PIPEDA Case Summary #2009-001

Bus terminal video surveillance is challenged by company employee

[Principles 4.3.1, 4.3.2, 4.3.5 and 4.3.6 of Schedule 1; subsection 5(3) and paragraph 7(2)(a)]

A man complained that his employer, an inter-city bus company, was using 22 video cameras installed in a city bus depot to monitor and manage employee performance. He claimed that there were no signs in the depot advising employees or the public of the video surveillance. He was thus concerned that the organization was collecting individuals’ personal information without their knowledge or consent.

The Assistant Commissioner found that the purposes stated by the organization for the collection and use of the information captured by the video surveillance cameras were reasonable. These purposes were supported by evidence specific to the depot in question as well as data collected from comparable company depots. None of the purposes cited by the company were to monitor or manage employee performance, and we observed that the locations of the cameras in the depot were consistent with the stated purposes. Adequate signage had, in fact, existed in the depot to alert employees and the public of the fact that there was video surveillance, although the Assistant Commissioner found that reasonable efforts had not been made by the organization to explain to employees the purposes of the surveillance.

The Assistant Commissioner made several recommendations to the organization, including improving its video surveillance policy, training its security personnel and managers, and adequately informing its employees. The organization agreed to implement the recommendations.    

The following is an overview of the investigation and the Assistant Commissioner’s findings.

Summary of Investigation

Although there had been video surveillance in the depot since 1986, by June 2006, the surveillance system had increased to two digital video recorders, two monitors and 31 video cameras.

According to the organization, there had been a detailed analysis to determine if a video camera surveillance system was needed, in accordance with standard security industry guidelines and processes, although our Office could not find any documentation of it. The organization stated that its privacy policy and complaint process, released in January 2004, maintained strict adherence to the principles and spirit of the Act.

The cameras were digital and they recorded to a hard disk on a computer kept in a secured room, which was staffed by private security personnel. The cameras were static and not continuously monitored. The tapes were kept for up to three months and automatically re-recorded if not needed.

The organization did not dispute the fact that its video surveillance system was collecting personal information but claimed that it was not its intention to use the technology to monitor employee productivity. This position was also stated in its draft video camera surveillance policy.

When this Office received the complaint, the organization was in the process of drafting its video camera surveillance policy. Throughout our investigation, the company consulted this Office regarding its draft policy, which it was developing in accordance with this Office’s four-point test. This test describes the conditions that must be considered in situations where surveillance may be an option for organizations. The four points of the test are as follows:

• Is the use of video surveillance cameras demonstrably necessary to meet a specific need?
• Is video surveillance likely to be effective in meeting these needs?
• Is the loss of privacy proportional to the benefit gained?
• Is there a less privacy-invasive way of achieving the same end?

According to the organization, the cameras were not located in areas such as public washrooms or employee break rooms. However, they were located in employee workplace areas (i.e. not focusing on a specific activity or person) where the organization believed there was a concern for safety and security (e.g. movement of vehicles, freight and passengers), as well as in areas where there was a large amount of cash and freight handling.

During this Office’s on-site review of the depot, it was determined that there were five general locations for the cameras: public area, bus bays, parcel pick-up area, general workplace areas and the mobile unit that monitors buses in transit.

With respect to access to the videotapes, the draft video surveillance policy indicated that only authorized private security and company personnel, those responsible for the security, safety and well-being of passengers and employees within a location, would be able to review the contents of the surveillance tapes. Moreover, the draft policy emphasized that review of the tapes would not be used to monitor or manage routine employee performance, but only to identify suspected employee misconduct or a breach of contract and only after all other less intrusive means had been tried and exhausted, with negative results. This type of review of tapes would only be allowed by authorized security and the appropriate manager or supervisor. A form specifically designed to request review of surveillance tapes would have be filled out by a manager before he or she could be permitted to review any tapes.

Collection and Use

The organization outlined three specific purposes for the collection and use of information by the video camera surveillance system:

• Purpose 1: Ensure the safety and security expectations of customers and employees. The company had evidence to show a significant level of criminal activity at the depot. Police often requested to view the surveillance tapes. Although there was data to show aggressive behaviour at other depots in other cities, there was none for the location in question.  
• Purpose 2: Reduce and discourage incidents of vandalism and illegal conduct. Again, there was no data from the location in question, other than reports that employee vehicles had been vandalized and broken into. Police had reviewed the tapes and made arrests. However, other depots could document illegal activities such as drug trafficking, damage to property and causing disturbances.
• Purpose 3: Limit the potential for liability for damages due to fraud, theft or inappropriate operational procedures. Video surveillance had provided information to police regarding theft from passengers, staff and courier passengers, as well as credit card fraud. Arrests had been made as a result. As well, the organization claims that video surveillance has provided a record of the numerous collisions involving forklifts and other equipment as well as situations where damage to cargo and parcels may have occurred in the terminal.

