CCTV legalities
In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) generally require a person's consent before video or audio recording them in a commercial or business situation. The consent can either be expressly given (either orally or in writing) or it can be implied (such as clearly posting notice of the surveillance .
There are specific procedures outlined in PIPEDA which must be followed for a legal recording. If you plan to record calls or conversations with customers or clients, you should consult PIPEDA for its particulars. PIPEDA also applies to workplace/employee surveillance situations. Pursuant to PIPEDA, an employer must usually advise its employees of any personal information it is collecting from them and why it is collecting the information. This can include video surveillance, phone monitoring, keystroke recording and email review. An employer should only collect information necessary to the employer's stated purpose in collecting it. An individual (as opposed to a business) can record conversations with the consent of one party to a conversation.
If you are taking part in the conversation yourself, the consent can come from you. With regard to video surveillance, Canada has passed a video voyeurism law, making it a crime to surreptitiously observe or record a person who has a reasonable expectation of privacy in the circumstances and is or is expected to be nude or partially nude or involved in sexual activity. You can't legally place cameras in bathrooms or locker rooms. You can't legally set up a camera to record in your roommate's bedroom. Keep in mind that, in addition to federal laws in Canada, your home province may also have privacy, surveillance and/or voyeurism laws which should be reviewed as well.
Below I have provided some case precedent on the subject of cctv as it relates to employee/employer. The message I am trying to convey hear is in order to save your self from any problems you should have a window decal or sign posted stated the purpose of the surveillance.
All cameras and DVR's come with free window stickers as above.
Reflect Aluminium 7" x 10"Only $17
3. Legal Precedent . . . . . . . . 28
3.1. Closed Circuit Television (CCTV)
Office of the Privacy Commissioner of Canada
Contributions Program
Canadian Workplace Privacy Lockton & Rosenberg
http://www.cs.ubc.ca/~lockton/workplace.pdf
2 8
3. LEGAL PRECEDENT
An examination of Canada’s privacy laws is not complete without a similar examination
of the ways in which they are currently being applied. Thus, situations in which
workplace privacy in Canada has been protected, as well as those situations in which it
has been decreased, shall now be discussed. This is not intended as a proper legal
review; rather, it is an interpretation of published cases by the a ‘reasonable person’. It is
important to understand case law through his or her eyes, as it is his or her opinions that
must be considered when making rulings based on current Canadian privacy law.
3.1. Closed Circuit Television (CCTV)
By far the most legally challenged privacy-affecting technology in Canada is CCTV. The
Privacy Commissioner’s Office has seen a broad range of complaints, some well-founded
and others not, and when taken as a group, the Office’s rulings create a reasonably
detailed road map of the allowable and disallowed functions of surveillance cameras. Six
cases shall be considered here: [PIPEDA Case Summary 114, 2003] (and the Federal
Court’s ruling on this case), [264, 2004], [265, 2004], [273, 2004], [279, 2004] and [290,
2004].
Issue 1: Cameras used for safety reasons, employees not notified of purpose (Case
summary 273)
In 2004, a broadcasting company placed three CCTV cameras on its premises: one
outside its building, and two indoors. Employees complained that this was a violation of
PIPEDA, as their employer had not made a reasonable effort to disclose the purpose of
these cameras. The employer claimed that a memorandum had been posted to such an
effect; employees claimed to have no knowledge of this memo.
This was a relatively uncontroversial case for the Commissioner’s Office. The company
in question was commended for its flexibility and availability, and the case was soon
resolved. The Commissioner’s Office found that since the cameras were installed for
security purposes, and in areas that would only incidentally capture any employee
personal information, the company did not need to obtain consent from its employees to
install the system. However, the Office did find that principle 4.3.2 of PIPEDA, which
requires employers to make a reasonable effort to inform their employees of the purposes
of surveillance, had been violated. The broadcaster agreed to develop a policy document
regarding the use of the cameras, as well as to tell workers of the intended uses; the
matter was thus considered to be resolved.
Issue 2: Cameras used to monitor workstations (Case summaries 279 and 290)
While incidental capture of employee personal data is allowable, focused concentration
on their workstations is not. This was made very clear in 2004, when employees of an
Internet service provider (ISP) challenged management’s installation of two webcams,
one pointing towards the sales and marketing staff, and the other towards the technical
staff. The cameras were set to low-resolution, did not record and could not pan nor
zoom; however, individuals and their actions could clearly be discerned. Though the
cameras were continuously operative, it was claimed that the managers of the two
departments would only view the images when they were off-site. The company listed
two main reasons for installing the cameras: security and productivity.
Upon consideration of the situation, the Commissioner’s Office ruled that neither reason
was sufficient for the invasion of privacy created by the cameras. As to the issue of
employee performance, the Office noted that there were numerous other productivity
measures already in place, including monitored e-mail, automated phone systems, etc.
The company contended that it needed the cameras in order to observe and manage
employee attitudes and behaviours at times when management was not on location. The
Commissioner’s Office countered that the ISP had not considered, nor were they willing
to consider, alternative solutions such as modifying managerial work hours, or creating
supervisory roles for employees. As to the issue of security, the commissioner noted that
the company did not provide evidence of problems of theft or harassment, and that less invasive
employee security measures, such as surveillance of entryways, were not being
used. Thus, it was considered that a reasonable person would not find that security
concerns would justify the use of these cameras.
