PIPEDA Case Summary #2009-007

Mother and daughter were videotaped during covert surveillance of another individual

[Principes 4.1.4(a), 4.3, 4.4 et 4.4.1; alinéas 7(1)b) et 7(2)d)]

A woman and her daughter were surprised to learn that video images of them were taken in a public place during a covert video surveillance operation on the woman’s sister. The covert surveillance had been requested by the sister’s insurance company because of an ongoing legal dispute with her. The woman filed a complaint against the private investigation firm that the insurance company had hired to investigate her sister.

After our investigation into the complaint, the Assistant Privacy Commissioner made several recommendations to the private investigation firm concerning the collection and use of personal information during covert video surveillance, including third-party personal information, in accordance with the Act.

While the firm agreed to implement some recommendations, it did not agree to implement all of them. It said that it would continue to collect, use and disclose personal information of third parties without their consent even when paragraph 7(1)(b) of the Act was not applicable. It also refused to depersonalize or remove third-party information collected without consent.

The Assistant Commissioner concluded that the collection without consent of third-party personal information via covert video surveillance could be acceptable under the Act in accordance with paragraph 7(1)(b) in certain, specific situations. (For example, when the third-party collection could be shown to be relevant to the purpose of the collection of information about the subject of the surveillance.) However, the Assistant Commissioner did not find the particular circumstances of the complainant’s case to constitute one of these acceptable situations.

The following is an overview of the investigation and the Assistant Commissioner’s findings.

Summary of Investigation

The complainant’s sister was the subject of a covert investigation carried out by a private investigation firm hired by the complainant’s sister’s insurer. The sister had been involved in a motor vehicle accident several years before and, at the time of the covert investigation on her, had began legal proceedings against her insurer over her benefits.

The complainant became aware of a surveillance report about her sister that also detailed her own and her young daughter’s activities, mentioned her licence plate number, and contained photographic and video images of her and her daughter. Neither the complainant nor her daughter had consented to being photographed.

The insurer admitted to this Office that the complainant’s and her daughter’s images were captured inadvertently, and that the intent of its covert investigation and surveillance was never to collect information about them. Moreover, both the insurer and the private investigator conceded that they did not have a corporate policy to deal with issues arising from accidentally collected information of individuals not under investigation.

The private investigation firm defended its actions. It believed that the circumstances of the complainant’s case fell outside the scope of the Act; that the Act allows collection of information of an individual without his or her consent if the collection is reasonable for an investigation of a breach of agreement or a contravention of laws (paragraph 7(1)(b)), and; that it was not reasonable to expect to obtain the consent of all parties whose information was inadvertently caught on videotape during an investigation. The private investigator also objected to having to blur the images of individuals accidentally recorded during video surveillance.

The Assistant Privacy Commissioner disagreed and made several recommendations: First, that the private investigator cease collecting personal information unless paragraph 7(1)(b) applies to the situation. Second, that it depersonalize as soon as practicable or remove extraneous personal information that is collected, unless 7(1)(b) applies. She also recommended that the firm incorporate into its privacy policy specific procedures and policies—duly conforming to the principles of Schedule 1 of the Act—that pertain to the collection, use and disclosure of personal information obtained by covert surveillance, including extraneous third-party personal information. A recommendation was also made for the regular training of employees and subcontractors on these new policies and procedures.

Finally, as a best practice, she suggested that the private investigator document its files whenever it relies on paragraph 7(1)(b) to collect information without consent.

In response to these recommendations, the private investigator agreed to advise our Office whenever training of employees and subcontractors occurs. In response to the best practice suggestion, the respondent agreed to properly document its files when it collects personal information without an individual’s consent and relies on paragraph 7(1)(b) to do so.

On the other hand, it responded that it would not revise its privacy policies and procedures on video surveillance to reflect the principles of Schedule 1 of the Act. Instead, it said that it would amend its privacy policy to allow collections of third-party personal information that are reasonable in the circumstances. Further, it would continue to collect, use and disclose personal information of third parties without their consent regardless of whether paragraph 7(1)(b) applies or not. The respondent also refused to depersonalize (i.e. blur the images) or remove third-party information collected without consent.

Findings

Issued May 4, 2009

Application: Principle 4.3 stipulates that the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate. Paragraph 7(1)(b) states that an organization may collect personal information without the knowledge or consent of the individual only if it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province. Under paragraph 7(2)(d), an organization may use personal information without knowledge or consent if it was collected under paragraph 7(1)(b). Principle 4.1.4(a) states that organizations shall implement policies and practices to give effect to the principles, including implementing procedures to protect personal information. Principle 4.4 states that the collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means. Principle 4.4.1 clarifies that organizations shall not collect personal information indiscriminately. Both the amount and type of information collected shall be limited to that which is necessary to fulfill the purposes identified.

In making her determinations, the Assistant Commissioner deliberated as follows:

• Principles 4.4 and 4.4.1 state that personal information collections shall be limited only to purposes that have been identified. In this case, the insurer admitted that the complainant and her daughter were not to be targeted by the surveillance operation. Their personal information had thus been collected inadvertently. After the collection took place, the private investigator did not remove or depersonalize this extraneous personal information from the surveillance videotape and, moreover, refused our recommendation for it to do so in future cases of collections of extraneous personal information. Thus, Principle 4.4.1 was not upheld.
• With respect to content, the Assistant Commissioner acknowledged that there are times when collecting the personal information via video surveillance of a third party without their consent may be acceptable. This would be the case, for example, in situations where the organization has reason to believe that the collection of information about the third party is relevant to the purpose for the collection of information about the subject. However, this complaint was not one of those situations since the complainant’s personal information was, by the insurer’s own admission, not relevant to the purpose of the covert surveillance operation. Thus, paragraph 7(1)(b) could not apply and the complainant’s consent was clearly required. Since her consent was not obtained, Principle 4.3 was contravened.
• As for its obligations under Principle 4.1.4(a) to implement procedures to protect personal information, the respondent did not agree to follow the recommendation that its covert surveillance privacy policies, guidelines and procedures be developed to reflect the principles of the Act’s Schedule 1. Thus Principle 4.1.4(a) was not upheld.

Conclusion

The Assistant Commissioner concluded that the complaint was well-founded.

Other

The Assistant Commissioner requested that the private investigator destroy all personal information of the complainant and her daughter that it had collected.