Letter to operators of webcam website
The Privacy Commissioner of Canada and the heads of the data protection authorities of the United Kingdom, Australia and Macao, as well as the commissioners of Quebec, Alberta and British Columbia, sent the following letter to operators of a website that has posted links to footage of unsecured surveillance videos from remote access webcams in use around the world.
*Update:
Shortly after this letter was sent, the website stopped broadcasting footage from unsecured webcams. However, subsequently, the site did resume posting a smaller number of feeds. The situation continues to evolve and the OPC is discussing the matter with its provincial and international counterparts.
The incident highlights the need for anyone with a webcam in their home or business to ensure they take steps to secure the camera.
As well, it is important for companies that manufacture and sell Internet connected cameras to emphasize the importance of changing the factory default password – and make it as clear and easy as possible for people to do so.
For more information, please see our blog post.
November 21, 2014
Dear Sir or Madam:
We are writing to you jointly as privacy enforcement authorities to highlight an important privacy concern that has come to our attention.
We have strong concerns about your website and its aggregation of live video footage from internet connected cameras operating with the manufacturer’s default username and password. Such cameras can be found in household, public and commercial spaces, including places of employment around the world.
Your website states that it carries out this practice with the intention of demonstrating the importance of security settings for surveillance cameras. We recognize in principle the importance of bringing to light potential security issues; however this should be done in a way that is not harmful to individuals.
Given the sensitive nature of the personal information collected via such cameras, especially those placed within the home, and the fact that your website is actively disclosing that personal information without the knowledge of the individuals on camera, this poses a serious threat to individuals’ privacy around the world. This threat is further heightened by the inclusion of precise geographical location information.
Furthermore, as you are undoubtedly aware, this issue has received significant international media attention. This increased public attention will result in an even greater privacy risk to individuals from these cameras with remote access capabilities.
As such, we are calling on you to take immediate action to take down this website. We furthermore request that you refrain from re-establishing the website under its current domain name or any other domain name in the future if it continues to show any kind of camera footage featuring individuals where those individuals are not aware of the disclosure taking place. Failure to comply with this request for removal by November 26th, 2014 (00:00 GMT), will result in the consideration of additional enforcement action.
Sincerely,Original signed by
Timothy Pilgrim,
Privacy Commissioner of Australia
Original signed by
Daniel Therrien,
Privacy Commissioner of Canada
Original signed by
Chan Hoi Fan
Coordinator, Office for Personal Data Protection of Macao – China
Original signed by
David Smith,
Deputy Commissioner, Information Commissioner’s Office – United Kingdom
Original signed by
Me Jean Chartier,
President, Commission d’accès à l’information du Québec
Original signed by
Jill Clayton,
Information and Privacy Commissioner of Alberta
Original signed by
Elizabeth Denham,
Information and Privacy Commissioner for British Columbia
- Date modified: