Personal Information Collected in Company's Defence of Damage Claim Falls Under PIPEDA

PIPEDA Case Summary #2011-003

March 25, 2011

Overview

A customer who slipped on the floor of a New Brunswick Sobeys grocery store in November 2008 complained to our Office that Sobeys had collected her personal information without her knowledge and consent through in-store video cameras. She also alleged that she was denied access to her personal information, including the store’s surveillance video recording of the incident.

We investigated whether Sobeys used signs or its privacy policy to notify its customers about its surveillance videos. We also wanted to know whether any such notification was adequately informative, and available in advance of a customer entering the premises.

Limiting collection

We concluded that Sobeys had, indeed, collected the complainant’s personal information without her knowledge and consent because there was inadequate signage about the surveillance cameras. We therefore upheld that portion of her complaint as well founded.

However, after Sobeys agreed to post decals on their storefronts in combination with a visible, live monitor screen with a camera hanging down beside it to alert shoppers to the surveillance, we deemed that particular issue to be resolved.

Identifying purposes and openness

With respect to the first component of the complaint, we concluded that Sobeys had failed to meet its obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA) to identify the purpose for which it was collecting personal information, and to be open about its personal information-management practices. 

We recommended that Sobeys explain in its privacy policy why the company uses video surveillance to collect personal information. We also called on the grocer to make readily available information about its video surveillance policies and practices.

Access to personal information

The second component of the complaint related to a request the customer had made to access the personal information that Sobeys had collected about her.

One piece of information she requested was the videotape of her fall, which the company’s lawyer sent to her lawyer even before the complaint was filed. Because the videotape was not withheld, we did not uphold that part of the complaint.

Definition of “commercial activity”

However, a second aspect of the access request related to documents that Sobeys prepared after the incident. The company argued that this information was not created in the course of a commercial activity and therefore did not fall under PIPEDA.

We disagreed. PIPEDA applies where an organization collects, uses or discloses personal information in the course of a commercial activity. We determined that an organization’s defence against a legal claim in tort from a customer must be considered a commercial activity under the Act where it arises in the ordinary course of the company’s ongoing business activities.

But while we concluded that PIPEDA applied to Sobeys’ collection of personal information in the circumstances, we also found that the store was entitled to deny access to the information under the Act’s specific exemption for documents protected by solicitor-client privilege.

Because the customer had the videotape in hand, and the legal papers were exempted from disclosure, we concluded that the portions of the complaint related to access to personal information were not well founded.

Background

The complainant claimed she was injured after having stepped in a puddle of water in a Sobeys store in November 2008. She discussed the incident with the store manager, and subsequently retained a lawyer.

In a letter to Sobeys, the lawyer indicated that his client reported that the store’s roof was leaking at the time.

The lawyer requested inspection and maintenance records for the store, along with any witness statements and surveillance tapes of the incident. 

In another letter in April 2009, the complainant submitted a further request for access to her personal information, pursuant to PIPEDA.

A later complaint to our Office alleged that Sobeys had collected, used and disclosed the customer’s personal information without her knowledge and consent. It also alleged that the store had improperly withheld personal information to which she was entitled under PIPEDA.

Our Investigation

1. Collection of Personal Information

In her complaint to us, the customer claimed that she was unaware that her personal information was being collected in the form of a videotaped record of the incident. She said that, when she initially reported her fall, the manager had neglected to disclose the existence of the videotape.

The complainant said she only obtained this information later from the lawyer representing Sobeys against her injury claim. 

Knowledge and Consent

PIPEDA requires the knowledge and consent of individuals for the collection of their personal information. Our 2008 Guidelines on Overt Video Surveillance in the Private Sector are also clear that the public must be informed of such surveillance.

However, a review of Sobeys’ privacy policy makes no mention of the use of video surveillance, or any collection of personal information by such means.

Sobeys also confirmed that there were no signs posted at the store to advise shoppers that the premises were under video surveillance. However, the company noted that there is a monitor that shows people entering and leaving the store, and cameras are suspended from the ceiling, in plain view of customers. Sobeys’ privacy officer argued that it would be obvious to anyone in the store that video cameras were in use. 

In our view, a monitor at an entranceway and cameras hanging high overhead, by themselves, do not provide clear and sufficient notice to patrons that a video surveillance system is in use. 

