Video surveillance of employees vs. right to privacy — a delicate balance

Complaint under the Privacy Act (the Act)

Summary

1. On January 10, 2012, our Office received a complaint against the Canada Border Services Agency (CBSA) on behalf of employees who work at a border crossing, alleging that the CBSA's use of video monitoring contravened the Privacy Act (the Act). Specifically, the complainant alleged that the CBSA was using video technology to collect personal information for the purpose of monitoring employee conduct and performance, which the complainant argued, went beyond the original safety and security related purposes for installing the cameras. In addition, the complainant alleged that the CBSA did not have sufficient signage to inform employees that they were being monitored with video technology.
2. With respect to the issue of video monitoring, the CBSA argued that its activities complied with its Policy on the Overt Use of Audio Video Monitoring and Recording Technology (the Policy) and relevant directives, and therefore were consistent with the Privacy Act. When made aware of the complaint regarding signage, the CBSA added additional signs to inform employees that they were being monitored via video.
3. In our view, the CBSA's response was sufficient to address the issue of signage. Therefore, with the consent of the complainant, we concluded our investigation into this aspect of the complaint.
4. This report focuses on the CBSA's collection of employee personal information via video technology for the purpose of monitoring employee performance and conduct at a border crossing. During the course of our investigation, the CBSA provided us with an updated Policy on the Overt Use of Audio Video Monitoring and Recording, a rationale for collecting employee information using video technology, and assurance that it did not intend to use video technology to monitor employee performance.
5. In our view, modern video equipment has an incredible capacity to capture information that would not otherwise be observed or recorded. This raises serious concerns regarding the impact that this technology can have on the privacy of Canadians. However, we are at this time satisfied that the CBSA's updated Policy and its rationale for collecting employee personal information meet the standard for collecting personal information established under the Act. This said, we are awaiting confirmation that all proposed changes to the guidelines for implementing the Policy are complete and consistent with the CBSA's representations to our Office. Therefore, we find that the complaint is conditionally resolved until the CBSA provides us with satisfactory guidelines, at which time we will consider the matter resolved. The reasons for our finding are outlined below.

Initial Positions of Both Parties

6. The complainant is a CBSA employee who raised the issue of the CBSA's use of video monitoring on behalf of employees at a border crossing. He alleged that CBSA managers were inappropriately using video technology to monitor employees in the workplace. The complainant argued that the CBSA was expanding its use of video monitoring from the original purpose of promoting border security and workplace safety, to include monitoring the conduct and performance of employees. In his representations to our Office, the complainant cited an alleged incident where employees were notified by supervisors via email that employees had been seen smoking in a restricted area via video.
7. According to CBSA officials, workplace video surveillance at this port of entry is governed by the CBSA's Policy on the Overt Use of Audio-Video Monitoring and Recording Technology - which was updated and implemented in 2011 - and guided by the Directives on the Overt Use of Audio-Video Monitoring and Recording Technology (the Directives). The CBSA submitted that the purposes for collecting and using information captured by video technology are clearly outlined in its Policy and the use of this technology is necessary to fulfill its mandate and therefore consistent with the Act.

Legal and Policy Framework

8. Section 3 of the Act defines personal information as information about an identifiable individual and provides a non-exhaustive list of what constitutes personal information. From this definition, it is clear that the CBSA is capturing employee personal information with its video monitoring and recording devices.
9. Section 4 of the Act requires that personal information only be collected if it "relates directly to an operating program or activity of the institution". This means that the collection of personal information must be necessary for a government institution's programs or activities. Our investigation sought to determine whether the CBSA was using live and recorded video to collect personal information for the purposes of monitoring employee conduct and performance, and whether any such collection was in accordance with section 4 of the Act.
10. We note that by its very nature, video monitoring is particularly privacy invasive as it allows for the collection of a vast quantity of information, including an employee's image, appearance, and mannerisms. Much of this information may not be relevant to the purpose of the collection. Thus, the unrestricted use of video recording equipment to monitor individuals poses a serious threat to the privacy interests that the Act was designed to protect. Consequently, our Office has had long-standing concerns with the use of video technology for monitoring employees.
11. In response to these concerns, we have issued guidance on the use of video surveillance. While the guidance is not strictly speaking applicable to employee monitoring, some of the principles discussed are nevertheless relevant. In particular:
    • video surveillance should only be deployed to address a real, pressing and substantial problem;
    • video surveillance should be viewed as an exceptional step, only to be taken in the absence of a less privacy-invasive alternative;
    • the video surveillance system should be tailored to minimize the impact on privacy; and
    • excessive or unnecessary intrusions on privacy should be discouraged.^{Footnote 1}

