Cameras collect personal information, and in Ontario that brings federal privacy obligations and, for many employers, a written monitoring policy. Most of it is straightforward — but it is much cheaper to handle at design than after a complaint.
We design and install security systems. What follows is a plain-language summary to help you ask the right questions. Confirm your own obligations with counsel and with the authority having jurisdiction before you rely on any of it.
The Personal Information Protection and Electronic Documents Act governs organizations collecting personal information in the course of commercial activity. Identifiable video of a person is personal information. In practice that means you need a stated purpose for the collection, notice to the people being recorded, a retention period you can defend, and a way to respond when someone asks for their own footage.
The Working for Workers Act, 2022 amended the Employment Standards Act to require employers above a specified size to maintain a written policy on electronic monitoring of employees and to provide it to their workers. If you are installing cameras that record staff — which is most commercial installations — this is likely to apply to you, and it is a document you want written before the system goes live rather than after.
Three design decisions follow directly from the above, and all three are cheap now and expensive later:
Notice should be visible before a person enters the area being recorded, state who is collecting the footage, and give a contact for questions. A generic warning sticker on the door does not meet the intent.
Yes, in practice. Under PIPEDA, collecting personal information requires knowledge and consent, and covert surveillance of employees is held to a much higher bar than overt surveillance. Separately, Ontario's Employment Standards Act now requires certain employers to have a written electronic monitoring policy. Signage and a written policy are the baseline.
The Working for Workers Act, 2022 amended the Employment Standards Act to require employers with 25 or more employees as of January 1 in a given year to have a written policy on electronic monitoring of employees, and to provide it to workers. Confirm your obligations with counsel — thresholds and deadlines are set in the Act.
PIPEDA requires that personal information be retained only as long as necessary for the purpose it was collected for, and that you have a retention policy. In practice, pick a defensible period tied to your actual incident timeline, write it down, and apply it consistently. Keeping everything forever is as much a problem as keeping nothing.
Under PIPEDA an individual generally has a right of access to their own personal information, and video of an identifiable person is personal information. Responding usually means producing the footage with other individuals obscured. Systems that cannot redact make this expensive, which is worth knowing before you buy one.
Anywhere a person has a reasonable expectation of privacy — washrooms, change areas, medical rooms. Beyond that, cameras should be positioned for a stated purpose rather than general observation, and the purpose should be written down before installation rather than justified afterwards.