It’s ironic that most companies use video surveillance cameras to watch for trouble, not realizing that improper use of these cameras could get a company into trouble.
A recent study at the University of Toronto concluded that the vast majority of Canadian businesses operating security cameras do so with little regard for federal privacy legislation. Although the signage requirements under the Personal Information Protection and Electronic Documents Act (PIPEDA) are simple, the research (published at surveillancerights.ca) points to an overwhelming number of cases in which video surveillance is carried out without stating a purpose for doing so or offering a contact number for more information.
Andrew Clement, the professor in the U of T’s Faculty of Information who presided over the study, tells me that it has been three years since he started offering a $100 reward for reports of compliant cameras, but the money has yet to find a deserving claim. Ontario’s Information and Privacy Commissioner, Ann Cavoukian, had this to say: “I find it disappointing that so many businesses have no signage in place to keep the public informed of the use of surveillance cameras. ”
The findings should be a concern to businesses because any passer-by can trigger a potentially lengthy and embarrassing privacy investigation. Audits by a privacy commissioner are nothing to sneeze at. They can be invasive and expensive, leaving an indelible mark on the business in the form of a public report on the website of the Office of the Privacy Commissioner of Canada (OPC) or potentially leading to lawsuits if the commissioner finds that the complaint is “well founded.” And they’re certainly not the kind of thing you would want to show up in Google search results.
The Office of the Privacy Commissioner of Canada makes it clear that:
In keeping with Principle 4.3 of PIPEDA, all retail organizations using video surveillance in their stores must give patrons clear and sufficient notice about the collection of their personal information. The notice should, moreover, be posted at the entrance, so that customers can exercise their right to withhold consent by not entering the premises.
Information about an organization’s personal information management practices, including video surveillance, should be readily accessible.
Failing to comply with the rules under PIPEDA could spell trouble for any business, a fact that Sobeys can attest to. The grocery chain faced an investigation by the Privacy Commissioner and the threat of a lawsuit after a shopper at one of its stores in New Brunswick complained to the commissioner about being videotaped without her consent.
The good news is that compliance is easy when it comes to signage and notification. Operators simply need to realize that filming people is akin to collecting personally identifiable information, and what could be more personally identifiable than an image or a video clip of a person? Here is a quick and effective way to stay on the good side of regulators:
- Post clear signs making people aware of your video surveillance before they enter
- Succinctly state the owner and purpose of the video surveillance and
- Provide an easy access phone number for clarification and footage requests
“While people may not be surprised by the growth of such technology in public spaces, they should be advised of its presence, why it is being used and who they can contact for more information,” says Cavoukian. She wrote a paper that can serve as a tool for organizations called Guidelines for the Use of Video Surveillance Cameras in Public Places.
The OPC also recommends creating proper documentation and descriptive policies to guide video surveillance efforts “in the most privacy-sensitive way possible” before surveillance is undertaken. For the details refer to the handy Guidelines for Overt Video Surveillance in the Private Sector. While you’re at it, take a glance at the Policy on Covert Video Surveillance, which is also on the OPC website.
All in all, preventive compliance is better—and easier—than remediation. But if you’re thinking of Googling images of proper privacy notices and signage for surveillance cameras, you may be disappointed. Searches yield no shortage of intimidating stickers and signs, but none that are compliant with the legislation. So don’t rely on stickers designed to deter and intimidate to count as a “privacy-sensitive way” of meeting your legal obligations.
Claudiu Popa is a corporate security and privacy-risk advisor, and president and CEO of Informatica Corp. He is also co-author of The Canadian Privacy and Data Security Toolkit (Canadian Institute of Chartered Accountants, 2009) and Managing Personal Information (Reuters, 2012).
More columns by Claudiu Popa