Consent

With respect to obtaining the consent of clients and employees for video surveillance, the company maintained that there was an assumption of consent for its use in the depot. It noted that there were video surveillance cameras, clearly visible to anyone, in the terminals of the international airport located in the same city as the bus depot. Despite the fact there was no signage at the airport to indicate the presence or use of the cameras there, the respondent believed that the public nonetheless had an expectation that video cameras would be used in such an environment.

Further, the company asserted that video camera surveillance had been in place in major transportation terminals in Canada for several years. Its own operations offer inter-city bus and courier services year-round, twenty-four hours a day, seven days a week.

The organization affirmed that, since 2003, there had been, and there were still, signs at the entrance of the terminal notifying the public of the existence of video surveillance. Moreover, the cameras were not hidden from view. Our Office subsequently confirmed that these signs were there and clearly visible. To inform employees specifically, the company had posted other signs advising that the premises might be monitored using video surveillance by private security and/or police agencies for investigative purposes.

Findings

Issued February 19, 2009

Application: Subsection 5(3) states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances. Principle 4.3.1 states that consent is required for the collection of personal information and the subsequent use or disclosure of this information. Principle 4.3.2 requires “knowledge and consent.” Organizations shall make a reasonable effort to ensure that the individual is advised of the purpose for which the information will be used. Principle 4.3.5 states that in obtaining consent the reasonable expectations of the individual are also relevant. Principle 4.3.6 indicates that the way an organization seeks consent may vary, depending on the circumstances and type of information collected. An organization should generally seek express consent when the information is likely to be sensitive. Implied consent would generally be appropriate when the information is less sensitive. Finally, paragraph 7(2)(a) of the Act stipulates that an organization may, without the knowledge or consent of the individual, use personal information only if in the course of its activities, the organization becomes aware of information that it has reasonable grounds to believe could be useful in the investigation of a contravention of the laws of Canada, a province, or a foreign jurisdiction that has been, is being, or is about to be committed, and the information is used for the purpose of investigating that contravention.

In making her determinations, the Assistant Commissioner deliberated as follows:

• The purpose of the Act, as outlined in section 3, is to balance the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances. Organizations must consider the effect of privacy-intrusive measures, such as video surveillance cameras, on this balance.

Collection and Use

• The respondent stated that it needed the cameras for three specific purposes. The Assistant Commissioner deemed it useful to consider the four-point test when analyzing these purposes for the collection and use of employee and client personal information: 1) Is the use of video surveillance cameras demonstrably necessary to meet a specific need? 2) Is video surveillance likely to be effective in meeting these needs? 3) Is the loss of privacy proportional to the benefit gained? 4) Is there a less privacy-invasive way of achieving the same end?

Purpose 1: Ensuring the Safety and Security Expectations of Customers and Employees

Although detailed data was unavailable from the depot, evidence regarding safety and security at other company locations was persuasive and could logically be generalized to the complaint location. The company presented sufficient information concerning illegal drug trafficking and aggressive behaviour to conclude that there were issues of safety and security at the depot. Moreover, it is reasonable to assume that safety and security were important considerations at any transportation facility.

The organization reported, and our Office confirmed, that its cameras were not focused on areas where there is a heightened expectation of privacy, such as public washrooms or employee break rooms. Therefore, the loss of privacy is proportional to the benefit gained with respect to safety and security at the depot.

While the security firm provided a certain measure of safety and security in the facility, the guards could not be in all locations at all times. The surveillance system was an additional level of safety and security, and it supplied evidence of wrongdoing. The Assistant Commissioner cautioned the organization that it must adhere to the requirements of paragraph 7(2)(a) in using the tapes for investigative purposes.

Therefore, the Assistant Commissioner was satisfied that the purpose of safety and security is a reasonable one for the video surveillance system in the depot.

Purpose 2: Reducing and Discouraging Incidents of Vandalism or Illegal Conduct

Much of the information provided by the organization to support the safety and security need is also applicable to this purpose. Again, the company cited data from other depots as none existed for the location of the complaint. This information indicated considerable illegal activity such as drug trafficking, damage to property, and causing a disturbance. According to the organization, there had been several incidents of employee vehicles being vandalized or items being stolen from the vehicles. Although one cannot say conclusively that the cameras reduced and discouraged incidents of vandalism and illegal conduct in the depot, the Assistant Commissioner deemed it reasonable to believe this was the case. Furthermore, she believed it difficult to separate this purpose from that of safety and security as there is a large degree of overlap.

Therefore, the Assistant Commissioner was satisfied that the purpose of reducing and discouraging incidents of vandalism and illegal activity was a reasonable one under the Act.

Purpose 3: Limiting the Potential for Liability for Damages Due to Fraud, Theft or Inappropriate Operational Procedures

Liability Due to Fraud and Theft

The organization explained that it had liability concerns for both passenger and courier services. It claimed that the video surveillance system had provided after-the-fact information on incidents involving fraud and theft. The system also had been a source of information in situations involving lost luggage, passengers in need of assistance and injury claims by passengers. The Assistant Commissioner observed that there is a business need to minimize the potential for liability, and videotapes supply evidence in some instances. Unless a security guard has witnessed a given situation, the videotapes are the next best thing to indicate whether the organization can be held liable.

