In the last batch of findings released by the Office of the Privacy Commissioner, the Assistant Commissioner had an opportunity to consider the installation of video surveillance equipment in an un-named workplace. The broadcasting company had installed the surveillance system following a full security review. The most interesting aspect of the case is that there is no reference to the requirements that former (and disgraced) Privacy Commissioner George Radwanski laid out as a pre-requisite to installing video surveillance equipment. These were referred to an implicitly supported by the Federal Court in Eastmond v. Canadian Pacific Railway, 2004 FC 852:

[126] In answering this question, all parties urged I adopt the factors or considerations which the Privacy Commissioner looked at to determine whether CP's purposes for collecting personal information are those a reasonable person would consider are appropriate.

[127] I am prepared to take into account and be guided by those factors which I repeat are:

• Is camera surveillance and recording necessary to meet a specific CP need;
• Is camera surveillance and recording likely to be effective in meeting that need;
• Is the loss of privacy proportional to the benefit gained;
• Is there a less privacy-invasive way of achieving the same end?

[128] As argued by all parties, these considerations or factors enumerated by the Privacy Commissioner are those which, over the years prior to PIPEDA, arbitrators adjudicating privacy issues under collective agreements involving camera surveillance have taken into account in balancing privacy interests of employees with the legitimate interests of employers.

In this new finding, Commissioner's Findings - PIPED Act Case Summary #273, the Assistant Commissioner did not refer to section 5(3) of PIPEDA, which sets out a baseline reasonableness for the collection, use and disclosure of personal information:

5(3) An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

Instead, the Assistant Commissioner focused on whether the company had taken sufficient steps to inform employees of the monitoring and its purposes.

Furthermore, the investigation established that the use of such a surveillance system constituted an appropriate means of protecting its employees. Since the cameras are not used to collect employees’ personal information and are not used in places where there is a reasonable possibility of invasion of privacy, it does not seem appropriate that the employer would be required to obtain employee consent for its use. Assuming that the cameras were, inadvertently, collecting employees’ personal information, the employer would be able to use the information thus collected without the employees’ consent only in the circumstances set out in the subparagraphs 7(2)(a) and (b) of the Act.

The Assistant Commissioner appreciated the employer’s flexibility and availability: during the investigation, the employer stated that the employees would be informed of the purposes, and that it would develop a policy document regarding the use of cameras, including the objectives of the security system, the installation sites, the employees authorized to operate the system, the time of surveillance and recording and the equity principles applicable to recording.

The Assistant Commissioner concluded that the complaint was resolved insofar as the firm agreed to:

• ensure that its employees are informed of the purposes for which the cameras are being used, in accordance with principle 4.3.2.; and
• develop a policy document on the use of the surveillance cameras that is made available to the employees, in accordance with principle 4.1.4. The firm will advise the Commissioner about the adoption of such a policy within 60 days following receipt of the letter of finding.

This finding appears to say that you can use video surveillance if it is an appropriate security measure, as long as the employees whose information will be incidentally collected are informed of the surveillance and of its purposes.

Labels: information breaches, pipeda findings, surveillance, video surveillance