Video surveillance in businesses can violate privacy laws

VICTORIA — B.C.’s acting privacy commissioner is warning private businesses that they might be breaking the law if they install video-surveillance cameras without thinking through the privacy implications.

Drew McArthur said a recent audit of an unnamed Lower Mainland medical clinic that had eight video cameras in operation is an example of the growing trend of cheap and easy-to-install surveillance systems that likely violate B.C.’s privacy laws.

McArthur rejected the clinic’s argument that it had installed the cameras in common areas to prevent crime, improve security and monitor employee behaviour.

“The fundamental premise of our private-sector privacy legislation is you require the purpose for collection has to be reasonable for the circumstances,” he said. “In this case, there’s no crime issue or threat-to-security issue, it’s just a medical clinic in a stand-alone location and they have not had a rash of crime or security issues.

“And so they don’t meet the threshold for reasonableness in terms of the collection of personal information. So where they are, they are over-collecting personal information.”

It would be more acceptable for a bank, with a lot of assets, or a convenience store, where employees might be working through the night, to justify surveillance, McArthur said. And it’s not acceptable to record all your employees and customers as a deterrent against possible future crimes because that doesn’t satisfy the legal requirements either, he said.

McArthur’s report on the medical clinic was the first of its kind involving a private business. The clinic has been given three months to remove its cameras and delete its video footage or face an order from the commissioner’s office that could be backed up in court.

McArthur declined to name the clinic, saying he wasn’t trying to single it out, but rather to use it as an illustrative example of a larger problem.

“You can go into Costco and acquire a video-surveillance system very economically and implement it yourself, and for that reason we’re providing this as an educational opportunity,” he said.

The clinic put cameras in its lobby, hallways, back exits and a fitness room, collecting video 24 hours a day of all the employees, patients and cleaning staff. The footage was only supposed be watched by the clinic’s owner, a physician, but McArthur noted others had access, too.

Although the clinic had signs pointing out the cameras, it failed to explain to people that the cameras were also recording the audio of their conversations, and it failed to tell people they had a right to see their own footage, the report ead.

In short, it failed to get people’s informed consent.

McArthur’s office published a tip sheet for private businesses that called on them to develop a policy, limit the time the cameras are on, avoid recorded unintended people, display adequate signs, store the footage in a secure location and limit access to the footage.

McArthur said businesses also need to know that the video they capture of employees and customers is their personal information and they’re liable for it being stolen or misused.