This week the Office of the Privacy Commissioner of Canada put out guidelines for respecting the privacy of employees, customers, and potential passers-by when using video surveillance. Occasionally, our team here at Forrester is asked about physical security measures which can fall outside our area of expertise. Other times, such as the following best practices, the suggestions are a specific example of the steps one should think through for a privacy impact assessment. In fact, many times when a client has questions about best practices for privacy in business, I will recommend following the guidelines from Canada because they are leaders in the area. If you are using video surveillance, here are their universal recommendations and guidance for doing so in a privacy-respecting manner.

  1. Determine whether a less privacy-invasive alternative to video surveillance would meet your needs.
  2. Establish the business reason for conducting video surveillance and use video surveillance only for that reason.
  3. Develop a policy on the use of video surveillance.
  4. Limit the use and viewing range of cameras as much as possible.
  5. Inform the public that video surveillance is taking place.
  6. Store any recorded images in a secure location, with limited access, and destroy them when they are no longer required for business purposes.
  7. Be ready to answer questions from the public. Individuals have the right to know who is watching them and why, what information is being captured, and what is being done with recorded images.
  8. Give individuals access to information about themselves. This includes video images.
  9. Educate camera operators on the obligation to protect the privacy of individuals.
  10. Periodically evaluate the need for video surveillance.