By Terry McQuay, CIPP, CIPP/C

Video Surveillance in Mass Transit Systems

On March 3, 2008 the Information and Privacy Commissioner of Ontario, Ann Cavoukian, released Privacy Investigation report MC07-68, titled "Privacy and Video Surveillance in Mass Transit Systems: A Special Investigation Report."

This special report was prompted by a complaint received by the commissioner from Privacy International regarding the Canadian expansion of the use of video surveillance cameras in Toronto's mass transit system (TTC). In addition to investigating the complaint, the commissioner expanded the report to include a review of the literature and an examination of the role that privacy-enhancing technologies can play in mitigating the privacy-invasive nature of surveillance cameras.

In 2001, the commissioner's office issued Guidelines for the Use of Video Surveillance Cameras in Public Places (the Guidelines). The guidelines were updated in 2007.

Before deciding whether to use video surveillance, the Guidelines recommend that organizations consider the following:

• A video surveillance system should only be adopted after other measures to protect public safety or to deter, detect, or assist in the investigation of criminal activity have been considered and rejected as unworkable. Video surveillance should only be used where conventional means (e.g., foot patrols) for achieving the same law enforcement or public safety objectives are substantially less effective than surveillance or are not feasible, and the benefits of surveillance substantially outweigh the reduction of privacy inherent in collecting personal information using a video surveillance system;
• The use of video surveillance cameras should be justified on the basis of verifiable, specific reports of incidents of crime or significant safety concerns;
• An assessment should be made of the effects that the proposed video surveillance system may have on personal privacy and the ways in which any adverse effects may be mitigated;
• Consultations should be conducted with relevant stakeholders as to the necessity of the proposed video surveillance program and its acceptability to the public;
• Organizations should ensure that the proposed design and operation of the video surveillance system minimizes privacy intrusion to that which is absolutely necessary to achieve its required, lawful goals.

Once a decision has been made to deploy video surveillance, the Guidelines set out the manner in which video surveillance cameras should be implemented in order to minimize their impact on privacy.

In the Special Report the commissioner's investigation concluded that:

• the information collected by the TTC's video surveillance cameras qualifies as "personal information" as defined under section 2(1) of the Municipal Freedom of Information and Protection of Privacy Act (the Act);
• the collection of personal information by the TTC's video surveillance cameras is in compliance with section 28(2) of the Act;
• the Notice of Collection is provided to TTC passengers in compliance with section 29(2) of the Act;
• the disclosure of personal information to the Toronto Police Services is in compliance with section 32 of the Act;
• the TTC has adequate security measures in place to safeguard the personal information collected. However, the TTC should amend its policy to require that all employees dealing with the video surveillance system sign a written agreement regarding their duties, including an undertaking of confidentiality;
• the TTC has proper destruction processes in place for recorded information that is no longer in use;
• the TTC should amend its retention periods for video surveillance images that have not been used from the current maximum of seven days to a maximum of 72 hours;
• as the TTC expands its use of video surveillance cameras in the public transit system, it must take additional steps to inform the public, by publishing general information on its Web site and by holding more extensive consultations, possibly in the form of town hall meetings;
• the TTC must ensure that its video surveillance program is subjected to an effective and thorough audit conducted by an independent third party, using the GAPP Privacy Framework.

In light of these conclusions, the commissioner made 13 recommendations to the TTC that would enhance the protection of personal information collected through its video surveillance system.

Terry McQuay, CIPP, CIPP/C, is the Founder of Nymity, which offers Web-based privacy support to help organizations control their privacy risks. Learn more at www.nymity.com.