Security Video Surveillance Policy

Security Video Surveillance Policy

Approved: September 24, 2018

Policy Objective

The purpose of the Video Surveillance Policy is to describe Toronto Public Library's installation and use of video surveillance equipment in the interests of privacy, public safety, protection of property, and to maintain a safe and welcoming environment for library customers, staff, and service providers.

Underlying Principles

Underlying the Policy Objective is Toronto Public Library's commitment to maintaining a safe and welcoming environment for staff and members of the public. Toronto Public Library will achieve this through a modern, cohesive security system that strives to minimize intrusions upon the personal privacy of customers, staff, and service providers. Video surveillance is to be deployed on the basis of a formal needs-assessment carried out by designated Toronto Public Library staff. Through the use of a prescribed protocol, designated staff will be empowered to determine how video surveillance equipment will be deployed based on Toronto Public Library's security needs. Video surveillance will only be deployed for identifiable purposes that are consistent with this Policy.

The Security Video Surveillance Policy provides detailed direction concerning the context, procedures, and protocols within which the Library installs and operates surveillance cameras. The Policy ensures that the Library follows the guidelines set out by the Information and Privacy Commissioner of Ontario, and the privacy requirements of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), without compromising the safety and security of Library visitors, staff, and premises.

Policy Statement

This Policy is in place to maintain public safety and security of property through adequate monitoring of library facilities. The deployment of surveillance cameras and monitoring systems is achieved through the consistent use of an evidence based approach to camera deployment. This protocol is detailed under the Specific Directives section of this Policy. Video surveillance deployment is guided by the principle of minimal intrusion by video surveillance systems into the daily operation of library facilities. Video surveillance systems are deployed only when needed based on criteria established within the Specific Directives. Library premises are monitored in the interest of asset protection, and to maintain safe library premises that are welcoming to library staff and visitors.

Scope

This Policy applies to all surveillance camera systems, deployed across all Library-owned and/or leased properties. This Policy does not apply to video surveillance used for employment-related or labour-related information.

Application

This Policy applies to all Toronto Public Library staff and contracted workers. All parties will be made aware of this Policy, their obligation to comply with it, and given instructions in meeting the Policy's requirements.

Specific Directives

  1. Protocol for Implementation of a Video Surveillance System at a particular site:

    The Toronto Public Library has developed a needs based assessment process for acquisition and installation of a surveillance camera. The documents developed in relation to this are:

    A. TPL Security Video Surveillance System Needs Assessment Form;
    B. Process for Acquiring Security Camera Equipment

    1. Factors to Consider Prior to Using Video

      Before deciding to install video surveillance, the following factors must be considered:

      1. The number of verifiable incidents of crime or significant safety concern;
      2. The level of risk to the safety of staff and customers posed by such incidents;
      3. The potential for violation of the Library's Rules of Conduct;
      4. A video surveillance system should only be considered after other measures of deterrence or detection have been considered and rejected as unworkable;
      5. On a system-wide basis, a Privacy Impact Assessment (PIA) must be conducted on the effects that the proposed video surveillance may have on personal privacy. The PIA should indicate mitigation strategies to limit adverse effects relating to privacy; and
      6. The proposed design and operation of the video surveillance systems should minimize privacy intrusion.

    2. Designing and Installing Video Surveillance Equipment

      When designing a video surveillance system and installing equipment, the following must be considered:

      1. Given the open and public nature of the Library's facilities and property, and the need to provide for the safety and security of individuals who may be present at all hours of the day, the Library's video surveillance systems may operate at any time in a 24-hour period;
      2. The video equipment shall be installed to monitor only those spaces that have been identified as requiring video surveillance;
      3. The ability of authorized personnel to adjust cameras shall be restricted so that authorized personnel cannot adjust or manipulate cameras to overlook spaces that are not intended to be covered by the video surveillance program;
      4. Equipment shall never monitor the inside of areas where the public and employees have a higher expectation of privacy (e.g. change rooms and washrooms);
      5. Where possible, video surveillance should be restricted to periods when there is a demonstrably higher likelihood of crime being committed and detected in the area under surveillance;
      6. Reception/recording equipment must be located in a strictly controlled access area. Only authorized personnel shall have access to the controlled access area and the reception/recording equipment;
      7. Every reasonable attempt should be made by authorized personnel to ensure video monitors are not in a position that enables the public and/or unauthorized staff to view the monitors.

    3. Notice of Use of Video Systems

      In order to provide notice to individuals that video is in use:

      1. The Library shall display signs, visible to members of the public, at all entrances to a premise where video surveillance is being utilized and/or on the perimeter of the area under video surveillance;
      2. The notification requirements of this sign must inform individuals of:
        1. the legal authority for the collection of personal information;
        2. the principle purpose(s) for which the personal information is intended to be used; and
        3. the title, business address, and telephone number of someone who can answer questions about the collection.

