After installing surveillance cameras in the workplace, a broadcasting company has agreed to inform its employees about the purpose and to adopt a policy regarding its use

PIPEDA Case Summary #2004-273

[Principles 4.1.4, and 4.3.2, subsection 5(3) and subparagraphs 7(2)(a) et (b)]

Complaint

After video surveillance cameras were installed in their workplace, employees complained that the company was using the cameras to collect their personal information, in particular about their behaviour and performance at work.

Summary of the Investigation

Further to recommendations resulting from a workplace security review, the firm installed cameras in the company’s work premises: one outside and two additional cameras inside the building. The employer said that a memorandum had been posted to notify the employees about how the information being collected by the cameras would be used. The employees were not aware of the memorandum in question.

Findings

Issued May 18, 2004

Jurisdiction : Since January 1, 2001 , thePersonal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking or business. The Assistant Privacy Commissioner had jurisdiction in this case because the broadcast company is a federal work, undertaking, or business as defined in the Act.

Application : Principle 4.1.4 states in part that organizations shall implement policies and practices to give effect to the principles, including developing information to explain the organization’s policies and procedures. Principle 4.3.2 states that “knowledge and consent” are required. Organizations shall make a reasonable effort to ensure that the individual is advised of the purpose for which the information will be used. Moreover, subsection 5(3) states that an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances. Finally, subparagraphs 7(2)(a) and (b) of the Act stipulate that an organization may, without the knowledge or consent of the individual, use personal information only if : (a) in the course of its activities, the organization becomes aware of information that it has reasonable grounds to believe could be useful in the investigation of a contravention of the laws of Canada, a province, or a foreign jurisdiction that has been, is being, or is about to be committed, and the information is used for the purpose of investigating that contravention; ( b) it is used for the purpose of acting in respect of an emergency that threatens the life, health, or security of an individual.

Based on the investigation, the Assistant Commissioner concluded that the firm had not made reasonable efforts to inform its employees, thereby violating principle 4.3.2.

Furthermore, the investigation established that the use of such a surveillance system constituted an appropriate means of protecting its employees. Since the cameras are not used to collect employees’ personal information and are not used in places where there is a reasonable possibility of invasion of privacy, it does not seem appropriate that the employer would be required to obtain employee consent for its use. Assuming that the cameras were, inadvertently, collecting employees’ personal information, the employer would be able to use the information thus collected without the employees’ consent only in the circumstances set out in the subparagraphs 7(2)(a) and (b) of the Act.

The Assistant Commissioner appreciated the employer’s flexibility and availability: during the investigation, the employer stated that the employees would be informed of the purposes, and that it would develop a policy document regarding the use of cameras, including the objectives of the security system, the installation sites, the employees authorized to operate the system, the time of surveillance and recording and the equity principles applicable to recording.

The Assistant Commissioner concluded that the complaint was resolved insofar as the firm agreed to:

• ensure that its employees are informed of the purposes for which the cameras are being used, in accordance with principle 4.3.2.; and
• develop a policy document on the use of the surveillance cameras that is made available to the employees, in accordance with principle 4.1.4. The firm will advise the Commissioner about the adoption of such a policy within 60 days following receipt of the letter of finding.