캐나다 브리티쉬 콜롬비아 주 가이드 라인
Privacy Guidelines for Use of
Video Surveillance Technology by Public Bodies
1. Introduction
Video surveillance is one of many tools used by public bodies to ensure the security of individuals, assets and property. Public bodies must exercise a high degree of care when using video surveillance technology in order to protect the privacy of individuals who visit or work at monitored sites.
2. Purpose
The Government of British Columbia recognizes that video surveillance technology may be required by public bodies for legitimate operational purposes, but its use must be in accordance with the provisions of the Freedom of Information and Protection of Privacy Act (the Act). The following guidelines are designed to assist public bodies that identify an appropriate use for video surveillance technology and to manage records that may be created using this technology in a manner that complies with the Act and records management requirements.
3. Authorities
◦ Freedom of Information and Protection of Privacy Act (RSBC 1996, c. 165) and Freedom of Information and Protection of Privacy Amendment Act, 2002.
◦
◦
◦ Document Disposal Act (RSBC 1996, c. 99)
◦
◦
◦ Corporate Privacy and Information Access Branch (CPIAB), Ministry of Management Services Freedom of Information and Protection of Privacy Act Policy and Procedures Manual
◦
◦
◦ Records and Information Management Manual
◦
◦
◦ Administrative Records Classification System (ARCS)
◦
◦
◦ GMOP Chapter 10 – Security
◦
4. Definitions
"Video surveillance technology" refers to cameras that monitor or record the activities of individuals at a government facility, including, but not limited to: video cameras; closed circuit television cameras; still frame cameras; digital cameras; and, time-lapse cameras. These devices may be used to create records, including videotape, photographic or digital images.
"Personal information" means recorded information about an identifiable individual.
A "record" is defined under Schedule 1 of the Act to include: books, documents, maps, drawings, photographs, letters, vouchers, papers and any other thing on which information is recorded or stored by graphic, electronic, mechanical or other means but does not include a computer program or any other mechanism that produces records. This means that videotapes are included under the definition of a record.
”Privacy Impact Assessment” means an assessment that is conducted to determine if a new enactment, system, project or program meets the requirements of Part 3 of this Act.
Records created through video surveillance can be classified as "special media records" which are defined under the Administrative Records Classification System as: photographs, sound recordings, motion picture films, video recordings, audio-visual materials, pictorial records, paintings, prints, maps, plans, blueprints, architectural drawings, and other sound, film, video, photographic or cartographic materials
"Transitory records" are records that are created to be used only for a limited period of time for the completion of a routine action or the preparation of an ongoing record. Transitory records are records of a temporary usefulness that are not an integral part of an administrative or operational record series.
5. Applicability and intended audience
These guidelines are applicable to all public bodies covered by the Act.
6. Designated responsibilities
The head of a public body is responsible for ensuring the public body complies with the Act. The head of a program area is responsible for the security and administration of records within that program area and complying with the provisions of the Act. The public body’s director or manager of information and privacy has the responsibility for ensuring that the collection, use, retention, and disclosure of personal information comply with the Act. The public body appoints a contact who has responsibility for answering questions from employees and members of the public regarding the public body’s use of video surveillance technology, specifically the collection, use, retention, access, and disposal of personal information collected by the video surveillance system
7. Written policy
Public bodies must develop written policies and procedures covering the use of video surveillance systems to ensure that personal information is managed in accordance with the Act.
8. Collecting personal information
Section 26 of the Act outlines specific circumstances under which public bodies may collect personal information:
26 No personal information may be collected by or for a public body unless
(a) the collection of that information is expressly authorized by or under an Act
(b) that information is collected for the purposes of law enforcement, or
(c) that information relates directly to and is necessary for an operating program or activity of the public body.
The public body must be able to justify the collection of personal information through the use of video surveillance technology in accordance with Section 26 of the Act.
9. Managing records created by video surveillance technology
Records created by public bodies covered by the Document Disposal Act are government records which must be retained and disposed of in accordance with approved records retention and disposition schedules (e.g., a program-specific Operational Records Classification System [ORCS] or the Administrative Records Classification System [ARCS] or a special government-wide schedule).
Video surveillance devices that record images of individuals on tape, photographically, in digitized format or in any other media, collect personal information that must be protected in accordance with the Act. Section 30 of the Act states:
30 The head of a public body must protect personal information by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure or disposal.
Public bodies should store all tapes, not in use, in a secured locked cabinet or storage room. In addition, public bodies must securely dispose of old tapes. It is recommended that the tape be shredded, burned or degaussed (magnetically erased).
Records used for decision-making must be managed in accordance with Section 31 of the Act, which states:
31 If a public body uses an individual’s personal information to make adecision that directly affects the individual, the public body must retain that information for at least one year after using it so that the individual has a reasonable opportunity to obtain access to it.
