The general rule of the Personal Information Protection and Electronic
Documents Act (PIPEDA) is that individuals must consent to the collection,
use and disclosure of their personal information.
There are certain situations
where personal information like video surveillance can be collected, used or
disclosed without consent, such as where:
(a) it is
reasonable to expect that the collection with the knowledge or consent of the
individual would compromise the availability or the accuracy of the
information; and
(b) the
collection of the information is reasonable for purposes related to
investigating a breach of an agreement or a contravention of a law of Canada or
a Province.
According to decisions of the
Office of the Privacy Commissioner (“OPC”), the following conditions must be
met to rely on one of the above exceptions to justify surveillance:
(a) the
collection of personal information must only be for purposes that a reasonable
person would consider appropriate in the circumstances:
(i)
Was it reasonable in all the circumstances to undertake
surveillance of the individual?
(ii)
Was the surveillance conducted in a reasonable way,
which is not unduly intrusive and which corresponds fairly with acquiring
information pertinent to the organization’s legitimate interests?
(b) There must
be substantial evidence to support the suspicion that a relationship of trust
has been broken or a law contravened (i.e. to determine whether the insured was
displaying behaviour inconsistent with her condition).
(c) The
organization must have exhausted all other means of collecting the information
in less privacy-invasive ways.
(d) The
collection must be limited to the purposes as much as possible.
(e) An
investigation firm must not collect more information than it needs to fulfill
the specific purposes identified at the outset of the investigation.
Draft Surveillance Guidelines
In
the Fall 2008, the OPC sought public consultation on a draft guideline[1] about the
conduct of covert video surveillance intended to apply to insurers and
employers. The guideline was developed based
on the premise that video surveillance technology is “inherently
intrusive”.
Several aspects of the
guideline are controversial.
Industry groups, including have
made submissions opposing aspects of the draft guideline.
While the proposed guideline is
not yet in force, the guideline serves to show how the OPC may address a privacy complaint in the future. In addition to incorporating the
above-referenced test, the draft guideline also requires:
- The decision to undertake
covert surveillance should be made at a very senior level of the
organization. - There should be a documented
record of every decision to undertake video surveillance, its progress and
outcome. - Organizations should have a general policy that guides
the decision making process and in carrying out covert surveillance in the most
privacy-sensitive way possible. - Organizations should enter into a service agreement
with the private investigation agency that incorporates the principals of the
guideline about the collection, use and disclosure of surveillance and the way
surveillance is approached and conducted. - The collection of images of third parties should be
avoided, or if captured, be deleted or masked by the use of “blurring
technology”.
The requirement for editing the
video or using “blurring technology” to remove reference to third parties is
troublesome. From an evidentiary perspective, courts demand that the original,
unaltered videotape be available for use at trial without unnecessary stops and
starts. The OPC suggests doing those
things to avoid capturing the images of innocent third parties.
It is premature to say whether
the draft guideline will survive intact, or whether the OPC will be persuaded
by the arguments of industry stakeholders.
In the meantime, insurers should pause to consider whether they want to
be proactive by incorporating even some of the draft guideline provisions as
best practices in conducting surveillance.
[1] “Guidance on Covert
Video Surveillance in the Private Sector”.
The draft guideline is no longer published on the Privacy Commissioner’s
website.