By Terry McQuay, CIPP, CIPP/C

Use of Generally Accepted Privacy Principles (GAPP) mandated by Information and Privacy Commissioner of Ontario

In a special investigation report, "Privacy and Video Surveillance in Mass Transit System," published March 3, the Information and Privacy Commissioner of Ontario made several recommendations to the Toronto Transit Commission (TTC) regarding its deployment of video surveillance cameras. Prompting this investigation report was a complaint received from UK-based Privacy International relating to the use of video surveillance cameras throughout the city's mass transit system. The report provides a comprehensive analysis of the use of video surveillance cameras with the goal of realizing a "positive-sum"paradigm through the use of privacy-enhancing technologies.

One of the conclusions was "The TTC must ensure that its video surveillance program is subject to an effective and thorough audit conducted by an independent third party using the GAPP privacy framework." It was also recommended that the independent third-party audit be presented to the Information and Privacy Commissioner's office for review to help ensure that the audit is methodologically sound and comprehensive in its scope.

The Generally Accepted Privacy Principles (GAPP) provide an operational framework to help management address privacy in a manner that takes into consideration local, national or international requirements. The primary objective of the GAPP is to facilitate privacy compliance and effective privacy management.

Everett Johnson, CPA, Chair, AICPA/CICA Privacy Task Force, which is a joint body of the American Institute of Certified Public Accountants and the Canadian Institute of Chartered Accountants and is responsible for the creation of GAPP stated: "There is no question that GAPP is being used more and more by organizations all over the world. The fact that it is a comprehensive global privacy framework makes it an important tool in designing or assessing an organization's privacy program."

Although the report was prepared within the context of the public sector, this report provides guidance to private-sector organizations considering the use of video surveillance technologies in the areas of:

• notice;
• safeguards;
• retention periods;
• destruction processes; and
• training for employees.

To view the report visit www.ipc.on.ca/images/Findings/mc07-68-ttc.pdf and to download the GAPP visit www.cica.ca/download.cfm?ci_id=36533&la_id=1&re_id=0

Terry McQuay, CIPP, CIPP/C, is the Founder of Nymity, which offers Web-based privacy support to help organizations control their privacy risks. Learn more at www.nymity.com.