PDF Version: Privacy and Video Surveillance on Campus

With thanks to Greg Hagen for his helpful suggestions on a draft of the blog.

Recently, I was walking across the campus at the University of Calgary and noticed that there was a display by an anti-abortion group (Campus Pro-Life Club). Because of a dispute over permission to have the display, the University had posted warning signs and barricades. One University sign indicated that the group was videotaping everyone who spoke to the display’s staffers and that this was contrary to the University’s Privacy Policy. Since I am aware that the University uses surveillance cameras, this incident caused me to wonder what rights students, staff and the public have with regard to video surveillance on campus, whether by the University or by others on campus.

Because it is an educational body (“local public body”), the University is governed by Alberta’s Freedom of Information and Protection of Privacy Act, R.S.A. 2000, c. F-25 (“FOIPA”). As evidenced by its title, this legislation deals with access to information held by public bodies and protection of our privacy when dealing with such bodies. In general, privacy legislation regulates the collection, storage, disclosure and disposal of personal information. “Personal information” includes “recorded information about an identifiable individual”. Video surveillance can fit this description.

Video surveillance by businesses would be subject to either the Personal Information Protection Act, S.A., 2003, c.-6.5 (“PIPA”) or the federal Protection of Information and Electronics Document Act, S.C. 2000, c. 5. In Alberta, non-profit organizations are subject to the PIPA only if they are engaged in commercial activities.

The overarching principle regarding video surveillance is that it should be used only for purposes that a reasonable person would consider appropriate in the circumstances. Generally, in order to limit the impact on privacy, cameras should be positioned to avoid capturing the images of people not being targeted and they should not be used in areas where people have a heightened expectation of privacy, such as a washroom or through a building’s windows.

Alberta’s Information and Privacy Commissioner, Frank Work, issued comments on the use of public surveillance systems. He said that the public must have notice. This reflects the wording of the FOIPA, which requires consent be given to the collection of personal information, except in specified circumstances. In asking colleagues and students who frequent the University, my rough survey indicates that the University may not necessarily be compliant with the notice requirement. No one was aware of spotting a sign indicating there is video surveillance on campus.

Additionally, the Information and Privacy Commissioner indicates that even where the surveillance system is found to be justified, there must be policies in place addressing:

• • the number and placement of the cameras,
• • control of access to information gathered through the use of surveillance measures, and
• • adequate retention and disposition schedules.

The University of Calgary’s Privacy Policy does not specifically address video surveillance, but both of its “Acceptable Use of Personal Information in Enterprise Information Systems Policy”) and the “Video Surveillance Policy” do. The Privacy Policy addresses the access to and collection, disclosure, use, retention and security of personal information. The Enterprise Systems Policy deals with confidentiality by staff who have access to personal information (including video surveillance information) because it is kept in a university enterprise system. Finally, the Video Surveillance Policy deals with the closed circuit television system (“CCTV”) monitored by Campus Security.

The Video Surveillance Policy indicates that the purpose of the CCTV system is to “discourage unlawful or anti-social behaviour of individuals on university premises”. It is also used to “apprehend and prosecute offenders” (art. 4.1). The policy says that surveillance cameras are situated in “identified public areas” and will not monitor areas where individuals have a “reasonable expectation of privacy”. In addition, cameras will not be used to see into licensed drinking establishments on campus, or directed at windows of private offices, residences or properties neighbouring the University (art. 4.3). Also, signs showing that the CCTV system is in operation will be visible to employees, students and people visiting the campus (art. 4.4). Video monitors are kept in a controlled access area and recorded images from the CCTV system are securely stored (art. 4.6). The policy also addresses when the recorded images may be used, disclosed, accessed, deleted, and retained.

The Campus Security Website indicates that there are 45 CCTV cameras on campus—14 exterior cameras on buildings or in parking lots and 31 interior cameras mounted inside buildings.

What can or must the University do if it is aware that a student group (not University Staff) may be violating the Video Surveillance and Privacy Policies while on campus? First, one would have to establish that the individuals in the group would be subject to the University’s privacy policies. Second, one would have to determine what the obligations of the University are in relation to people who may be violating their policies.

Since the persons doing the videotaping were on campus despite the objections of the University, it would seem difficult to establish that they would be subject to the University’s Privacy Policy. Perhaps it could be argued that as students, they are subject to the policy and were in violation of it. The Privacy Policy is stated to apply to personal information in the custody or under the control of the University of Calgary. One might argue that the students’ footage is under the control of the University; however, I am not sure if this argument would be successful. Could the University actually demand that it be given the footage? In addition, the wording of the Video Surveillance Policy suggests that that policy applies only to those who are operating or maintaining the CCTV system.

What about the University’s obligations with regard to groups or individuals who may be violating privacy rights? In a recent decision of the Office of the Information and Privacy Commissioner (with a very different fact situation), members of a union were accused of video recording and photographing people who were crossing a picket line at a Casino. Some of the images were being posted to the union’s website, http://www.casinoscabs.ca/. There were no allegations made against the Casino. An Adjudicator found that some of the Union’s collection, use and disclosure of the information was for a reasonable purpose, but that the union had failed to provide notice of its authorized purpose in accordance with s. 13 of the PIPA. Second, the Adjudicator found that some of the purposes for the collection, use and disclosure of the personal information were not authorized under the PIPA. The union was ordered to cease collecting, using and disclosing this information and to destroy any information in its possession that it had collected in contravention of the PIPA. See: United Food and Commercial Workers, Local 401, Information and Privacy Commissioner, Order P2008-008 (March 30, 2009). Since the Casino was not brought into the matter, it is not possible to tell from this case whether it could have been liable for allowing such activities to take place on its premises. Thus, the existing cases do not provide any guidance as to whether the University would be legally responsible for permitting the group to violate its Privacy Policy.

Assuming the University could not be liable for the actions of the students, do people who are being videotaped by members of the group have any remedies under privacy law? It is unlikely that the PIPA would apply because the individuals involved were probably not an “organization” or individuals acting in a commercial capacity. Thus, individuals who were videotaped without notice or consent would be left to rely on common law or statutory protections of individual privacy. Alberta does not have any general statutory privacy law outside of the FOIPA and the PIPA. However, some provinces have recognized a common law tort of invasion of privacy. It is not well developed in Alberta and there is doubt as to whether a Canadian common law court would recognize a right to privacy in an unsecluded public place. Arguably there would be little reasonable expectation of privacy on the public parts of a university campus, where the display was held and the videotaping was done.

Thus, perhaps ironically it would seem that the University’s Privacy Policy would apply to any CCTV cameras that are aimed at and filming the people at and visiting the anti-abortion display. However, with regard to any remedy for the video surveillance done by the anti-abortion display persons, other individuals could only exercise their own precautions to avoid being taped.