Relevant Facts

12. There are currently 49 cameras at this border crossing. Five of these cameras have the ability to pan, tilt, and zoom. The remainder are fixed cameras. All of the cameras record in colour and are placed in areas where programs are administered. According to the CBSA's Directives on the Overt Use of Audio-Video Monitoring and Recording Technology, "no such equipment will be installed in places where the expectation of privacy is higher, such as washrooms, lunch rooms and locker rooms. In addition, signage will be posted to inform all individuals that an area is subject to audio-video monitoring and recording". We received assurance from the CBSA (including a map identifying all cameras at the border crossing) that the camera placement complies with this directive.
13. Although the Policy refers to "audio-video" monitoring, the CBSA advised that the audio-capability of the cameras at this border crossing has been deactivated. Therefore, we will limit our comments to the CBSA's collection of employee personal information by way of video monitoring.
14. The CBSA submitted that it consulted with the Customs and Immigration Union when developing the Policy and posted it on its intranet (Atlas) on December 13, 2011. All CBSA employees had access to this document at the time of the complaint.
15. In his submission to our Office, the complainant made specific reference to an alleged incident where employees were believed to have been observed smoking via surveillance cameras. A warning was subsequently sent out to all employees indicating that their compliance with the smoking policy would be monitored through means that could include video surveillance. The CBSA confirmed that the warning was sent out and that video surveillance could be used for that purpose, but denied that the initial incident was captured via video monitoring. Although the incident cited by the complainant does not appear to have involved the use of video monitoring, the scope of the complaint includes all of the CBSA's video monitoring activities related to its employees' conduct and performance at this border crossing, and therefore is not restricted to a single incident.

The CBSA’s Use of Video Monitoring and Recording Technology at the Time of the Complaint

16. The CBSA provided us with its Policy on the Overt Use of Audio-Video Monitoring and Recording Technology to explain how it uses personal information collected by video recording devices. The 2011 Policy outlined four usages of video monitoring and recording technology. The first three usages focus on security, as well as health and safety. However, the complaint concerns the fourth usage, which focuses on, "integrity and quality assurance of CBSA programs". The specific provision at issue in the Policy - paragraph 39(d) - states that audio-video monitoring and recording technology can be used for the following purposes:

    "(d)To ensure the integrity and quality assurance of CBSA programs:

    At all Ports of Entry and Inland CBSA Service Locations

    1. To monitor live interactions between employees of the CBSA and its clients, including members of the public;
    2. To monitor CBSA operations to ensure efficient program delivery;
    3. To gather information related to, provide evidence of or investigate allegations of breaches of the CBSA Code of Conduct and the Values and Ethics Code for the Public Service by CBSA employees, which includes the investigation of complaints filed to the Canadian Human Rights Commission;
    4. To gather information related to, provide evidence of, or investigate allegations of illegal activity by a CBSA employee."

17. The scope of paragraph 39(d) includes both employee performance and employee conduct. In general, we understand employee performance to concern how well an employee does his or her job. For example, the number of travellers an employee processes in an hour is a question of performance.^{Footnote 2} Whereas, we understand conduct to concern an employee's compliance with applicable rules and codes governing behavior that go beyond the achievement of workplace goals, such as the Values and Ethics Code for the Public Service and the CBSA Code of Conduct, and the Criminal Code. For example, the aforementioned smoking incident falls within the category of conduct because it concerns employee compliance with workplace rules of behavior that apply even when an employee is not performing his or her duties (such as while on a break). This said, it is important to note that conduct and performance are not necessarily mutually exclusive concepts and it can be difficult to make a sharp distinction between the two. In some cases, employee behavior might be considered both in terms of conduct and performance. For example, how an employee interacts with the public could be considered a question of performance insofar as the employee's duties require that he or she interact in a certain way to perform his or her duties. On the other hand, documents such as the CBSA Code of Conduct prescribe how CBSA employees must interact with members of the public (such as refraining from making abusive statements).^{Footnote 3} Therefore, there are some instances where employee behavior is a matter of both performance and conduct.
18. With respect to the 2011 Policy, we noted the last two bullets relate primarily to employee misconduct^{Footnote 4} whereas we found that the first two are broad enough to cover employee performance issues. This, along with other submissions provided by the CBSA, including a list of scenarios designed to guide staff in implementing the Policy, led us to believe that the Policy could be interpreted in such a way as to authorize the use of video technology to monitor employee performance.
19. In addition, the CBSA submitted that it used video technology to monitor "program and professional integrity." However, in our view, a broad range of employee conduct can fall within the scope of program and professional integrity. Furthermore, the CBSA did not present clear evidence of workplace problems that could justify the broad use of video technology for the purposes of monitoring individual employee conduct and performance. As a result, we found that the CBSA had not demonstrated that it was necessary to collect the personal information of employees for the broad range of purposes that could fall under program and professional integrity.

