a majority of organizations operating video surveillance systems in Canada are not complying with the letter or spirit of the law when it comes to addressing privacy. The ramifications of this non-compliance can take different forms. Breaches of PIPEDA often lead to negotiated settlements rather than extended, bruising court cases. This may explain some of the prevailing apathy. It should be remembered that we live in a world in which the most minor, technical breach of a law can take on viral, negative proportions through the “new media.” Maybe it is the risk to reputation, rather than the risk of non-compliance, that will lead organizations operating camera surveillance systems to better understand and adhere to legal privacy obligations.

David Hyde, M.Sc., CPC
David Hyde and Associates