Privacy and Personal Information: Lessons 2026

Lesson 1: Personal information and the law

Security guards handle a lot of personal information: names in visitor logs, ID details, licence plates, incident reports, CCTV images and access card records. Personal information is information about an identifiable person. According to the Privacy Commissioner of Canada, it includes names, ages, ID numbers and ethnic origin, and also opinions, evaluations, comments and disciplinary actions about a person.

Which law applies?

Situation	Law that usually applies
Private-sector business in commercial activity, in most provinces	PIPEDA (federal Personal Information Protection and Electronic Documents Act)
Private-sector business inside Alberta, British Columbia or Quebec	That province's private-sector privacy law, considered substantially similar to PIPEDA
Federally regulated business (for example banks, airlines, telecommunications)	PIPEDA
Business in the Northwest Territories, Yukon or Nunavut	PIPEDA (considered federally regulated)
Municipalities, universities, schools and hospitals	Generally provincial laws

The details differ from law to law, but the core ideas are the same. Your employer's privacy policy tells you how they apply at your site.

Lesson 2: The 10 fair information principles

PIPEDA is built on 10 fair information principles. Here is what they mean for a guard:

Principle	On the job
1. Accountability	Your employer is responsible and names someone, often a privacy officer, to oversee privacy
2. Identifying purposes	Know why each piece of information is collected, such as a visitor log for building safety
3. Consent	Information is collected with the person's knowledge and consent, except where the law allows otherwise
4. Limiting collection	Collect only what is needed for the purpose. Do not add extra details "just in case"
5. Limiting use, disclosure and retention	Use it only for its purpose, share it only when allowed, and keep it only as long as needed
6. Accuracy	Write names, times and details correctly
7. Safeguards	Lock away notebooks and reports, protect passwords, and lock screens
8. Openness	Policies are available to people who ask
9. Individual access	People can ask for their own information
10. Challenging compliance	People can complain about how their information is handled

Lesson 3: Privacy on the job

Logs and ID checks: record only the fields your post orders require. Do not photocopy or photograph ID unless policy says to.
Notebooks and reports: keep them with you or locked away. Never leave them open on a desk.
Screens: lock computers and turn monitors so the public cannot see them.
Phones: use employer-approved devices for photos and video, not your personal phone, which is hard to secure and easy to share from.
Conversations: do not discuss residents, visitors or incidents with friends or in public places.
Social media: never post anything from work.
Questions from the public: do not say who lives where or who visited. Offer to pass on a message instead.

Codes of conduct say the same. British Columbia's code of conduct for security workers requires them to respect privacy under privacy law and keep information received at work confidential unless the work or the law requires disclosure.

Lesson 4: Video surveillance

The Privacy Commissioner of Canada's guidelines for overt video surveillance in the private sector set out good practice:

Notice: post clear signs where people will see them before they enter the area, with a contact person for questions.
Limit use: use cameras only for the stated purpose, after less intrusive options have been considered. Limit each camera's view so it does not capture people who are not the target.
Private areas: never aim cameras at washrooms, showers, change rooms or windows, and make sure operators cannot move cameras to see them.
Recording: where cameras are watched live, record only when unlawful activity is suspected or observed. Do not record sound unless there is a specific need.
Security: store recordings securely and limit access to a small number of authorized people.
Retention: keep recordings only as long as needed, then destroy them securely.
Access: people have a right to see images of themselves. Other people in the footage should be masked.

Footage must be used only for its stated purpose or as the law allows. The guidelines' example: video of a car break-in can be shared with police, but parking garage video should not be used to track tenants.

Lesson 5: Requests and privacy breaches

Access requests

Anyone can ask an organization for their own personal information. Under PIPEDA, a business generally has 30 calendar days to respond, and may extend this by up to 30 more days in limited cases, telling the person within the first 30 days. As a guard, do not hand over records yourself. Refer the request to your supervisor or privacy officer.

Privacy breaches

A breach happens when personal information is lost, stolen or seen by someone who should not see it: a lost notebook, an email sent to the wrong person, an unlocked filing cabinet. Report any possible breach to your supervisor right away.

Under PIPEDA, a business must report a breach to the Privacy Commissioner and notify the people affected when it is reasonable to believe the breach creates a real risk of significant harm, even if only one person is affected. Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss, identity theft, damage to credit records and loss of property. Every breach, reportable or not, must be recorded and the record kept for 24 months.