Saturday, October 25, 2008

PIPEDA: Guidelines for Covert Video Surveillance

  • A manager at a railway company uses the zoom lens on cameras, installed for the purpose of monitoring train movements, to watch two employees leaving company property during regular working hours without permission.
  • An employee with a history of work-related injuries over a period of several years refuses to cooperate with his employer’s efforts to accommodate him or to provide current information to support his disability claim. His employer hires a private investigation firm to conduct covert video surveillance to observe the employee for a period of two weeks to determine if he indeed had the physical limitations he was claiming.
  • A transportation company hires a private investigation firm to conduct surveillance on an employee suspected of violating the company’s Conflict of Interest Policy by having a romantic relationship with a colleague. While the employee under investigation was the target of the surveillance, images were also covertly captured of the colleague and alleged romantic partner.

Which of the above scenarios are in violation of PIPEDA (Personal Information Protection and Electronic Documents Act)? *

The Privacy Commissioner of Canada has prepared a draft guidance document that sets out good practice rules for private sector organizations that are either contemplating or using covert video surveillance.

The guidelines also include the test used by the Office of the Privacy Commissioner to determine whether an organization may properly rely on covert video surveillance:

1. The collection of personal information must only be for purposes that a reasonable person would consider appropriate in the circumstances.

2. There should be substantial evidence to support the suspicion that:

  • the relationship of trust between the organization and an individual has been broken;
  • there has been a breach of an agreement; or,
  • a law has been contravened.

3. Covert surveillance is a last resort and should only be contemplated if all other less privacy-invasive means of collecting personal information have been exhausted.

4. The collection of personal information must be limited to the stated purposes to the greatest extent possible.

Feedback on the draft guidance will be received until November 14, 2008. The Privacy Commissioner is particularly interested in comments from those directly affected by covert video surveillance, including unions representing employees of federally regulated organizations as well as consumer associations.

*Only the scenario in the first bullet was found to be in violation of PIPEDA.

Monday, October 13, 2008

Private eye Steve Rambam: Privacy is dead

Private investigator Steve Rambam has worked on a number of high-profile cases in his 25 year career, including tracking down Nazi war criminals in Canada. In a recent interview with Computerworld, Rambam discusses PallTech, his investigative database service with more than 25 billion records on U.S. citizens and businesses.

PallTech claims to have “ pretty much every American's name, address, date of birth, Social Security number, telephone number, personal relationships, businesses, motor vehicles, driver's licenses, bankruptcies, liens, judgments -- I could go on and on”

If the fact that PallTech has amassed this much specific information on almost every American isn’t troubling enough, there are two other disturbing issues raised in the interview. The first is the apparent lack of security or oversight of the sensitive data. When asked who has access to the data and how it is safeguarded, Rambam replies:

This is a database that's restricted to law enforcement, private investigators, security directors of companies and people who have a genuine need. … The most restrictive rule is my own personal ethics. In 20 years, we haven't had a single lawsuit or complaint.

The second troubling issue is how the data is being contributed:

The other thing is the mind-boggling level of self-contributed data. The average person now willingly puts on the Internet personal information about himself that 20 years ago people would hire an investigator to try and get. It's extraordinary. If you know how to use the Internet, 75% of an investigation can be conducted sitting in your pajamas.

Rambam feels that people have no reason to fear that PallTech will abuse their personal information, as they are “more accountable” than the US government: “You can sue us; you can subpoena us. You can hold us to task if we do something improper. Not so the U.S. government.”

Rambam is a proponent of public access to information, in order to prevent government abuse. In an earlier post, I mentioned David Brin’s book The Transparent Society , which discusses the illusion of privacy and advocates making most information available to everyone to ensure greater transparency and accountability.

Will information remain private and "secret", or are we on a path to making it open and public?

Monday, October 6, 2008

October is Public Library Month in British Columbia

According to B.C. Library Association executive director Alane Wilson, more than 98 per cent of British Columbians live in an area that is served by a public library, and this year's theme for Library Month -"Your Library, Your World" - reflects the many ways in which libraries contribute to the fabric of B.C.'s education, culture and community.

While the following video focuses on Seattle Public Library, the message about the library's role in society is true on both sides of the border: