Retailer agrees to improve measures to safeguard video surveillance records

PIPEDA Report of Findings #2009-022

A woman complained that a retailer had disclosed images of her captured by store surveillance cameras to her ex-husband, his spouse and her employer. She also complained the company had refused to provide her with access to the video recordings.

After reviewing the circumstances of the case, our Office found it was reasonable for the retailer to believe that the complainant may have gone to the store to harass, intimidate or otherwise assault one of its employees. The ex-husband’s spouse worked at the store at the time.

PIPEDA permits organizations to deny access to personal information if the collection of this information was reasonable for purposes related to investigating a breach of an agreement or contravention of law, and also that it was reasonable for the organization to expect that collecting it with an individual’s knowledge or consent would compromise the availability or accuracy of the information.

In this case, we agreed that those criteria had been met and, therefore, that it was appropriate to deny access to the information.

However, we found that the company should not have disclosed the surveillance video to the complainant’s former husband’s spouse.

We recommended the retailer improve its measures related to both the safeguarding and disclosure of video surveillance records and also provide training for employees about those measures and rules.

The retailer confirmed it would implement the recommendations.

Our Office concluded that the complaint regarding access to be not well-founded and the complaint regarding disclosure to be well-founded and resolved.

Report of Findings

Complaints under the Personal Information Protection and Electronic Documents Act (the “Act”)

1. The Complainant alleges that the Respondent, a retail company, inappropriately disclosed her personal information to third parties, including her former husband, his spouse and her employer. The Complainant also alleges that the Respondent refused to provide her with access to her personal information in the form of video recordings of her at one of the Respondent’s stores.

Summary of Investigation

2. On December 19, 2007, the Complainant attended one of the Respondent’s stores. The Complainant was accompanied by a companion. Both the Complainant and her companion were police constables. Loss prevention employees of the Respondent used video surveillance equipment to record the Complainant and her companion’s visit to the store. A plain clothes security officer also followed the Complainant and her companion throughout the store.

3. Some time later, the loss prevention employees copied the December 19 video footage onto a CD-Rom and provided a copy to a fellow employee, who worked at the store and is married to the Complainant’s former husband.

4. The Complainant’s former husband and his current spouse made still images from the December 19 footage and included these images as part of a public complaint to the police about the Complainant.

5. The Complainant’s former husband made the complaint to the police on April 3, 2008. The police force concluded its investigation on October 28, 2008. The police investigation inquired into various events, including the Complainant’s attendance at the Respondent’s store on December 19, 2007. The police force interviewed the Complainant, her companion, her former husband and his current spouse and concluded that the Complainant’s former husband’s complaint was not substantiated by the evidence.

6. The Complainant learned about the surveillance and the photographs during the course of the police investigation and made a request to the Respondent for access to this information on June 5, 2008.

7. On June 23, 2008 and again on July 11, 2008, the Respondent refused to provide the Complainant with access to the video recordings in question. The Respondent stated that it considered the matter confidential in that it involved one of its employees and was therefore not able to provide the Complainant with any further information.

8. While the Respondent contests the jurisdiction of this Office over this complaint, it also advances the position that its actions are justifiable from a privacy perspective because the Complainant’s former husband’s spouse had told other employees of the Respondent that the Complainant presented a threat to her safety and had engaged in confrontational behaviour and that she was very concerned that the Complainant would harass her and might physically assault her in the Respondent’s store.

9. The Respondent argues that:

1. the Act does not apply because this dispute arises in the course of the Complainant’s former husband’s spouse’s employment, not in the course of a commercial activity;
2. the exception in section 9(1) of the Act applies, which requires organizations not to disclose personal information about third parties;
3. access need not be granted pursuant to the exception in section 9(3)(b) of the Act as confidential commercial information (namely, its security procedures) would be disclosed by providing the Complainant with the material requested;
4. access need not be granted pursuant to the exception in section 9(3)(c) of the Act because disclosing the information requested could reasonably be expected to threaten the life or security of another individual; and
5. the recordings were made as part of an investigation into a breach of the laws of Canada and obtaining the Complainant’s consent before making such recordings would have compromised the information being collected such that access could be refused pursuant to the exception in sections 9(3)(c.1) and 7(1)(b) of the Act.

Application

10. In making our determinations, we applied sections 2(1), 4(1)(a), 7(1)(b) and 9(3)(c.1) of the Act and Principles 4.3 and 4.9 of Schedule 1.

11. Section 4(1)(a) of the Act provides that the legislation applies to organizations that collect, use or disclose personal information “in the course of commercial activities”. Section 2(1) defines a “commercial activity” as any particular transaction, act or conduct or any regular course of conduct that is of a commercial character.

12. Principle 4.9 states that upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information.

13. Paragraph 9(3)(c.1) provides that an organization is not required to give access to personal information if the information was collected under paragraph 7(1)(b).

14. Paragraph 7(1)(b) provides, in turn, that an organization may collect personal information without the knowledge or consent of the individual if it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the law of Canada or a province.

15. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use or disclosure of personal information except where inappropriate.

Findings

June 9, 2009

Jurisdiction

16. The Respondent uses its video equipment for security and loss prevention purposes. The December 19 recordings were of the public areas of the store during normal business hours. The Complainant also maintains that she was at the store to shop and appears from the video recording to have made a purchase.

