Photographing of tenants' apartments without consent for insurance purposes

PIPEDA Case Summary #2006-349

[Section 2; Principles 4.2, 4.3, 4.3.2 and 4.8 of Schedule 1]

The tenant of an apartment building happened to be at home one day when two insurance inspectors, along with a property management representative, entered his apartment and proceeded to take photographs of every room. Although the property management company had informed him that it would be entering the unit, he did not know that it was going to be photographed. He took his concerns first to the provincial tribunal that deals with disputes between landlords and tenants. The property management company agreed to destroy the photographs it took of his apartment. However, the complainant still felt that the company owed the other tenants, whose apartments had also been photographed and who likely did not know about it, an explanation and apology. Unhappy with the company’s handling of the matter, the complainant brought his concerns to the Office of the Privacy Commissioner.

The Assistant Privacy Commissioner agreed with the complainant that photographing a tenant’s apartment constituted a collection of personal information (though that collection may be inadvertent) and that tenants should be informed beforehand why their apartments are being accessed and that the units will be photographed, and their consent obtained. The Assistant Commissioner also recommended that the other tenants, whose units had been photographed, be informed. Although the company agreed to amend its notice of entry form to include purposes and to inform tenants that their unit may be photographed, the company refused to obtain consent or to inform the other tenants, as recommended.

At first, the organization refused to implement the Commissioner’s recommendations and the matter was referred to the Commissioner’s litigation counsel. Shortly after commencing the application in Federal Court, the organization agreed to implement the recommendations thus avoiding the need to follow through with the litigation.

The following is a detailed overview of the investigation and the Assistant Commissioner’s findings.

Summary of Investigation

The complainant had received a notice from the property management company for his apartment building indicating that it would require access to his apartment for insurance purposes. The complainant was at home one afternoon, when two insurance inspectors and a representative of the property management company arrived at his apartment. The complainant allowed them to enter, and without warning or permission, the insurance inspectors began to photograph every room in his apartment with a digital camera.

Under paragraph 21(2)(2) of Ontario’s Tenant Protection Act (TPA), a landlord may enter a rental unit in accordance with written notice given to the tenant at least 24 hours before the time of entry to allow a potential mortgagee or insurer of the residential complex to view the unit. Neither the complainant nor the property management company could provide the Office with a copy of the exact notice sent to the tenants in this instance. The company did provide a copy of a template of the form that would have been used. The form provides space to indicate the address of the place to be entered, date, time, and purpose of entry, and the name of the individual entering the unit.

In the complainant’s opinion, by photographing his apartment, the company was collecting his personal information, an action to which he had not given his consent. He wrote to the company to express his concerns and requested that it assure him this would not reoccur. He also asked that the photographs be destroyed.

Shortly afterward, the complainant brought his concerns to the provincial tribunal. The company agreed to apologize, to destroy the photographs of his apartment (except for three photographs, which were kept as a result of his complaint before the housing tribunal and the Office) and to review its practices and policies to ensure that they conform to the Personal Information Protection and Electronic Documents Act (the Act).

The complainant believed that the company should have informed the other affected tenants of the collection and use of their personal information, and therefore complained to this Office.

According to the company, it is normal business practice to take photographs of property that is being assessed in order to gather information about the state of the interior of the apartment. To that end, photographs were taken to determine and document the state of repairs to the ceilings, walls, floors, bathrooms, kitchens, fixtures, and appliances – not to gather personal information. The company indicated that the photographs were used in a report prepared by a consultant on behalf of the property management company and the building owner to estimate the current market value of six particular apartment buildings. The appraisal was intended to provide assistance with mortgage financing. The complainant’s apartment was one of 21 units inspected out of a total of 62 units. According to the company, although photographs were taken of other units, not all were used in the report.

The company contended that the photographs were properly safeguarded. It stated that, when the photographs were stored, they were not identified by unit number. The digital photographs, it indicated, had since been destroyed. Once the report was completed, the consultant who took the photographs and prepared the report deleted them. The company maintained that the consultant at no time made any connection between the unit number and the names of the individuals residing in each apartment unit. The company stated that it did not retain any copies of the photographs.

