19 July 2004 Video of Workers Ruled OK A recent decision of the Federal Court dismissed a complaint against Canadian Pacific Railway by one of its employees under the Personal Information Protection and Electronic Documents Act (PIPEDA). This decision reversed a decision of the privacy commissioner. PIPEDA is federal privacy legislation that governs the use and collection of personal information. The act allows organizations to collect, use or disclose personal information only for appropriate purposes and - with certain exceptions - only with consent.   In December 2001, CPR installed six digital surveillance cameras at one of its mechanical facilities that repair locomotives and cars. The cameras were installed at access points, in general parts of the yard and in the parking lot. CPR posted a sign that the facility was protected by video and surveillance.   The employee complained the video was a violation of privacy and that CPR could use the tapes to monitor employee performance. CPR's position was that the cameras were a security measure to prevent theft and vandalism and to create a more secure workplace.   The court considered two questions to determine if there was a violation of PIPEDA:   - Was CPR's installation of security cameras for a purpose a reasonable person would consider appropriate under the circumstances?   - If so, did CPR have the consent of employees to collect this information?   CPR provided evidence that there had been numerous security breaches so video surveillance was found to be a reasonable and appropriate measure.   The test the court used to determine if the surveillance was reasonable was whether:   - the surveillance was necessary to meet the need identified,   - the surveillance was likely to be effective,   - the loss of privacy was proportional, and   - there was a less invasive way of achieving the same result.   The court dismissed the complaint, concluding the collection of information was not surreptitious since signs were posted. It was not continuous because cameras were only briefly capturing the image of people within their ranges. Nor was the information collected only for CPR employees - the cameras also captured the images of contractors, suppliers and trespassers.   Access to the tapes was restricted. The tapes were kept locked and could be accessed only by a manager or police if an incident was reported. If there were no incidents, the tapes were destroyed.   The loss of privacy was found to be minimal because if there were no security incidents the tapes were not viewed. The persons captured on camera would have a low expectation of privacy because of the location of the cameras.   CPR established that alternatives to the video surveillance, such as fencing or guards, were not cost-effective, and would have been disruptive.   The court found the personal information collected was reasonable under the circumstances. It ruled that employee consent was not required, based on the wording in PIPEDA that provides that consent is required "except where inappropriate".   This case provides some insight on how the courts will review privacy complaints regarding video surveillance.