According to the company, it had been able to respond to police requests to view the tapes in this regard, and arrests had been made. The Assistant Commissioner was of the view that any loss of privacy is minimal.

Liability for Damages Due to Inappropriate Operational Procedures

With respect to operational procedures, the organization identified two specific areas based on location of its operations: in-terminal activities and public thoroughfares. The complaints under investigation were not about the public thoroughfares.

In-terminal

With respect to in-terminal activity, the organization used the term “inappropriate operational procedures” in the context of the potential for liability, rather than employee performance management. It explained that the term referred to specific actions of employees that could result in a liability, such as situations in which company or client property is damaged.

In 2005, according to the organization, there were 72 non-driver collisions— predominately by maintenance workers operating equipment in the terminal. It stated that it was difficult to determine where damage occurred because of cargo and parcel movement. The Assistant Commissioner believed the video surveillance system provided a record of these incidents for liability purposes.

The organization reiterated that cameras were focused on general areas where there would be a minimal expectation of privacy. We observed that the cameras appeared to be positioned appropriately to collect the required data to meet the stated purposes. Furthermore, based on the on-site visit information in addition to the information provided by the organization, the Assistant Commissioner was of the view that the video system did not collect sensitive personal information.

On balance, the Assistant Commissioner was satisfied that the use of the video surveillance system could be supported for the purposes as outlined by the organization—ensuring security and safety, reducing illegal behaviour and limiting the potential for liability. In this respect, the company met the reasonableness requirements of subsection 5(3).

Consent

• The complainant alleged that both customer and employee personal information is collected and used without consent. Principle 4.3.6 allows an organization to seek consent in different ways, depending on the circumstances and type of information collected. If the information collected is sensitive, express consent is recommended. If it is less sensitive, implied consent may be appropriate. When considering the reliance on implied consent, Principle 4.3.5 stresses the relevance of the individual’s reasonable expectations.
• With regard to company employees, if consent is being implied, it should only be implied for purposes for which the employee could reasonably expect that the data would be used. The Assistant Commissioner noted that the organization plainly indicated in its draft policy the purposes of the video surveillance system and that it did not intend to collect personal information for the purposes of monitoring productivity. Although a number of the video cameras were trained on work areas, these were locations in which freight or cash are being handled—therefore reasonable for the stated purposes. Furthermore, there was no reasonable expectation of privacy in the areas where the video cameras may capture images of employees. The Assistant Commissioner was therefore of the view that implied consent is sufficient to meet the reasonableness test for employees working in the terminal and that, therefore, Principles 4.3.5 and 4.3.6 were upheld.
• She pointed out, however, that if a camera set up for an appropriate purpose inadvertently collects employee personal information that the employer later wishes to use for workforce management purposes, the employer can only legitimately use the information thus collected in the circumstances set out in paragraphs 7(2)(a) and (b) of the Act. Otherwise, consent is required, as stipulated in Principle 4.3.1.
• With regard to customer consent, implied consent is a reasonable assumption for transportation facilities such as this. Moreover, the personal information being collected is not very sensitive.
• The complainant further alleged that there were no signs posted indicating that employees are under video surveillance. However, the company claimed, and our investigation confirmed, that notices are posted at all entrances and work areas advising of the video surveillance, and that the notices were in place at the time the complainant filed his complaints.
• While consent could be considered implied in this case, and signs in the terminal provide limited information about the video cameras, there had been at the time of the complaint no detailed explanation of the cameras’ purposes provided to employees. For this reason, Principle 4.3.2 was contravened.

The Assistant Commissioner recommended that the organization do the following:

• Finalize its video surveillance policy. At a minimum, the policy should establish guidelines and procedures for the collection, use and disclosure of personal information obtained by video surveillance that clearly explain to the organization’s employees the purposes for using video surveillance and the purposes for using or disclosing any personal information collected by video surveillance. The guidelines and procedures should also specify that access to personal information obtained by video surveillance can only be granted to security personnel and managers after less intrusive methods have been tried unsuccessfully.
• Finalize its specific procedures for security personnel and managers regarding accessing videotapes in instances of suspected employee misconduct or breach of contract.
• Train its security personnel and managers regarding its specific procedures for accessing videotapes in instances of suspected employee misconduct or breach of contract.
• Establish guidelines with respect to conducting an annual management audit for assessing compliance with the video surveillance policy.
• Advise this Office when and how its employees will be informed about its video surveillance policy.
• Revise the service agreement with its security firm to reflect the Canadian context, with particular emphasis on the Act and the concept of personal information. The agreement must require the security firm to train its staff regarding both the Act and the organization’s privacy policy. Copies of these documents should be included in the agreement.

In response, the organization agreed to implement these recommendations.

Conclusion

The Assistant Commissioner concluded that the complaint was well-founded and resolved.