Surveillance signage lacking, leads to complaint
VANCOUVER (CP) — British Columbia's privacy office is calling on a medical clinic to immediately stop collecting video and audio of patients, employees and contractors because it is not legally authorized to do so.
Acting privacy commissioner Drew McArthur said an audit of the clinic in the Lower Mainland was the first of a private business in B.C. and began after a complaint was filed.
The Office of the Information and Privacy Commissioner published its finding Thursday in a report detailing an examination of the clinic's privacy management program and video and audio surveillance in its lobby, hallways, back exits and fitness room.
McArthur said the doctor who owns the clinic told auditors that eight video cameras were installed to deter crime, but there was no evidence to suggest such a concern existed and the clinic had no signage about its surveillance equipment.
Signage must state that surveillance is being conducted and for what purpose, typically for security reasons, along with contact information for inquiries, he said.
The clinic installed signs after the audit started but it was inadequate because it did not contain any information about audio recording, McArthur said.
He said private businesses are increasingly using video cameras to over collect personal information without any justifiable reason or knowledge about their legal obligations.
“We want people to be aware and note where these video surveillance system are in place. They have the right to query why they're in place.”
Video cameras serve as a crime deterrent only in limited situations, such as when employees are working alone, but a threat must be established before equipment is installed, McArthur said.
“There are a number of court cases in Canada where video surveillance was deemed appropriate in the circumstances, where either it was a high-crime area or there were many security issues associated with it or there were break-ins.”
Business owners create liabilities for themselves by using surveillance equipment because the information must be protected and provided to people who request it if they have been recorded, he said.
“You can't just provide the video to the individual. You have to review the video and make sure that no other personal information is disclosed with it. You would have to go through it and blur images of anyone else so they are not identifiable in the information you disclose.”
The report said the clinic, which did not develop a written privacy policy until it was audited, was also collecting other personal information from patients and employees without storing it securely and later disposing it inadequately in contravention of the Personal Information Protection Act.
“They needed to acquire a shredder,” McArthur said.
The privacy office called on the clinic to provide a written update within three months about its implementation of 12 recommendations, including regular privacy training and education for staff.