Public bodies should retain and store videotapes that are required for evidentiary purposes according to the standard procedures until they are required by law enforcement authorities.
A public body that uses video surveillance devices for recording personal information must meet the requirements set out by Section 32 of the Act, regarding the use of personal information. Section 32 of the Act states:
32 A public body may use personal information only
(a) for the purpose for which that information was obtained or compiled, or for a use consistent with that purpose (see section 34)
(b) if the individual the information is about has identified the information and has consented, in the prescribed manner, to the use, or
(c) for the purpose for which that information may be disclosed to that public body under sections 33 to 36
10. Notification
A public body that collects personal information in accordance with Section 26 of the Act using a video surveillance system is obligated to notify individuals affected under Section 27(2) of the Act, which states:
27(2) A public body must tell an individual from whom it collects personal information
(a) the purpose for collecting it
(b) the legal authority for collecting it, and
(c) the title, business address and business telephone number of an officer or employee of the public body who can answer the individual’s questions about the collection.
The following is suggested wording for use in building signage:
"This area is monitored by video surveillance cameras. For further
information contact:
Contact Position
Contact Telephone Number."
Although Section 27(2) sets out requirements to notify individuals of the collection of personal information, there are instances where notification would defeat the purpose for which the information is being collected (e.g., investigation of criminal activities). The only exceptions to the requirement set out under Section 27(2) to notify individuals of the presence and purpose of a video surveillance system are noted in Section 27(3) of the Act, which states:
27(3) Subsection (2) does not apply if
(a) the information is about law enforcement or anything referred to in section 15(1) or (2), or
(b) the minister responsible for this Act excuses a public body from complying with it because doing so would
(i) result in the collection of inaccurate information, or
(ii) defeat the purpose or prejudice the use for which the information is collected.
11. Implementing video surveillance systems
Section 69 of the Act states that it is mandatory for a ministry to conduct a PIA on any existing or planned video surveillance system:
69(1) In this section:
Privacy impact assessment means an assessment that is conducted to determine if a new enactment, system, project or program meets the requirements of Part 3 of this Act.
69(5)
The head of a ministry must conduct a privacy impact assessment and prepare an information sharing agreement in accordance with the directions of the minister responsible for this Act.
A public body that implements a video surveillance system to deter crime, protect the safety of members of the public and employees, or meet operational requirements must conduct a Privacy Impact Assessment to evaluate the privacy implications of the proposed video surveillance system and to ensure that security requirements are met in the least intrusive manner possible. A public body that is intending to implement a video surveillance system should contact either the director or manager of information and privacy or the Corporate Privacy and Information Access Branch of the Ministry of Management Services for assistance and guidance in conducting the Privacy Impact Assessment.
The decision on whether a video surveillance system is appropriate for the security requirements of a public body is based on a Security Threat and Risk Assessment (STRA). Contact the Risk Management Branch, Ministry of Finance for more information on conducting an STRA. Public bodies should consult Treasury Board’s Government Management Operating Policy (GMOP) Chapter 10 – Security, for more information on developing a security management program.
12. Camera location, operation and control
Public bodies should ensure that the location, operation and control of any video surveillance system meet their security requirements. In addition, public bodies should restrict the collection of personal information in surveillance to those purposes identified in Section 26 of the Act. Within the appropriate context of those purposes, public bodies should also take into consideration whether the surveillance is a necessary and viable deterrent. Access to the operation and control of any video surveillance system should be restricted to designated staff only.
13. Operational times
In cases where video surveillance has been put in place to deal with a threat to security of individuals, assets and property, public bodies might consider the appropriateness of filming only at times when there is a higher likelihood of a threat of security to individuals, assets and property.
14. Audits and reviews
Public bodies should conduct follow-up privacy impact assessments on their use of video surveillance on a regular basis in order to confirm adherence to policies and procedures and compliance with the Act. Public bodies must advise all camera operators that the system is subject to audit and that they may be called upon to justify the method of surveillance to a member of the public or an employee of the public body.
Public bodies must be aware that, under the authority of Section 42(1)(a) of the Act, the Office of the Information and Privacy Commissioner may conduct periodic audits of the public body’s video surveillance system.
15. Conclusion
Public bodies that are using video surveillance technology are required to comply with the provisions of the Act. Consultation should take place with the public body’s security officers and directors or managers of information and privacy prior to implementing and administering a video surveillance system. The director or manager of information and privacy will be able to provide assistance and guidance to ensure the requirements of the Act are being met. The Corporate Privacy and Information Access Branch (the central agency responsible for freedom of information and protection of privacy) is also available to provide corporate policy advice and interpretation of the provisions under the Act.
This page was last updated April 22, 2002
2002-04-21
