The Office of the Privacy Commissioner of Canada (the “Privacy Commissioner”) recently issued its Guidance on Covert Video Surveillance in the Private Sector (the “Guidance”). An understanding of this Guidance is important for everyone engaged in video surveillance, including insurers, employers and those in the broader corporate sector.

Principles

The Guidance makes it clear that covert video surveillance will be subject to the Personal Information Protection and Electronic Documents Act (“PIPEDA”), the federal privacy legislation governing the collection, use and disclosure of personal information in the course of commercial activity. The Privacy Commissioner considers video surveillance to be covert when images are being gathered of identifiable individuals by using video surveillance of which the subject is not aware. The surveillance is considered covert whether conducted in a public place, in a workplace, in the course of an investigation or otherwise. However, in some areas, the Guidance goes beyond PIPEDA, and includes the Privacy Commissioner’s interpretation and understanding of business practices.

The Privacy Commissioner generally considers covert video surveillance to be a form of technology that is very invasive, as a great deal of personal information is collected that may be irrelevant for the purposes of information collection. For example, the Privacy Commissioner asserts that an insurer that conducts surveillance on an individual claiming whiplash has no need to know if that person steals from merchants, breaks into parked cars or cheats on his spouse. Therefore, the Privacy Commissioner is of the view that covert video surveillance “must be considered only in the most limited cases.”

To assist with compliance with the law, the Privacy Commissioner released the Guidance to set out what it considers to be the requirements and guidelines for use of covert video surveillance. However, the Guidance is not absolute, as the Privacy Commissioner considers each complaint on a case-by-case basis.

Characteristics of Legitimate Covert Surveillance

PIPEDA provides that any organization contemplating the use of video surveillance must be sure that the collection, use or disclosure of personal information will be “only for purposes that a reasonable person would consider appropriate in the circumstances.”

According to the Privacy Commissioner, this involves an analysis of several factors, including:

  • a demonstrable, evidentiary need for the covert collection, beyond mere suspicion;
  • whether the collection of information is clearly related to a valid business purpose;
  • a balance between the benefit gained by the business as against an individual’s right to privacy; and
  • whether less invasive measures were exhausted before resorting to the use of covert video surveillance.

These factors, separately and together, should be analyzed in terms of what a reasonable person would consider appropriate before determining that covert video is the most appropriate method of surveillance given the business purpose.

Consent

The Guidance focuses on the fact that covert video surveillance, by its nature, often takes place without the subject’s consent. PIPEDA requires that, with limited exceptions, an individual give consent before personal information can be collected, disclosed or used. The Privacy Commissioner acknowledges that some use of covert video surveillance can be consented to implicitly; for example, where it is necessary to collect information for a defence against a lawsuit initiated by the subject of the surveillance. The Guidance provides that this surveillance and data collection must be limited to what is relevant to the merits of the case and the conduct of the defence of the case.

Collection of such information without consent is permitted under PIPEDA where it is reasonable to expect that obtaining an individual’s consent would compromise the availability or accuracy of the information, and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the law.

The thresholds for these exceptions are relatively high. Previous findings by the Privacy Commissioner have held that an insurance claim by itself is not sufficient grounds for a finding of implied consent, notwithstanding the fact that a typical insurance situation requires the insurer to adjust and investigate a claim. Although these findings do not have the force of law, insurers must be aware of them and develop their internal policies accordingly. The Guidance also does not consider a situation in which an insurer obtains a consent that may outline the need for the insurer to confirm and verify independently information that the insured has provided.

In the employment context, the Guidance provides that an organization should have evidence that the trust relationship was broken prior to the initiation of the covert video surveillance. This evidence must be more than suspicion or rumour. This position raises possible concerns about a circular argument around whether or not surveillance was justified; that is, many employers will say that it is only with surveillance that they can determine whether or not the employee has engaged in misconduct.

Where implied consent cannot be determined, organizations using covert video surveillance must ensure that their use falls under such an exemption.

Limits

The Privacy Commissioner makes it clear in the Guidance that both the type and amount of personal information captured on video, as well as the duration and scope of surveillance, must be limited to the minimum amounts required to satisfy the purposes of the business.

Collection of any identifying information about third parties should be limited to instances that are relevant to the main investigation. Specifically, the Privacy Commissioner recommends that businesses take efforts not to collect personal information – including street names, licence plates, names or faces – about individuals that are simply near or with the subject, unless those individuals have consented to the collection. Such information captured should be deleted or depersonalized (through “blurring” technologies, for example) as soon as practicable.

Internal Policies

Organizations should have internal policies that guide their surveillance activities. These policies should provide that surveillance be limited in duration and properly documented, including how surveillance may be initiated, the information to be collected, and the storage and eventual destruction of the surveillance products.

For each surveillance effort, organizations should also include an account of how the internal policy was satisfied, including the conduct of the surveillance, and how access to the surveillance products was controlled.

Use of Private Investigation Firms

Finally, the Guidance addresses the use of private investigation firms to conduct video surveillance on behalf of an organization. Both the organization and the private investigator have a responsibility to ensure that the surveillance is conducted in accordance with PIPEDA.

One way for organizations to abide by their duties is through service agreements with private investigators that require investigators to abide by PIPEDA terms, and that clearly describe the scope and purpose of the investigation. The service agreement should require that collection of personal information be limited to the purpose of the surveillance, and that collection of third-party information be avoided to the greatest extent possible. The service agreement should also permit the organization to conduct an audit of the private investigation firm and its practices.

Recommendations

Organizations considering engaging in covert video surveillance are advised to:

have written policies and procedures on covert video surveillance; document their relationship with and communications and instructions to third parties that set the parameters for the surveillance; take seriously any finding issued by the Privacy Commissioner and consider this finding both on its own merits and on the general policies and processes of the organization with respect to covert video surveillance; and consult with legal counsel when developing the above and when in doubt about legal obligations and duties.