Moreover, people must be made aware of the surveillance while still outside the store, so that they can choose whether or not to enter. According to our guidelines, a sign should be posted at the front entrance to alert prospective customers. It should briefly describe the purpose of the video surveillance, and offer a telephone number for further information or to let patrons request access to their personal information. 

In a preliminary report of findings provided to Sobeys in December 2010, we recommended that all of the chain’s stores provide proper notice about the collection of personal information through the use of video surveillance. We also called on Sobeys to include a description of its practice of collecting personal information via video surveillance in its privacy policy.

In response to our recommendations, Sobeys has now placed a sticker at the entrance of the store in question where customers can also see a live monitor along with a camera hanging down beside it, as well as in another area of the store, indicating that closed-circuit television cameras are in use. 

Sobeys is also encouraging its other corporate stores to affix such decals and has since advised us that decals are in place at all its New Brunswick stores.

At the conclusion of our investigation, we determined that the collection portion of the complaint was well founded.

However, we also concurred that the decals, along with the viewing monitor at the store’s entrance and the camera hanging down beside the viewing monitor, constituted sufficient notice that the store is under video surveillance. Accordingly, we also deemed the issue to be resolved.

Identifying Purposes and Openness

People cannot be expected to know about or consent to the collection of their personal information unless the fact of the collection is made plain. That is why PIPEDA requires organizations to be open about their policies and practices, and to clearly identify what personal information they are collecting and why.

Toward that end, we urged Sobeys to improve their decals with an explanation of the purpose of the video surveillance. The stickers, we said, should also have a telephone number that customers can call if they have questions about the surveillance or if they want access to their personal images.

Sobeys, however, took issue with our view. The company argued that contact information would only encourage curious customers who wanted to view themselves on videotape, and that additional resources would be required to handle the workload. The company also predicted that such information would enable potential thieves to determine the viewing scope of store cameras. 

Sobeys also took issue with our observation that its privacy policy does not mention video surveillance.  Sobeys argued that it was unable to identify any other Canadian retailer who includes such a reference in its publicly available privacy policy.

We countered that the practices of other retailers do not relieve Sobeys of its obligations under PIPEDA. The law requires the company to identify the purposes for which it collects personal information—including through video surveillance—and to be open about its personal information-management practices. 

Accordingly, we called on Sobeys to update its privacy policy to explain its collection of personal information by video surveillance.   

2. Access to Personal Information

In addition to the collection issue, the complainant also alleged that she was being denied access to her personal information.

Sobeys’ privacy officer told us that the only personal information the store collected about the complainant in the course of its commercial activities was the security video footage.

When pressed, however, the privacy officer stated that the store had gathered further personal information about the complainant, but that it was generated in order to defend itself against an anticipated claim for damages by the complainant.

We considered both types of personal information separately.

Surveillance tape

The complainant’s lawyer initially sought access to the store videotape capturing the November 2008 incident. In April 2009, the complainant again requested access to the information under PIPEDA. Two days later, she received a copy of the videotape from the solicitor handling her injury claim on Sobeys’ behalf. 

Because the videotape had been turned over, we dismissed that portion of the access complaint as not well founded.

Reports and letters

With respect to the reports and letters created after the injury occurred, Sobeys contended that these documents related to the store’s defence of an injury claim by the complainant. In Sobeys’ opinion, therefore, this information was not collected in the course of a commercial activity as defined under PIPEDA, and therefore fell outside the purview of the Act.

We disagreed. We took the view that Sobeys’ activity of defending itself against a customer’s claim in tort for an incident that occurred on its premises was sufficiently related to its regular course of business that it constituted a commercial activity under the Act. It was therefore covered by PIPEDA.

That said, personal information subject to the Act may also be subject to specific exemptions under the Act. One of those exemptions, spelled out in paragraph 9(3)(a), relates to information that is subject to solicitor-client privilege.

In this instance, Sobeys began building a dossier after it was put on notice by the complainant’s solicitor that the complainant had injured herself in the store. No court action had yet been filed, but Sobeys could reasonably anticipate that a claim would be forthcoming.

We therefore found the documents in question to be subject to litigation privilege, a component of solicitor-client privilege, which protects materials brought into existence for the dominant purpose of litigation, or reasonably anticipated litigation. 

In our view, Sobeys was entitled to deny the complainant access to the personal information contained in those documents.

Accordingly, we determined that the portion of the access complaint related to the letters and reports was not well founded.