    4. Personnel Authorized to Operate Video Equipment

      Only authorized personnel shall be permitted to operate video surveillance systems.

  2. Video Equipment/Records

    1. Types of Recording Device

      The Library may use either recording mechanisms that record information directly on a hard-drive or recording mechanisms using a removable/portable storage device in its video systems. Facilities using video recorders will retain these records in accordance with the specified retention periods.

    2. Record Identification

      All records (storage devices) shall be clearly identified (labeled) as to the date and location of origin including being labeled with a unique, sequential number or other verifiable symbol. In facilities with a DVR that stores information directly on a hard-drive, the computer time and date stamp shall be understood to be this identification. In facilities with a VCR or other recording mechanism using a removable/portable storage device, the authorized personnel shall affix a label to each storage device identifying this information.

    3. Record Keeping

      Policy, Planning and Performance Management (PPPM) is the office of record for disclosure requests that are received either electronically or in paper format. Requests are to be scanned, or photographed and e-mailed to disclosure@tpl.ca. A hard copy is to be delivered to the Data Governance and Privacy Risk Advisor via inter-office mail. Staff are not to retain copies of images on their personal devices. Once an image of a form is sent via e-mail, any existing electronic copies of the image must be destroyed from personal devices.

  3. Access to Video Records

    1. Access

      Access to the video surveillance records shall be restricted to authorized personnel, and only in order to comply with their roles and responsibilities as outlined in the Security Video Surveillance Policy.

    2. Storage

      All storage devices that are not in use must be stored securely in a locked receptacle located in an access-controlled area.

    3. Formal Access Requests Process

      With the exception of requests by law enforcement agencies, all formal requests for video records should be directed to PPPM. Requests are subject to the requirements of MFIPPA and the Library's Access to Information and Protection of Privacy Policy.

    4. Access: Law Enforcement

      If access to a video surveillance record is required for the purpose of a law enforcement investigation, the requesting Law Enforcement Officer must complete the Disclosure of Personal Information Form and forward it to the authorized staff member. The authorized staff member will provide the recording for the specified date and time of the incident requested by the Law Enforcement Officer, subject to MFIPPA exemptions.

      It is important to complete the Disclosure of Personal Information Form when requesting video surveillance footage. The Disclosure of Personal Information Form serves as the record for the request and is maintained and stored by PPPM.

      Authorized Library staff are to provide law enforcement with a secure means of accessing video footage, as directed by PPPM in the circumstances.

    5. Viewing Images

      When recorded images from the cameras must be viewed for law enforcement or investigative reasons, this must only be undertaken by authorized personnel, in a private, controlled area that is not accessible to other staff and/or visitors.

    6. Custody, Control, Retention and Disposal of Video Records/Recordings

      The Library retains custody and control of all original video records not provided to law enforcement. Video records are subject to the access and privacy requirements of MFIPPA, which include but are not limited to the prohibition of all Library employees from access or use of information from the video surveillance system, its components, files, or database for personal reasons.

      The Library will take all reasonable efforts to ensure the security of records in its control/custody and ensure their safe and secure disposal. Old storage devices must be disposed of in accordance with an applicable technology asset disposal process ensuring personal information is erased prior to disposal, and cannot be retrieved or reconstructed. Disposal methods may include shredding, burning, or erasing depending on the type of storage device.

      Records and information collected from the video recording system are subject to the following retention periods under the Library's record retention schedules:

      1. Information will be retained for a maximum of thirty (30) days from the date of the original collection by the video surveillance system, except as described in (ii); and
      2. Information collected from the video recording system used by the Library or a law enforcement agency as part of a criminal, safety, or security investigation or for evidentiary purposes will be retained for a minimum of one (1) year from the conclusion of the matter for which it has been used.

    7. Unauthorized Access and/or Disclosure (Privacy Breach)

      Any Library employee who suspects a privacy breach should refer to the Privacy Breach Protocol available on ShareTPL:

      Any Library employee who becomes aware of any unauthorized disclosure of a video record in contravention of this Policy, and/or a potential privacy breach has a responsibility to ensure that PPPM is immediately informed of the breach.

    8. Inquiries from the Public Related to the Video Surveillance Policy

      A staff member receiving an inquiry from the public regarding the Video Surveillance Policy shall direct the inquiry to PPPM.

Accountability

  1. The Directors' Committee is responsible for:

    1. Approval of the installation of video surveillance cameras.

  2. Directors with responsibilities for facilities management, including the Director for Transformational Projects and the Director for Branch Operations and Customer Experience are responsible for:

    1. Assessing proposed installations of video surveillance equipment after a Security Video Surveillance Needs Assessment has been completed.

