Safety and Security Camera Systems Procedures

Responsibilities 

1. The Executive Director (ED), Safety, Security, Risk & Privacy (SSRP) is ultimately responsible for administering this Policy, including: the approval of new Security Camera Systems; the secure installation and operation of approved Security Camera Systems; the secure storage of recorded Camera Data in accordance with related College policies; regular audits of the privacy and technical standards of the Security Camera Systems; and training of Authorized Personnel. The ED, SSRP may designate responsibilities to other positions in the College.  


2. The Manager, Safety & Security is the designate responsible for the installation, maintenance, audits, notification, and operation of approved Security Camera Systems; the secure storage and retention of Camera Data; training and compliance of Authorized Personnel; and the approval of requests for access to Camera Data from internal College members and law enforcement, and in emergency situations. 


3. The Privacy Officer is the designate responsible for the approval of any new Security Camera Systems or Privacy Impact Assessments (PIAs); the approval of requests for access to Camera Data from law enforcement; auditing Security Camera Systems for privacy compliance; and for responding to privacy complaints, breaches, and all other access requests.

Operations and Use

4. VCC may use Security Camera Systems to monitor or record activities on properties owned, leased, or controlled by the College:  
   
   
   
   1. to assist in the protection of individuals, property, or assets;  
   
   
   2. to assist in the prevention and investigation of: 
      
      
      
      1.  criminal activity, injury, and property loss; and 
      
      
      2.  violations of College policies related to safety and security. 
      
      
      
      
   
   
   3. to facilitate responses to emergencies, natural disasters, inclement weather, or other serious incidents; 
   
   
   4. for other purposes expressly authorized by law. 
   
   
   
   


5. VCC will only collect Personal Information through Security Camera Systems when the information is directly related to and is necessary for one or more of the purposes described in section 4, and only under the following conditions:  
   
   
   
   1. other means for achieving the same objectives are substantially less effective than using cameras;  
   
   
   2. the benefits of using cameras substantially outweigh any privacy intrusion;  
   
   
   3. the cameras have been configured to collect the minimum amount of Personal Information necessary to achieve the purpose of the collection. 
   
   
   
   


6. VCC will only use Personal Information collected through Security Camera Systems for one of the purposes described in section 4, or for a use consistent with those purposes. 

Installation and Notification

7. Approval is required prior to the installation or expansion of any camera or Security Camera Systems. 


8. The Manager, Safety & Security will complete a PIA specific to Security Camera Systems prior to the installation of any new cameras and Security Camera Systems. The Security Camera Systems PIA will be approved by the Privacy Officer and the ED, SSRP prior to installation. 


9. The Manager, Safety & Security will complete a PIA for any new system or software related to or needed for operating the Security Camera Systems. 


10. Security Camera Systems will not be directed to look through the windows of adjacent buildings or properties not owned, leased, or controlled by VCC. VCC will not install any Security Camera Systems in or near areas where individuals have a reasonable expectation of privacy, including, but not limited to: washrooms, change rooms, offices, first aid/health rooms, counselling, and disability services areas.  


11. Security Camera Systems that are privacy-intrusive, including, but not limited to, Security Camera Systems that may record employees in the course of their regular work duties, will be approved: 
    
    
    
    1. only when the Security Camera Systems are proven to be necessary;  
    
    
    2. when clear and specific needs for these cameras are identified in the Security Camera Systems PIA;  
    
    
    3. after consultation with affected individuals, who will be notified if installation is approved; and 
    
    
    4. as permitted under the Act.  
    
    
    
    


12. The installation or expansion of any Security Camera Systems will take measures to mitigate privacy intrusion when it is not deemed to be necessary, such as employing privacy zones in Security Camera Systems' configuration to prevent the collection of Personal Information in certain visible areas.  


13. VCC will display clear public notification of Security Camera Systems. Signage will be provided at the perimeter of any area monitored by Security Camera Systems.  


14. If privacy-intrusive Security Camera Systems are installed, the Manager, Safety & Security will directly inform affected employees about the installation and position of the camera(s).  


15. VCC will post a public notification on its website of the purpose(s) for the use of its Security Camera Systems; the legal authority for the collection of information using these Security Camera Systems; and the title and contact information of an employee who can answer questions about the collection.


16. Security Camera Systems will only be installed by a designated employee or service provider of VCC. 

Access and Disclosure

17. Access to Camera Data is limited to those Authorized Personnel as necessary for the performance of their job duties. All monitoring or review of Camera Data will be conducted in a professional, ethical, and legal manner.  