Finally, the Commissioner’s Office commented that it felt that this surveillance was
being undertaken solely as a deterrent (to theft, harassment, criticism, etc). It was
admitted that privacy-invasive systems tend to fulfill such objectives at minimal financial
cost; however, the cost of human dignity must also be considered. The Assistant-
Commissioner writes, “continuous, indiscriminate surveillance of employees … [is]
based on a lack of trust and treats all individuals with suspicion, when the underlying
problems may rest with a few individuals or with a management plan that may not be
entirely sound. The effect of such omnipresent observation [is] stifling. … The goal of
ensuring adherence to the company’s vision comes at too high a price to our individual
autonomy and freedom.” [PIPEDA Case Summary #279, 2004] The ISP was thus
ordered to remove the cameras within 45 days.
Approximately six months after issuing this order, a similar case appeared before the
Commissioner’s Office. In it, a Canadian Food Inspection Agency (CFIA) employee
complained that a camera installed in the evisceration room of a meat-packing plant had
no purpose but to observe his actions. The company argued that the camera was being
used to ensure product safety. The Commissioner’s Office rejected this claim, however,
noting that the Veterinarian in Charge and CFIA inspectors were present whenever the
room was in use, and it was their responsibility to ensure product safety; a camera (which
did not provide a clear picture of the animals) was of no assistance to them. There was
no purpose for the cameras, it was deemed, other than to scrutinize the CFIA employees;
since, it was felt, this would not be considered a reasonable purpose for the invasion of
the employees’ privacy, the company was ordered to remove the camera.
Issue 3: Cameras installed for other purposes used to confirm suspicion of rule-breaking
(Case summary 265)
In February 2004, the Privacy Commissioner’s office issued its finding for a case in
which an operational camera (that is, a camera used to monitor the day-to-day operations
of a company) was used to observe two employees of a railyard leaving the property
during working hours. The complainants were spotted entering a vehicle, and their
manager used the camera’s zoom function to observe them leaving the premises, a
violation of company policy. The employees argued that this was an improper collection
of their personal information under PIPEDA.
The presence of the camera, in this case, was not at issue, as it had been installed as the
result of a risk analysis procedure, and its use was supported by both management and the
employees union. Also, it must be noted that PIPEDA allows the collection without
consent of personal information when investigating the breech of an agreement. Thus,
the Commissioner’s Office was asked to rule if such an exception applied in this
particular case.
The Office first noted that there was no prior evidence presented that unauthorized
absences were a problem for these or any employees, nor that showed any previous, less
invasive measures to control such absences. Thus, it was unlikely that a reasonable
person would feel that it was acceptable to use a surveillance camera to manage
workplace performance issues such as this. Secondly, it was noted that while an
organization has the right to initiate an investigation if it has suspicion that a breech of
trust has occurred, such suspicion did not exist in this case. The complainants were
merely spotted entering a private vehicle; this does not imply any wrongdoing on their
part. Thus, such an allowance for collection of information without consent did not apply
in this case. It was thus determined that the complaint was well-founded, and that the
company was not permitted to use the camera in this way.
Issue 4: Cameras installed for other purposes used for disciplinary action, when the
information comes in the regular course of business (Case summary 264)
The next case differs in a subtle, yet very important, way from the previous one. In this
case, the camera in question monitored the front entranceway to a railyard, storing all
information gathered for 30 days. The complainant claimed that he was reprimanded for
actions caught by this camera, and that this was an improper use of his personal
information. The company contended that the information was gathered during the
regular course of business, and that it aided in the investigation of a contravention of the
laws of Canada, and thus satisfies the two conditions of use without consent described by
PIPEDA paragraph 7(2)(a). Again, the use of the camera for its intended purposes
(security) is not in question.
The Privacy Commissioner’s Office’s investigation found that the video in question
showed the complainant on various occasions walking up a ramp that was prohibited to
foot traffic for safety reasons; signs stating this rule were posted at the top and bottom of the ramp. The Canada Labour Code, section 126, states in part that employees must
follow proscribed safety procedures while at work; the complainant was not doing so, and
thus was in violation of a law of Canada. The question turned, then, to the matter of how
the information was brought to the attention of management. As it turned out, the
complainant himself had asked that the recorded surveillance video be viewed, in order to
support his allegations of harassment by a supervisor. While the tape did not support this
claim, it did clearly show the previously described safety violation. Thus, as the
complainant’s personal information had come to the attention of management during the
regular course of business, PIPEDA 7(2)(a) applied. The Commissioner’s office ruled
that the complaint was not well-founded.
Issue 5: Cameras that unintentionally may capture employee work information (Case
summary 114)
This incident was the earliest PIPEDA challenge involving workplace surveillance
cameras, and has become rather a contentious one. The scenario is simple enough; a
railyard installs surveillance cameras to guard against vandalism and theft. Employees
are notified of the purpose of the cameras, and told that they will not be used for
productivity issues. They are trained at entranceways, and away from work areas; when
it is noticed that the cameras may incidentally be capturing work areas, they are repositioned
or fitted with a shield to protect employee privacy. The union, though, objects
to the presence of the cameras, arguing that they are not needed.