Request to the CBSA and subsequent response

20. We expressed our concerns to theCBSA and requested that it take the following actions:
    1. Provide the Privacy Investigations Branch of our Office with a rationale for using live and recorded video to collect personal information for the purposes of monitoring "program and professional integrity". This rationale should include a clear definition of what falls both within and outside the scope of program and professional integrity, and should demonstrate that the proposed practice is necessary and minimally intrusive. This rationale should be used to update the Policy, the Directives, and other supporting material related to the CBSA's video monitoring activities, and should be communicated to all CBSA staff.
    2. Provide the Privacy Investigations Branch of our Office with proposed changes to the Policy, the Directives, and supporting material that respond to the CBSA's commitment to refrain from using video surveillance to collect personal information for the purposes of monitoring employee performance. The CBSA should commit to implementing these changes when finalizing the updated Policy.
21. In a letter received in our Office on January 28, 2014, the CBSA responded to our concerns. Specifically, it updated its Policy by removing the subparagraphs in question (i-iv) in order to clarify its intention that video technology not be used to monitor employee performance. The CBSA also modified language in provisions identified by our Office as being overly broad in scope. It disseminated the updated Policy to CBSA employees via the organization's intranet on January 2, 2014.
22. With respect to the intended use of video monitoring and recording technology, the CBSA submitted that it would continue to use the technology to ensure the integrity and quality assurance of its programs. The CBSA argued that given the nature of its mandate, its operational environment, and its need to maintain public trust, video monitoring and recording technology is a necessary tool.
23. According to its enabling legislation, the CBSA's mandate is to provide "integrated border services that support national security and public safety priorities and facilitate the free flow of persons and goods, including animals and plants, that meet all requirements under the program legislation …"^{Footnote 5} We acknowledge that the CBSA needs to monitor its employees to some degree in order to carry out its mandate of providing border services. Furthermore, we accept that the nature of video technology entails that more information than is necessary to carry out the CBSA's mandate will be collected by the organization. However, the questions raised by this complaint included the extent to which the video technology is being used to monitor employee conduct and performance, and whether the CBSA is respecting privacy while fulfilling its operational needs.
24. In its representations to our Office as well as in its Policy, the CBSA distinguished between live video monitoring of employees and accessing video recordings of employees. Live video monitoring consists of viewing video images in real time and, according to the CBSA, can be used in situations where there is a need for a manager to supervise operations but it is not feasible to do so in person. However, in addition to displaying remote video images in real time, the video devices at this border crossing also record images. Therefore we considered the CBSA's respective rationales for using live monitoring and accessing recorded images separately.
25. According to the Policy, live video monitoring can be used to manage operations and deliver programs. The CBSA submitted that video monitoring technology was an essential tool for managing operations at border crossings. For example, a supervisor might use video devices to monitor and manage traveller line-ups, and in the course of doing so, observe employees performing their respective duties. According to the CBSA's representations, the physical layout of some of its operational environments, such as border crossings, preclude the possibility of using in-person supervision to manage program delivery. It argued that if real-time supervision is required, video technology is the most reasonable means to meet this need.
26. Both the 2011 Policy and the updated version state that live video monitoring of employee conduct can be used in cases where, "ongoing or repeated breaches of the Code of Conduct are suspected." The CBSA submitted that as a visible law enforcement agency, it must maintain a high level of credibility and public confidence in order to effectively deliver its programs. It argued that employee compliance is an important component to maintaining public confidence and credibility. Furthermore, the CBSA clarified that live video monitoring cannot be used to seek out infractions. Rather, it can be used as a tool to follow up on ongoing or repeated issues that have already been identified through other means.
27. With respect the use of recorded video images, both the 2011 Policy and the updated version state that video recordings can be used for the purpose of investigating formal allegations into breaches of the CBSA Code of Conduct or illegal activities by CBSA employees. In its representations, the CBSA clarified that it would only use video recordings to support investigations into allegations of severe misconduct that could have a "direct negative impact on program and professional integrity." It provided us with concrete examples of such misconduct as well as instances where video recordings were instrumental in investigating cases of serious misconduct. Furthermore, in the Policy, the CBSA has established a clear approval process to control access to video recordings for this purpose.
28. We recognize that in light of the CBSA's mandate and role as a law enforcement agency, employee adherence to the CBSA Code of Conduct has a direct and meaningful impact on the organization's ability to fulfill its mandate. Furthermore, the cameras in question are located in areas where programs are administered. This means that employees would reasonably expect to be observed by members of the public, managers, and colleagues in these areas in the course of performing their duties. Finally, the Policy explicitly limits the collection of personal information for the purpose of maintaining program integrity to that which is collected via live monitoring.
29. With respect to the issue of monitoring employee performance, the CBSA explicitly stated in its representations that it did not intend to use video monitoring for this purpose. Although this was not clear in its initial representations it has since been clarified by the department. Therefore, we are satisfied with the CBSA's commitment to not use personal information collected through video technology for the purpose of monitoring employee performance.
30. Concerning the issue of monitoring employee conduct, we accept the CBSA's rationale for using video recordings of employees to formally investigate allegations of serious misconduct. Therefore, we find that in this regard, the CBSA has met the standard for collection of personal information established under section 4 of the Act.

Findings and Recommendations

31. After reviewing the available evidence and the CBSA's representations, we are satisfied that it has met the standard for the collection of personal information established under section 4 of the Act for the abovementioned purposes. However, in the course of our investigation, the CBSA committed to providing us with updated scenarios that are designed to guide staff on the implementation of the Policy. We have yet to receive the updated scenarios. Once we receive the scenarios and are satisfied that they are consistent with the representations provided to us, we will consider the complaint to be resolved. Accordingly, I have concluded that the complaint is conditionally resolved.
32. We will follow up with CBSA in six months if we have not received by then its updated scenarios.