18. The Manager, Safety & Security will respond to internal requests for access to Camera Data only from the Vice President, People Services or designate with investigative responsibilities within the College and only when requests are necessary for managing the employment relationship between VCC and the employee and as authorized by section 4(b). The Manager, Safety and Security, will inform the Privacy Officer of any disclosure.


19. Requests for Camera Data from law enforcement agencies in Canada must be made by completing a Law Enforcement Access Request Form. The Manager, Safety & Security and the Privacy Officer will both approve the Request Form prior to the release of any Camera Data. Disclosure to law enforcement agencies is only permitted by the Act, when the request is made to assist in a specific investigation: 
    
    
    
    1. undertaken with a view to a law enforcement proceeding; or  
    
    
    2. from which a law enforcement proceeding is likely to result. 
    
    
    
    


20. The Manager, Safety & Security may disclose Camera Data in emergency situations, or where compelling circumstances exist that may affect anyone's health or safety. The Manager, Safety & Security will notify the Privacy Officer in these circumstances and will only disclose this Camera Data to the appropriate individuals and in accordance with the Act and other applicable laws. 


21. All other internal or external requests for access to Camera Data, including requests for access to an individual's Personal Information, are considered access to information (FOI) requests. These requests must be made in writing with enough detail to identify the records sought and be directed to the Privacy Office. The Privacy Office will manage these requests in compliance with the Act. 


22. The Department of SSRP maintains access logs that document the use, access, disclosure, and retention of Camera Data. Access logs are maintained both within the Security Camera Systems' software and in physical records within the Security offices.  


23. Any theft or loss, or unauthorized access, use, disclosure, storage, or retention of Camera Data is a privacy breach. All privacy breaches must be immediately contained and reported to the Privacy Officer in accordance with VCC Freedom of Information and Protection of Privacy Policy - Privacy Breaches and Complaints Procedures 501-3.  


24. Any privacy complaints related to Security Camera Systems should be made directly to the Privacy Officer. The College will follow the VCC Freedom of Information and Protection of Privacy Policy - Privacy Breaches and Complaints Procedures 501-3.  

Retention and Disposal

25. Security Camera Systems are passive systems that record only on motion detection but are operational on a 24-hour basis.  


26. All Camera Data will be overwritten after a maximum of 30 calendar days through automatic configuration through the Security Camera Systems' software, with the following exceptions:  
    
    
    
    1. if Camera Data is needed to facilitate or document an investigation or legal proceeding related to section 4 of these procedures, the Camera Data may be retained for as long as required for that specific purpose; 
    
    
    2. any Camera Data used to make a decision that directly affects an individual must be retained for at least one year following the date of that decision.  
    
    
    
    


27. Any retained Camera Data will be securely destroyed when they are no longer required.  

Audit and Security

28. Monitors used to view and review Camera Data will be located in secure areas that are restricted to Authorized Personnel and are not viewable by the public. 


29. Access to any Security Camera System or associated software, system, or storage media is restricted to Authorized Personnel. Security Camera Systems software, systems, and storage media are protected by modern cyber security controls and employ role-based access.  


30. Any Security Camera Systems storage media will be held in a secure location.  


31. On a monthly basis, Security Officers will review Security Camera Systems, including monitors and storage media, to determine whether:  
    
    
    
    1. any changes need to be made in the use or configuration of the Security Camera Systems; 
    
    
    2. the Security Camera Systems have been approved are being used in accordance with the terms of their approval;  
    
    
    3. the Security Camera Systems are effectively addressing the intended purpose of installation, and whether that purpose remains a concern;  
    
    
    4. there is any reason that justifies the Security Camera Systems' termination.  
    
    
    
    


32. The Manager, Safety & Security will promptly address any concerns that raised by audits, including reporting any privacy-related issues to the Privacy Officer. 


33. Other audits, as determined by any privacy impact or risk assessments, will be conducted by the Department of SSRP as required.  


34. Any significant changes made to the terms documented in PIAs for Security Camera Systems or associated software or system will require an updated PIA to be completed.  


35. The Department of SSRP will maintain a register of cameras in the Security Camera Systems through the Security Camera Systems' software.  


36. Camera Data may not be sold, publicly viewed, or distributed in any other manner except as stated in this Policy and in applicable legislation.