In deciding this case, the Privacy Commissioner’s Office considered a four-point test,
which is now frequently used when evaluating surveillance technologies. The points
were:
- Is the measure demonstrably necessary to meet a specific need?
- Is it likely to be effective in meeting that need?
- Is the loss of privacy proportional to the benefit gained?
- Is there a less privacy-invasive way of achieving the same end?
The Commissioner’s Office argued that there was not actually a demonstrable need for
this security measure. If the company could have proven that the cameras were needed to
reduce vandalism and improve security, then such a measure would have been
acceptable; the Office ruled, though, that no such evidence had been provided. It also
found that though no incidents had been reported since the installation of the cameras,
warning signs posted on exterior fencing may have been the reason for the reduction.
The Office also felt that less invasive measures, such as better parking lot lighting, had
not been considered. Finally, it was noted that the mere presence of the cameras may
have given rise to the perception among employees that their comings and goings were
being monitored (even if that was not objectively the case), and that the adverse
psychological effects of a perceived privacy invasion may have been occurring. For
these reasons, it was ruled that a reasonable person would not consider such a security
measure to be appropriate, and the Office made a recommendation that the company
remove the camera.
The recommendation was rejected by the company; thus, as is made necessary by
PIPEDA, the employee (Erwin Eastmond) filed a complaint against the company
(Canadian Pacific Railway) in Federal Court, asking that this recommendation be
enforced. [Erwin Eastmond v. Canadian Pacific Railway and Privacy Commissioner of
Canada, 2004] The Justice for the case decided that it was his duty to treat this complaint
as a fresh application; it was not simply a review of the Privacy Commissioner’s report.
While some deference would be given to the Commissioner in his area of expertise, it
was decided that the evidence presented in this new case was sufficiently different as to
warrant no deference being given to the Commissioner’s findings of fact.
The Justice began by stating that he was prepared to be guided by the same four
evaluatory questions mentioned by the Privacy Commissioner, as described above. He
also agreed that constant observation of an employee’s working area is offensive in
human terms. He writes, “it is difficult to conceive of circumstances in which
considerations of efficiency would justify such an affront to human dignity…”. He also
agreed that surveillance cannot be used without reason, citing a previous arbitration
ruling which states: “As a general rule, [the employer’s interest] does not justify resort to
random videotape surveillance in the form of an electronic web, cast like a net, to see
what it might catch. Surveillance is an extraordinary step which can only be resorted to
where there is, beforehand, reasonable and probable cause to justify it.” However, based
on the evidence presented to him, he felt that a reasonable person would consider CP’s
use of video surveillance appropriate under the circumstances.
First, he notes, the collection is not surreptitious, as warning signs are displayed. The
collection is brief, occurring only when an individual is within the camera’s field of
vision, and it is not limited to employees, as visitors will also be captured on film. Also,
the recordings are kept under lock and key, accessible only by managers and CP police,
and only when an incident has been reported.
Next, the Justice remarks that he is satisfied that CP has legitimate need for surveillance.
CP is allowed, in his opinion, to focus on the future utility of the cameras in deterring
theft, vandalism, and protecting employee safety and the security of the hazardous and
toxic materials that can be found in the yard.
Finally, the Justice feels that the actual loss of privacy is minimal. Since the recordings
are not viewed unless an incident is reported, and the recordings are of areas in which a
person has low expectation of privacy (i.e. public places), the Justice finds that the loss of
privacy is proportional to the benefit gained. Since the railyard is a large area, as well,
alternatives like fencing or extra security staff are not practical; thus, the final part of the
Privacy Commissioner’s four-part test is also passed, and it can safely be said that a
reasonable individual would find this surveillance appropriate under the circumstances.
The final matter that must be addressed is the matter of whether or not CP needed to
obtain consent to collect individuals’ personal information. The Justice felt that since
recordings are not viewed until an incident has been reported, and will otherwise be
deleted, it is actually at the time of viewing that collection can be said to have taken place. Thus, CP’s argument that the collection of personal information takes place only
during the investigation of an incident, and that such information would not be available
if CP had to get an individual’s consent to record it (since the individual in question is the
perpetrator of the incident being investigated), is valid, and section 7(1)(b) of PIPEDA
can be applied, allowing collection without consent.
Thus, the Privacy Commissioner’s findings were reversed, and Canadian Pacific is
allowed to retain their security cameras.
In general, then, it seems to be the case that so long as employees are informed of the
purposes of video surveillance, they are not filmed while actually performing their duties,
and the cameras do not develop ‘function creep’, CCTV installations in the workplace
will be allowed. This seems a reasonably fair trade-off between employee and employer
interests; so long as further cases bring only clarifications, and not complete overhauls to
this system, Canadians should be pleased with the handling of this privacy-threatening
technology. However, in other, less examined areas of workplace privacy, there is much
work left to be done.
Vance Lockton and Richard S. Rosenberg
April 10, 2006
|