The company acknowledged that personal information may have been visible in the photographs. It maintained, however, that there was no evidence of any improper collection or use of information. It indicated that no searches of the premises were conducted and the contents of the units were not recorded. The company also noted that, as the complainant was present at the time, he could have asked for an explanation. According to the company, all potentially affected tenants were given proper notice of entry and were aware that unit information was being gathered. It believed that the complainant’s request that all tenants be informed was unwarranted since there was no evidence of an improper collection or use of personal information.

The complainant denied the company’s assertion that his consent was implied. He stressed that the onus was on the company to obtain consent, and that consent must be obtained prior to or at the time of collection, use or disclosure. He indicated that it was coincidence that he was at home, and that many tenants were probably not. They would therefore have no knowledge that photographs had been taken. The complainant also pointed out that, since the company admitted fault in the collection of his personal information (as a result of his complaint to the housing tribunal), and took action to remedy the situation, it should do the same for all the other affected tenants. The complainant felt that the company, by failing to do so, was not being accountable under the Act.

According to the company, none of the original photographs exist anymore, and the consultant did not keep copies. The consultant confirmed that the digital photographs and the hard copy photographs of the complainant’s apartment were destroyed. However, he could still electronically produce the report, which contains the photographs of other units, as well as the interior and exterior photographs (the photographs of the complainant’s apartment show as “Image Not Available). The consultant confirmed that the report was not used for anything else and was not given to anyone else but the property management company. The digital images were stored on a password-accessible computer hard drive, as was the report. The consultant stated that he never knew the tenants’ names when he did the appraisals of the units. After the site visits, however, he was given a copy of the “Rent Roll” to do the income analysis portion of the report. The Rent Roll lists the unit number, tenant’s last name, and monthly rent. The tenants’ names were not used in the report. The consultant confirmed that the complainant did not in any way oppose his photographing of the apartment.

The consultant indicated that it is industry practice to photograph the interior of apartment units when conducting appraisals. The photographs are used by lenders or by insurance companies to make underwriting decisions. Most financial institutions require the provision of exterior and interior photographs of a building when providing financing for mortgages.

The Office reviewed a copy of the report. There were photographs of 11 other units. Under each photograph is the address and unit number. While the three photographs of the complainant’s apartment were removed, there was one photograph of a kitchen, which had no unit number listed. The consultant indicated that when the report was being compiled, he could not recall what unit that photograph belonged to. Therefore, he did not include a unit number. When the complainant described his kitchen to the Office, it was determined that the photograph in question was of his kitchen.

Findings

Issued August 24, 2006

Application: Section 2 defines personal information as “…information about an identifiable individual….” Principle 4.2 states that the purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected. Principle 4.3 stipulates that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Under Principle 4.3.2, organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which information will be used. To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed. Principle 4.8 states that an organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.

In making her determinations, the Assistant Commissioner deliberated as follows:

• The property management company contended that no improper collection or use of personal information took place. It questioned whether any personal information was in fact collected at all. In its view, it did not act in a manner contrary to the Act and therefore had no obligation to inform other tenants that their apartments were photographed.
• The Assistant Commissioner stated that the company would likely agree that the act of taking a photograph is a collection of data, but that that was where the agreement would likely end. While the company did not generally view the information in these photographs as personal information (although it could acknowledge that some of the photographs revealed personal information), the Assistant Commissioner felt that they did contain information of a personal nature.
• For example, she noted that, while the purpose of a particular photograph might be to show the state of the walls or the condition of a kitchen or bathroom of a certain unit, it also revealed information about the unit dweller and his or her standard of living. It might show whether they are tidy or not, whether they can afford expensive media equipment or not, whether they love music, or art, or cooking.
• Under section 2, personal information is defined as information about an identifiable individual. She noted that itstates only that the individual must be “identifiable,” not necessarily identified. Under each unit photograph is the street address of the building, and the unit number, thereby ensuring that each photograph of a unit could be traced back to the individual living in the unit.
• The Assistant Commissioner therefore concluded that the information at issue was information about an identifiable individual, and was personal information for the purposes of the Act.
• The Assistant Commissioner noted that the purpose was not to photograph the contents of the unit but rather to record the state of the unit. Nevertheless, she was of the view that the company ought to have been cognizant of the fact that by photographing the units, it might also be collecting the personal information of the people dwelling in those units.  Moreover, she considered that the company ought to have been sensitive to the fact that people consider their homes, above all, to be a very private sphere.
• She noted that it may very well be an industry practice to photograph the interior of apartment units, but that this did not mean that it is acceptable under the Act, to do so without informing tenants and obtaining their consent.
• The Assistant Commissioner commented on the organization’s obligations with respect to the collection of personal information – the purposes must be identified prior to or at the time of collection, the individual’s knowledge and consent must be obtained, and a reasonable effort must be made to ensure that the individual understands how the information will be used or disclosed. The Act also requires organizations to be open about policies and practices related to personal information management.
• In this case, the company notified its tenants that it would be accessing certain units, as required under the TPA, for insurance purposes. No mention was made that photographs of the units would be taken.
• The Assistant Commissioner noted that Principle 4.3.2 stresses the link between knowledge and consent and underscores the importance of the individual’s reasonable expectations. In other words, if an individual is being asked to consent to a collection of his or her personal information, he or she would reasonably expect to be informed of the reason for the collection. The Assistant Commissioner also believed that the individual would reasonably expect to be informed of the means of this collection.
• The tenants in this case were neither fully informed of the purposes for which any information collected would be used, nor were they told that photographs would be taken of their units.
• Thus, she concluded that, since photographs were taken that contained the personal information of identifiable individuals, the tenants should have been informed that not only was the landlord entering the premises for insurance or mortgage financing purposes, but also that photographs would be taken by a consultant to be used in a report prepared by him. The tenants should also have been told how the photographs would be safeguarded, and should have been provided with any other relevant information regarding the company’s privacy policies and practices. Only then would the tenants have had enough information upon which to base their decision to consent.
• She determined that this was clearly not the case and that the company had contravened Principles 4.2, 4.3, 4.3.2, and 4.8.
• The Assistant Commissioner recommended that the company inform the other tenants whose apartments were photographed for the report. She also recommended that the company indicate that it would, in any future notices to tenants, clearly state why tenants’ apartments were being accessed and that the units would be photographed, and obtain their consent beforehand.
• On the matter of consent, the company amended its notice of entry form, which now lists the reasons for entry (which are checked off) and notifies tenants that photographs may be taken of the unit, as required. The Assistant Commissioner noted that such an action met the requirement to inform tenants of the purpose and the means of collection, as outlined in Principles 4.2 and 4.3.2.
• However, the company stated that it would not obtain consent from tenants to enter their units or photograph them and indicated that the notice of entry form was in accordance with the lease and the requirements of the Tenant Protection Act.
• The Assistant Commissioner reiterated that taking photographs of an individual’s apartment is a collection of personal information, and knowledge and consent are required for any such collection.
• While acknowledging that that the company is subject to the Tenant Protection Act, she reminded it that it is also subject to this Act and must act in accordance with it.
• She therefore determined that its stance with respect to consent was in contravention of Principle 4.3.
• As for accountability, the company did not inform the other tenants that photographs had been taken of their units, as recommended. It stated that it did not believe that personal information was collected or misused during or after the inspection of the units.
• The Assistant Commissioner commented that this was a disappointing response and one that revealed a lack of understanding of personal information protection generally and the organization’s obligations under the Act, specifically.
• She therefore found that the company remained in contravention of Principle 4.8.

Accordingly, she concluded that both the consent and accountability complaints were well-founded. She noted that the Office would be pursuing the matter in accordance with its authorities under the Act.