Canadian Ruling Raises CCTV Issues.

A recent ruling by Canada's privacy commissioner sent a brief scare through the security community when at least two newspapers suggested that, under the ruling, a robber could now order a bank to shut off its CCTV cameras before he committed a crime, and the bank would have to comply. Although the privacy commissioner quickly repudiated that interpretation, calling it "perverse," the ruling, as well as the new legislation on which it is based, has raised issues about the use of CCTV by Canadian businesses that the courts may have to resolve.

The stir began when George Radwanski, the privacy commissioner, found that a security company in the Northwest Territories had violated the Personal Information Protection and Electronic Documents Act by using cameras on the top of a drug store to watch the streets below. The statute, which took effect at the beginning of this year, bars certain companies from collecting personal data about a person without his or her express consent or a warrant. In the ruling, CCTV use was considered collection of personal information, and some feared that, by extension, a robber could ask a bank or other business to turn off its cameras.

In a letter to a newspaper the day after the articles appeared, Radwanski distinguished a business's surveillance of public areas from its surveillance of its own property. In addition, he explained that the law incorporates provisions of consent and reasonableness. Under those provisions, it would be considered reasonable for banks to use security cameras, and consent to the information collection would be implied if customers were alerted via a sign indicating that surveillance was occurring.

But some attorneys say the ruling raises as many questions as it answers. Peter Mantas, an Ottawa technology lawyer, wonders whether cameras would have to be turned off in a bank if a customer expressly withdrew his consent, even if the use of cameras was considered reasonable. "I think the act says that even if the collection is reasonable, if consent is not given, it doesn't matter"--that is, that person can't be filmed. Also unresolved is whether the lack of consent would force the bank to turn off the cameras even if it were impractical to do so.

Other questions relate to the use of interior cameras that capture images in public areas. "Lots of banks and jewelry stores get their best evidence...just outside [the doors]," Mantas says. "Is that unreasonable?" He suggests that it might come down to such factors as how much of the public space the camera captures.

Also, in his clarification, Radwanski emphasized that, as long as cameras were used for security purposes only, such use in banks would pass the reasonableness test because "banks face a genuine and serious threat of robbery."

But, queries Mantas, what type of business, especially storefront business, doesn't face that risk? The reasonableness test would thus seem meaningless. In addition, he asks, would it be a violation to use cameras for valid business purposes, such as counting customers so as to know when to deploy additional personnel, as long as the tapes weren't retained? "You're left at the end of the day with no firm answers," he says.