Start with a clear purpose
Security cameras can help a business prevent theft, investigate incidents, and protect people or property. They can also collect personal information when an individual can be identified. According to guidance from Canada's privacy commissioners, privacy obligations may apply even when video is viewed live and not recorded.
Before installing cameras, identify the specific problem the system is meant to address. Also consider whether lighting, locks, access control, or another less privacy-intrusive measure could reasonably solve it. Once cameras are in use, the images should not be used for an unrelated purpose.
Limit what cameras capture
Each camera should cover only the area needed for the stated security purpose. Avoid capturing neighbouring homes, windows, unrelated public areas, or people who are not connected to the problem being addressed.
Cameras should not be directed at washrooms, change rooms, or other places where people have a high expectation of privacy. If changing the angle or using privacy masking can reduce unnecessary collection, that should be addressed when the system is installed.
Give people clear notice
People should be informed before they enter a monitored area. A clear and understandable sign should normally state that video surveillance is in use, explain its purpose, identify the responsible organization, and provide a contact for privacy questions.
A sign does not make every form of surveillance appropriate. The business must still have a reasonable purpose and limit collection to what is necessary.
Avoid unnecessary audio recording
The official guidance recommends that sound not be recorded unless there is a specific need. Audio is more intrusive than video and can raise additional legal concerns involving private communications.
For an ordinary property-security system, disabling the camera microphone is generally the simpler privacy-conscious approach unless the organization has carefully reviewed a defined need for audio.
Protect and delete recordings
Recordings should be stored securely and made available only to a limited number of authorized people. A business policy should explain who may view or export footage, when it may be used or disclosed, how access requests are handled, and how unauthorized access will be addressed.
There is no single retention period for every business. Footage should be kept only as long as it is required for the identified purpose, then securely deleted. A recording connected to a known incident may need to be preserved for the related investigation.
Review the system regularly
After installation, the business should periodically confirm that the original security problem still exists, the cameras remain effective, access is properly restricted, and footage is being deleted according to policy.
The main principle is simple: collect only the video needed to address a real security problem. A responsible system has a clear purpose, limited views, visible notice, controlled access, reasonable retention, and regular review.
How the official guidance applies
This article refers to joint guidance published by the Office of the Privacy Commissioner of Canada and the privacy commissioners of British Columbia and Alberta. The guidance explains the privacy principles private-sector organizations should consider when using overt video surveillance in publicly accessible places. It does not cover covert or employee surveillance, and specific requirements remain subject to the privacy laws that apply in each jurisdiction.
This article provides general information and is not legal advice.
Official sources
Planning a security project in Metro Vancouver?
Discuss your property with Vision Guard →