  3. The Director, PPPM is responsible for:

    1. Documenting, implementing, and enforcing the Library's privacy and access compliance policies;
    2. Responding to formal requests to access records, including law enforcement inquires;
    3. Providing advice, training, and recommendations to staff to assist in compliance with MFIPPA;
    4. Undertaking periodic evaluation of TPL's video surveillance systems to ensure compliance with this Policy;
    5. Reviewing this Policy on a regular basis, and recommending updates as appropriate to the City Librarian;
    6. Ensuring training in compliance with this Policy is available and provided to appropriate staff and service providers; and
    7. Investigating privacy complaints related to video surveillance records, and security/privacy breaches.

  4. The Director of Transformational Projects, and the Director of Branch Operations and Customer Experience each have the authority to:

    1. Conduct Security Video Surveillance Needs Assessments to determine requirement for a video surveillance system;
    2. Advise on installations and operation of video surveillance systems;
    3. Recommend proposed installations in accordance with this Policy, and in consultation with the appropriate Director(s). (see approval at Directors' Committee);
    4. Conduct periodic internal audits to ensure compliance with this Policy;
    5. Delegate the day-to-day operations of video surveillance systems to managers, ensuring system-wide compliance with this Policy and TPL procedures; and
    6. Ensure that appropriate Facilities and Branch staff are familiar with this Policy, and that training is provided by PPPM to all authorized personnel.

  5. Authorized staff are responsible for:

    1. Complying with and adhering to all aspects of this Policy;
    2. Overseeing the day-to-day operation of video surveillance cameras, providing supervision to approved authorized personnel, and ensuring their compliance with all aspects of this Policy;
    3. Ensuring that all aspects of the video recording system are functioning properly;
    4. Ensuring that training is provided to their staff via PPPM;
    5. Ensuring that all the staff they supervise are familiar with this Policy;
    6. Ensuring monitoring and recording devices, and all items related to surveillance (e.g. logbooks) are stored in a safe and secure location;
    7. Forwarding all external requests for access to video records to the appropriate authorized staff member;
    8. Documenting all information regarding the use, maintenance, and storage of records; including all instances of access to, and use of, recorded material to enable a proper audit trail;
    9. Ensuring that access to video surveillance occurs within the rules established by the Security Video Surveillance Procedures;
    10. Ensuring that no video surveillance imagery/records are disclosed without the approval of authorized management/in-charge staff;
    11. Ensuring that no copies of data/images in any format (hard copy, electronic, etc.) are taken from the video recording system without approval from authorized management/in-charge staff;
    12. Informing appropriate shared facilities' personnel of this Policy's requirements;
    13. Immediately reporting breaches of security/privacy to the City Librarian or designate; and
    14. Forwarding all inquiries from the public about the use of video surveillance or about the Library's Security Video Surveillance Policy to PPPM.

Appendices

Appendix 1: References

Guidelines for Using Video Surveillance, Information and Privacy Commissioner of Ontario. 2015.

Municipal Freedom of Information and Protection of Privacy Act, R.R.O. 1990, c. M. 56 (MFIPPA).

Municipal Freedom of Information and Protection of Privacy Act, R.R.O. 1991, Regulation 372/91 as Amended.

Occupational Health and Safety Act, R.S.O. 1990, c.0.1.

Privacy and Video Surveillance in Mass Transit Systems; A Special Investigation Report - Privacy Investigation Report MC07-68, Information and Privacy Commissioner/Ontario, 2008.

Toronto Public Library Access to Information and Protection of Privacy Policy.

Toronto Transit Commission Video Recording Policy for Security Purposed. 2018.

Appendix 2: Definitions

Authorized staff: Employees of TPL or of a TPL contractor who are specifically authorized by the Library to operate the video surveillance system for a particular facility and to perform the duty, responsibility or action described in the Policy and in the Security Video Surveillance Procedures.

Video surveillance operation: Operation of the video surveillance system may include:

  1. Requesting access to video surveillance records
  2. Accessing/viewing/retrieving video surveillance records
  3. Disposing of video surveillance records
  4. Installing/maintaining video surveillance systems and infrastructure

Appendix 3: Contacts

Vickery Bowles, City Librarian, City Librarian's Office,
Tel: 416-393-7032 Fax: 416-393-7083

Shawn Mitchell, Director, Policy, Planning and Performance Management,
Tel: 416-395-5602

Alyssa van Graft, Director, Transformational Projects,
Tel: 416-395-5541

Moe Hosseini-Ara, Director, Branch Operations and Customer Experience,
Tel: 416-397-5944