By McInnes Cooper
An increasing number of municipalities in Canada are using public video camera surveillance to promote public safety and help deter crimes like vandalism and theft. But public video camera surveillance can – and does – impact the privacy of individuals who might be captured on video. To ensure compliance with Canadian privacy laws and best practices, municipalities must, before implementing any video surveillance, find the right balance between achieving legitimate civic purposes and the public’s right to privacy. So, before you flick the switch on your video surveillance system, follow these five key steps.
- Understand Your Collection, Use & Disclosure Compliance Obligations
Public bodies in Canada, including municipalities, are subject to provincial access to information statutes that govern their collection, use and disclosure of personal information. Generally, access to information statutes define “personal information” as “recorded information about an identifiable individual”. So, a video image or recording of an individual captured by a municipality on a video camera system is “personal information” where an individual might be identified from that video image or recording. While each statute varies, all impose specific obligations on a municipality relating to collection, use and disclosure of personal information. In general, municipalities must:
- Ensure any collection of personal information is authorized or required under the law, or is necessary for a service, program or activity of the municipality.
- Notify individuals of the purpose for collection of information, including via video surveillance (for example, through appropriate signage).
- Limit use and disclosure of the information to that which is necessary to achieve the purpose for which it was collected.
- Protect the information by reasonable security arrangements.
To ensure compliance, it is important to identify which privacy and access laws are applicable.
- Prepare a Privacy Impact Assessment (PIA)
A PIA is a tool used to identify privacy risk and mitigation strategies associated with the use of personal information. While not every provincial privacy statute mandates them, a PIA is extremely useful to help ensure a public body’s collection, use and disclosure of personal information, including via a video surveillance system, complies with statutory obligations and privacy best practices. Given the potentially serious privacy implications of video surveillance, a public body should always undertake a PIA before implementing a video surveillance system.
The federal Office of the Privacy Commissioner (OPC) has published Guidance on the use of overt video surveillance (video surveillance that the public is aware of, both through notification via clear signage, and obvious placement of video cameras or other recording devices) in the private sector. While public bodies using video surveillance for purposes related to safety and property protection generally wouldn’t be subject to Canada’s private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA, soon to be replaced by the Consumer Privacy Protection Act or CPPA), the OPC Guidance is considered best practice. Similarly, some provincial privacy regulators, such as the Office of the Information and Privacy Commissioner of Nova Scotia (OPIC NS), have issued guidance with respect to the implementation and use of overt video camera systems. Although framed differently, both the federal OPC and the OIPC NS Guidance recommend that before a public body (or any organization) implements overt video surveillance, it consider whether:
- Video surveillance is demonstrably necessary to meet a specific need and is likely to be effective in meeting that need.
- The loss of privacy is proportional to the need.
- There is a less privacy-invasive way of achieving the same end goal.
A PIA will allow a municipality to fully assess these and more specific privacy considerations respecting use of video surveillance systems. Some privacy regulators offer PIA templates that guide public bodies through the relevant considerations, including an analysis of risks and mitigation strategies to help comply with applicable privacy laws. For example, the OIPC NS has published a OIPC NS PIA Template for use by public bodies in Nova Scotia.
A thorough and well-documented PIA showing a clear assessment of risks and privacy impacts is crucial in the event your use of video surveillance systems is challenged – such as if a member of the public makes a privacy complaint.
- Prepare a Video Surveillance Policy
Once you’ve completed your PIA, use it to create a written video surveillance policy. The federal OPC Guidance recommends a video surveillance policy as a best practice and describes in detail what that policy should include:
- The rationale and purpose of the video surveillance system.
- The location and field of vision of the video surveillance equipment.
- Any special capabilities of the system, for example, sound, zoom, facial recognition or night-vision features.
- The rationale and purpose of the specific locations of equipment and fields of vision selected.
- The personnel authorized to operate the system and access the information it contains.
- The times when surveillance will be in effect.
- Whether and when recording will occur.
- The place where signals from the equipment will be received and monitored.
- Guidelines for managing video surveillance recordings, including security, use, disclosure, and retention.
- Procedures for the secure disposal of video surveillance recordings.
- A process to follow if there is unauthorized disclosure of images.
- Procedures for individuals to access personal information captured and challenge any suspected failure to comply with the policy.
- Sanctions for the organization’s employees and contractors for failing to adhere to the policy.
- The individual accountable for privacy compliance and who can answer any questions about the surveillance.
Similarly, some provincial privacy regulators have issued guidance. For example, the OIPC NS has prepared a Video Surveillance Policy Template suggesting the sections a video surveillance policy should include nine sections:
- Purpose.
- Collection.
- Notification.
- Use.
- Disclosure.
- Security.
- Retention.
- Access to Information Requests.
- Contact Information.
- Be Ready to Respond to Access to Information Requests
Access to information statutes also:
- Give individuals a right of access to any records that are in the municipality’s custody or under its control (subject to certain exceptions), including records that contain their own personal information.
- Outline the process through which individuals can request access to such information and how public bodies must respond to such requests.
Before you hit the “on” switch:
- Make sure you’re ready to respond to any access requests made by individuals with respect to their own personal information you collect through a video camera system in accordance with your statutory obligations.
- Consider how you can protect the privacy of other individuals who might appear in requested videos (for example, does the video system include face-blurring technology?).
- Review Regularly
Finally, create a plan to regularly review and re-evaluate whether you need to conduct video surveillance at all, and if you do, whether you need to make any adjustments to where or how you conduct it or to your related policies and procedures (including staff training) to ensure that your collection, use and disclosure of personal information continues to be in keeping with your purpose, best practices, and you continue to comply with your privacy law obligations.
Please contact your McInnes Cooper lawyer or any member of our Privacy, Data Protection & Cyber Security Team @ McInnes Cooper to discuss your use of public video surveillance.
This article is information only; it is not legal advice. McInnes Cooper excludes all liability for anything contained in or any use of this article. © McInnes Cooper, 2024. All rights reserved.
