Airport must change its procedures for handling third-party requests for airport terminal video surveillance to comply with subsection 7(3) of PIPEDA

PIPEDA Case Summary #2015-004

August 13, 2015

---

Complaint

An individual complained that a Canadian airport had disclosed her personal information in the form of video surveillance images of her to a third party organization without her knowledge and consent.

Summary of Investigation

After experiencing a work-related injury, the complainant started receiving regular financial compensation from the governmental agency in her province that compensates employees injured on the job. Sometime after the compensation began, the agency decided to investigate to determine whether her injuries were as debilitating as she had claimed.

Knowing the complainant had departed from her local airport for a trip, the agency contacted the airport security office to enquire about accessing video surveillance taken there the day of her departure.

The agency issued a subpoena to the airport. This ordered the airport to turn the surveillance footage recorded on the day of the complainant’s departure over to the agency. The airport fully complied and provided the footage to the agency.

Several days later, anticipating the complainant’s return to the airport at the end of her trip, the agency arranged for an airport security employee to operate a video surveillance camera to record the complainant as she claimed her luggage. This footage was then turned over to the agency. The agency did not issue a second subpoena to obtain the footage, but did submit information request forms supplied by the airport prior to the footage being disclosed.

Several months later, upon reading the agency’s final report about its investigation, the complainant learned that the airport had supplied video surveillance footage of her. Claiming this took place without her knowledge or consent, she filed a complaint with our Office against the airport. We accepted the complaint and began to investigate.

The airport claimed that the video surveillance footage did not contain the complainant’s personal information since the video cameras were perfectly visible and captured images in a public setting.

Furthermore, the airport claimed that even if the footage was personal information protected under the Act, the complainant’s consent to disclose her information, either on the first or second occasion, was not necessary since the exceptions to consent set out in paragraphs 7(3)(c) and 7(3)(c.1) applied.  These paragraphs state the following:

Paragraph 7(3)(c) permits disclosure of personal information without consent where the disclosure is required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records.

Paragraph 7(3)(c.1) does not require a subpoena or warrant, but instead requires that the disclosure be made to a government institution or part of a government institution that has: (i) made a request for the information; (ii) identified its lawful authority to obtain the information; and (iii) indicated that the disclosure is being sought for certain permissible purposes, such as the administration or enforcement of any federal or provincial law.

The airport claimed that the subpoena issued by the agency to compel the production of video images recorded the day of the complainant’s departure was also valid under paragraph 7(3)(c) for compelling the production of images recorded the day of her return. In the airport’s view, the footage recorded upon her return was part of a continuation and follow-up of the same investigation into the complainant, and related to the same trip.

Lastly, the airport claimed that it could also rely on the exception to consent under paragraph 7(3)(c.1), which does not require a subpoena or warrant.

Outcome

Our Office determined that the video footage where the complainant was visible was her personal information, notwithstanding the fact that the surveillance was conducted in a public setting. The Act does not exclude personal information that is captured by video cameras in a public setting from its ambit.
Our Office reviewed the footage taken both the day of the complainant’s departure and the day of her return and which had been disclosed to the agency. In the footage taken the day of the complainant’s departure, the complainant was not clearly visible. In any event, our Office was of the view that the disclosure was acceptable under paragraph 7(3)(c) since the agency had the authority to issue the subpoena and the departure footage fell within the scope of information required to be disclosed by the subpoena.

However, as for the airport’s disclosure of footage taken upon the complaint’s return, our Office determined that the footage clearly contained images of the complainant and that neither paragraph 7(3)(c) nor 7(3)(c.1) could be relied upon in the circumstances, for the following reasons:

1. Concerning paragraph 7(3)(c), the only subpoena issued by the agency was clearly limited to the production of records concerning the complainant’s departure.
2. Concerning paragraph 7(3)(c.1), the requirements for this exception were not met. Firstly, there was nothing in the information request forms submitted by the agency that identified the agency’s lawful authority^{Footnote 1} to obtain the information without a subpoena. Secondly, the information request forms submitted by the agency referred, erroneously, only to the departure flight of the complainant from the airport, not to her return. The request therefore did not correspond to what was ultimately disclosed to the agency.

As a result of our investigation, we recommended that the airport establish procedures and practices related to subsection 7(3) and train employees in them. We also recommended that, going forward, the airport must ensure that personal information disclosed must be limited to what is specified by a subpoena, warrant or order. Lastly, we recommended that when the airport invokes paragraph 7(3)(c.1), it ensures that all the conditions of this provision are met.

The airport agreed to implement our recommendations by a specified date and so our finding was well-founded and conditionally resolved. Since our investigation’s conclusion, our Office has confirmed that our recommendations were implemented.

Footnotes