Canadian businesses need to pay close attention to the government’s new video surveillance guidelines to avoid landing in hot water over privacy complaints. Ignoring the guidelines could mean facing an investigation by the privacy commissioner or even a court action over complaints from the public.

The guidelines apply to overt video surveillance by the private sector. They were developed by the federal privacy commissioner, Jennifer Stoddart, who operates under the Personal Information Protection and Electronic Documents Act (PIPEDA), in conjunction with the privacy commissioners of B.C. and Alberta, whose provinces have their own privacy legislation.

Setting up the guidelines in conjunction with the provinces means they will apply identically across Canada, said Stoddart, noting that Quebec didn’t formally sign on but is in agreement with them.

The guidelines assist businesses in understanding and applying existing privacy legislation in the context of video surveillance.

“We’re saying to the private sector, which has long being using video surveillance, to please remember there are privacy laws,” said David Loukidelis, privacy commissioner of B.C. Even though businesses are recording in a public or quasi-public place, they need to follow the personal information protection legislation.

“We’re trying to get that message out and encourage best practices that also comply with the law,” Loukidelis said. Businesses should determine if there is a less privacy-invasive alternative to video surveillance by examining their needs and considering whether they have a business case for using it. Once they go through this process, they may determine that a less privacy-invasive alternative is acceptable, Loukidelis said.

Although the guidelines aren’t regulations or legislation, businesses should follow them in order to strengthen their position in an investigation by the privacy commissioner or in court, should they find themselves at the wrong end of a privacy complaint.

“This is our guidance, our interpretation of the Act,” Stoddart said. “We are willing to take the necessary steps to uphold this interpretation. If somebody makes a complaint, we investigate on our own initiative and expect that the practice of overt surveillance will be corrected to conform to these guidelines. If it’s not and we don’t think it’s justified, we’re willing to take it to federal court. That’s our policy.”

Lawyers can use the guidelines to assist organizations in the development of procedures for video surveillance, said Fazila Nurani, a lawyer specializing in privacy and information security issues. When she assesses an organization that engages in surveillance, the guidelines will give her a framework to ensure that she has considered all the angles in introducing that surveillance.

The guidelines can be put directly into a company’s policies and practices around surveillance, Nurani said.

“If it’s put into their procedures, whoever is in charge of surveillance within the organization has to comply with them,” Nurani said. “That’s where it’s really useful.”

The guidelines require businesses to establish a business reason for conducting video surveillance and use it only for that purpose. An exception is when the cameras capture an image showing someone breaking the law.

“If there’s something that involves a violation of the law, for example if a car is broken into, the information can be disclosed to law enforcement,” Nurani said. But generally the use of video surveillance must adhere to its original intent.

“I can see there being a lot of ‘slippery slopes’ arguments because organizations who are capturing things on cameras that they didn’t expect to will want to use that information for their benefit,” Nurani said.

“When you do surveillance, which is collecting information, there’s always another use for that information,” said Frank Work, privacy commissioner for Alberta. “For example, with cameras in downtown Calgary, you put them up for safety purposes, you want to discourage pickpockets and muggers from subway platforms...

“Inevitably, someone will think of another use for them. The planners want to monitor the cameras to see traffic patterns in subway stations. It gets hard to argue with that... So then you have to deal with these secondary uses; you have to be prepared to say no. It becomes ‘function creep’ after a certain point. Inevitably you start identifying people... You go from one step to the next step all in a good cause, but pretty soon you’re monitoring people constantly.”

The guidelines require businesses to inform the public that video surveillance is taking place.
 “As we move to this new kind of technological monitoring, which can have benefits in terms of safety and security, it’s important that people know about it, that there are signs saying that there is video surveillance,” Stoddart said. “If I go in a store with video surveillance, I can walk up and have access to my image. My privacy rights apply to that situation. I should be able to go to the store, say that I was in the store at 4:15, and ask for a copy of the picture that was taken of me.”

However, Nurani noted that access rights can create other privacy issues.

“You cannot violate someone else’s privacy in providing access,” Nurani said. “If you’ve recorded a number of people on tape, and someone wants access to their recording, you’re going to have to be able sever out the other personal information unless you get their consent as well.”

This could prove difficult from a practical point of view, she said.

Nurani also has concerns around consent by the public to surveillance. The guidelines don’t address the issue of conferences or organized events with video surveillance that’s not in the context of safety, where it may be being recorded for the benefit of members who can’t attend.

“These guidelines don’t actually talk to consent at all,” Nurani said. “They talk about video surveillance in the context of safety or security. But in the context of someone saying they don’t want to be taped and they’re going into a meeting with a hundred people in a room, what do you do? I get that question a lot.

“It’s not practical to give people the option of saying, ‘don’t record me.’ The only other option is that they don’t participate in the event,” Nurani said.

Nevertheless, the guidelines offer direction for dealing with a method of information collection that’s not going to go away.

“There’s no turning it back, there will always be some form of surveillance,” said Work. “The intent of the guidelines is to retain some humanity in it.”