17. We do not accept the Respondent’s argument that the Act does not apply to its collection, use and disclosure of the Complainant’s personal information. While there may be an employment aspect to these events from the Respondent’s perspective, that aspect does not negate the commercial nature of the Respondent’s activities in regard to the Complainant.

18. The personal information in issue was collected by the Respondent in the course of commercial activities in public areas of the store during normal business hours through the use of equipment intended to protect the Respondent’s commercial interests in ensuring security and preventing loss.

19. As paragraph 4(1)(a) makes clear, the Act applies to every organization “in respect of personal information that the organization collects, uses or discloses in the course of commercial activities”. As the Act applies in respect of personal information that was collected in the course of commercial activities, the Respondent’s subsequent disclosure of this information to an employee for use for personal purposes does not exempt this particular disclosure from the operation of the Act.

20. Throughout the course of this investigation, the Respondent has reiterated and maintained its position that the Act does not apply to it on the facts and circumstances of this case because this complaint involves personal information collected about an employee. Notwithstanding its position with respect to the Office’s jurisdiction, the Respondent has, however, agreed to participate in this Office’s investigation with a view towards cooperatively resolving the matters giving rise to this complaint.

Access

21. We will deal first with the Complainant’s request for access to the video recordings in issue – a matter that is governed by Principle 4.9 of the Act, subject to the exceptions set out in section 9.

22. Paragraph 9(3)(c.1) of the Act provides that an organization is not required to provide access to his or her personal information to an individual if the information was collected under paragraph 7(1)(b) of the Act. There are two aspects of section 7(1)(b) the Respondent must satisfy for this exception to apply. First, the collection must be reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province. Second, it must be reasonable for the Respondent to expect that collecting the information with the knowledge or consent of the individual would compromise the availability or the accuracy of the information.

23. In our view, given the Complainant’s former husband’s spouse’s prior complaints to her employer, it was reasonable for the Respondent to believe that the Complainant may have been attending at its store to harass, intimidate or otherwise assault one of its employees.

24. The Respondent’s actions appears reasonable in this case because the Complainant’s former husband’s spouse had told her employer about her concerns regarding the Complainant before December 19 and because the persons involved in the recording do not appear to have a relationship with the Complainant’s former husband’s spouse beyond a co-worker relationship.

25. Based on the Respondent’s actions on December 19, it is clear that it found the Complainant’s former husband’s spouse’s concerns to be credible.

26. Likewise, the Complainant’s former husband’s subsequent complaint to the police supports the reasonableness of the Respondent’s belief that a contravention of the criminal and common law prohibiting harassment and assault could have occurred on December 19.

27. We express no view on whether the Complainant’s former husband’s spouse’s concern about a potential violation of the law is well-founded, as we believe some latitude must be given to the Respondent in assessing the risk (or lack thereof) that presented itself when the Complainant and her arrived at its store.

28. With respect to the other criterion of section 7(1)(b), it is obvious that seeking the Complainant’s express consent to this particular recording would have compromised the Respondent’s ability to document these events with a view to investigating a potential breach of the law and, if necessary, protecting its employee(s).

29. We are therefore of the view that the Respondent has not contravened Principle 4.9, as paragraph 9(3)(c.1) applies to permit it to refuse access on the facts of this case.

Use and Disclosure

30. Principle 4.3 of the Act provides that knowledge and consent of an individual is required for the disclosure of personal information.

31. There is no dispute that the Respondent permitted or allowed the Complainant’s former husband’s spouse to obtain a copy of the December 19 surveillance video.

32. The Respondent had no ability to control how the Complainant’s former husband’s spouse used this information or to impose other safeguards to protect the Complainant and it appears she provided this information to her spouse and possibly the Complainant’s employer.

33. The circumstances in which disclosure is permitted without knowledge or consent are set out in section 7(3) of the Act. While the Respondent did not direct our attention to these exceptions, we have canvassed the criteria set out therein. We are satisfied that none of these exceptions permitted disclosure of the videotape to the Complainant’s former husband’s spouse.

34. As outlined above, the Respondent’s position is that the Act does not apply to its disclosure of the video recordings to the Complainant’s former husband’s spouse because she was its employee and the disclosure did not occur in the course of commercial activities.

35. As we do not accept this position for the reasons outlined above, we find this disclosure to the Complainant’s former husband’s spouse to be a contravention of the Act.

36. In the course of our investigation, we asked the Respondent to:

1. develop improved measures for the safeguarding of video surveillance records and rules regarding the persons to whom such records may be disclosed; and
2. train employees about those measures and rules.

37. The Respondent has confirmed that it is willing to implement these recommendations and, is, in fact, already in the process of reviewing and improving its procedures regarding video surveillance records.

Conclusion

38. In view of the foregoing, we find the complaint regarding the disclosure of the Complainant’s personal information to be well-founded and resolved.

39. We find the complaint regarding the Respondent’s refusal to provide the Complainant with access to the video recordings in issue to be not well-founded.

40. We would, however, remind the Respondent of its obligations under subsection 9(5) of the Act to notify this Office if it decides not to give access to personal information in the circumstances set out in paragraph 9(3)(c.1).