On October 29, 2020, a joint investigation conducted by the federal, Alberta, and British Columbia Privacy Commissioners (the "Commissioners") found that Cadillac Fairview ("CF") had embedded cameras inside their digital information kiosks at 12 shopping malls across Canada, without their customers' knowledge or consent.

The Commissioners found that CF violated Canadian privacy laws by failing to obtain meaningful consent before using small, inconspicuous cameras and facial recognition technology to collect personal information. Despite CF's assurances that shoppers were made aware of the activity through decals placed at mall entrances referring to CF's privacy policy, the Commissioners determined that this measure was insufficient.

The CF investigation is a reminder of the myriad of privacy issues facing businesses that collect, use, and disclose personal information in the course of their commercial activities. More importantly, it raises important considerations for commercial landlords and tenants before installing security cameras and other similar devices at their premises.

Privacy Law Obligations When Using Video Surveillance Cameras - Meaningful Consent

When a commercial landlord or tenant uses overt video surveillance, personal information about the subjects of the surveillance is collected, used, and may be disclosed. Personal information is information that identifies an individual or by which an individual's identity could, alone or in combination with other information, be deduced. This engages Canada's privacy legislation, the Personal Information Protection and Electronic Documents Act ("PIPEDA"). PIPEDA applies to each of the provinces and territories, other than Alberta, British Columbia, and Quebec; these three provinces have their own sets of privacy laws, which are substantially similar to PIPEDA.

PIPEDA requires that businesses obtain meaningful consent prior to the collection, use, and disclosure of personal information, including information obtained through video surveillance cameras. Such consent is only valid if it is reasonable to expect that the individual consenting would understand the nature, purpose, and consequences of the activity to which they are consenting.

The purpose for which the information is collected must also be one that a reasonable person would consider appropriate - for instance, installing video surveillance cameras for security purposes.

According to the Office of the Privacy Commissioner of Canada (the "Canadian Commissioner"), implied consent may be appropriate where information is collected through video surveillance cameras. Businesses can obtain implied meaningful consent to video surveillance by posting clear and understandable notices about the use of cameras on their premises. These notices should allow individuals to learn about the presence of video surveillance cameras before entering the premises, which thereby gives them the choice to not enter the premises if they do not consent to the surveillance. The Canadian Commissioner also recommends that these signs include contact information should individuals have questions or wish to access images of themselves that have been captured.

Meeting Privacy Law Obligations - Guidance from the Privacy Commissioner

The Canadian Commissioner's office has published guidelines for the use of video surveillance cameras in the private sector. These guidelines include the following 10 things to do when considering, planning, and using video surveillance:

  1. Determine whether a less privacy-invasive alternative to video surveillance would meet your needs.
  2. Establish a business reason for conducting video surveillance and use video surveillance only for that reason.
  3. Develop a policy on the use of video surveillance.
  4. Limit the use and viewing range of cameras as much as possible. For example, position the cameras so as not to capture unintended individuals or only turn the cameras on for limited periods of the day.
  5. Inform the public that video surveillance is taking place. This can include posting signs and distributing policies that explain the use and purpose of collecting video surveillance footage. Commercial landlords should also be sure to advise tenants of their surveillance policies before installing video surveillance cameras.
  6. Store any recorded images in a secure location, with limited access, and destroy them when they are no longer required for business purposes.
  7. Be ready to answer questions from the public, as individuals have the right to know who is watching them and why, what information is being captured, and what is being done with recorded images.
  8. Give individuals access to information about themselves, including video images.
  9. Educate camera operators on the obligation to protect the privacy of individuals. If the camera is monitored by an operator, consider only turning on the recording function when unlawful activity is suspected or observed.
  10. Periodically evaluate the need for video surveillance.

Perhaps the most important of these 10 guidelines is the obligation to provide notice that video surveillance is taking place. The recommended method of providing notice is by way of a sign or signs. These must be positioned so that such signage can be normally noticed and read by individuals before entering an area under surveillance (so they can avoid the cameras if they wish). The actual placement of the signs should be reasonably close to eye level and oriented to be readily noticeable by anyone about to enter an area subject to surveillance.

For a sign to be compliant, it must contain the following information:

  • A statement video recording is being conducted in the vicinity of the sign;
  • Whether captured images are being monitored live and/or recorded;
  • The times when video recording will occur;
  • The purpose(s) of the video recording;
  • The name of the organization(s) responsible for the video recording;
  • The title and contact information for the person in the organization who is responsible for personal information protection. This should include a phone number for a timely response to immediate queries, as well as usual contact details for correspondence (mailing address, email contact, privacy policy URL);
  • A reference to the specific privacy or personal information protection legislation that governs the handling of personal information in the situation (being the Personal Information Protection & Electronic Documents Act, S.C. 2000, c. 5); and
  • Contact information for the office of the privacy commissioner.

Conclusion

As a commercial landlord or tenant, there may be a variety of reasons to implement video surveillance and/or other security devices at your premises. It is important, however, to understand that you will be subject to a rigorous set of privacy obligations under PIPEDA. Failure to comply with those obligations is not only a costly risk, but a reputational risk that parties should equally seek to avoid.

If you are a commercial landlord or tenant considering implementing video surveillance cameras or other security devices at your premises, or if you already have devices installed and wish to discuss your obligations under PIPEDA, we would be pleased to assist you and answer any of your questions or concerns.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.