It’s ironic that most companies use video surveillance cameras to watch for trouble, not realizing that improper use of these cameras could get a company into trouble.

A recent study at the University of Toronto concluded that the vast majority of Canadian businesses operating security cameras do so with little regard for federal privacy legislation. Although the signage requirements under the Personal Information Protection and Electronic Documents Act (PIPEDA) are simple, the research (published at surveillancerights.ca) points to an overwhelming number of cases in which video surveillance is carried out without stating a purpose for doing so or offering a contact number for more information.

Andrew Clement, the professor in the U of T’s Faculty of Information who presided over the study, tells me that it has been three years since he started offering a $100 reward for reports of compliant cameras, but the money has yet to find a deserving claim. Ontario’s Information and Privacy Commissioner, Ann Cavoukian, had this to say: “I find it disappointing that so many businesses have no signage in place to keep the public informed of the use of surveillance cameras. “

The findings should be a concern to businesses because any passer-by can trigger a potentially lengthy and embarrassing privacy investigation. Audits by a privacy commissioner are nothing to sneeze at. They can be invasive and expensive, leaving an indelible mark on the business in the form of a public report on the website of the Office of the Privacy Commissioner of Canada (OPC) or potentially leading to lawsuits if the commissioner finds that the complaint is “well founded.” And they’re certainly not the kind of thing you would want to show up in Google search results.

The Office of the Privacy Commissioner of Canada makes it clear that:

In keeping with Principle 4.3 of PIPEDA, all retail organizations using video surveillance in their stores must give patrons clear and sufficient notice about the collection of their personal information. The notice should, moreover, be posted at the entrance, so that customers can exercise their right to withhold consent by not entering the premises.

Information about an organization’s personal information management practices, including video surveillance, should be readily accessible.

Failing to comply with the rules under PIPEDA could spell trouble for any business, a fact that Sobeys can attest to. The grocery chain faced an investigation by the Privacy Commissioner and the threat of a lawsuit after a shopper at one of its stores in New Brunswick complained to the commissioner about being videotaped without her consent.