Security Camera Retention and Privacy: PIPEDA and BC PIPA for Property Operators

Cameras are one of the most common technologies in residential and commercial buildings, and one of the least governed. Many systems record continuously, retain footage for however long the disk allows, and allow anyone with a login to export clips. When a resident, a tenant or a regulator asks why, the property operator needs a better answer than "that is how the system came". This article sets out a practical approach. It is general information, not legal advice, and operators should seek counsel for their specific circumstances.

Which law applies

In British Columbia, most private organisations, including strata corporations, property management firms and landlords operating as businesses, are subject to the Personal Information Protection Act. Federal organisations and some cross-border activity fall under the Personal Information Protection and Electronic Documents Act. Both are built on similar principles: have a reason, tell people, limit collection, protect the data, keep it only as long as needed and let people ask about it.

The Office of the Information and Privacy Commissioner for BC has published guidance on video surveillance that is worth reading before you design or review a system.

Start with a written purpose

Every camera group should have a documented reason: protecting against theft or vandalism at the parkade entrance, monitoring a lobby after reported incidents or managing a loading dock. If you cannot write the purpose in one sentence, the camera may not be justified.

Place cameras to serve the purpose and no more. Avoid pointing at suite doors, windows or areas where residents have a high expectation of privacy. Review placement whenever the building layout or the problem changes.

Setting a retention period

Footage should be kept only as long as it serves the purpose. Many operators settle on a window of around thirty days for general footage, then overwrite, while preserving specific clips that relate to a known incident. The right number depends on how quickly incidents are normally discovered in your building.

Write the period down, configure the recorder to enforce it and confirm that backups and cloud archives follow the same rule. Retention that depends on a disk filling up is not a policy.

Who can see and export footage

Limit viewing and export rights to a small number of named people, with individual logins and a log of every export. Shared admin passwords make any later investigation impossible. Live views on a lobby monitor should show only what is necessary.

Create a release procedure for police, insurers and residents. It should record who asked, what was provided, the reason and the date, and it should be reviewed by a designated privacy contact before footage leaves the building.

Signage and notice

People should be told that cameras are operating. Post clear signs at entrances and near camera areas, with a contact for questions. Add a short privacy notice to the resident handbook or portal explaining the purposes, retention period and how to make a request.

Transparency also supports the practical goals. Visible cameras and notices deter some incidents and reduce complaints.

Securing the system itself

A recorder with a default password and a public IP address is a privacy breach waiting to happen. Place cameras and recorders on a dedicated network segment, replace default credentials, apply firmware updates and disable unneeded remote access.

Encrypt stored footage where the platform allows, and ensure cloud providers' data-location and access terms are understood and acceptable.

Handling a request or a complaint

Residents can ask what footage you hold about them. Respond within the statutory time, locate relevant clips, consider the privacy of other people in the frame and keep a record of the outcome. If someone complains, take it seriously, review the purpose and placement and document the result.

Appoint a privacy officer, even if the role is part-time. A named person who owns questions of purpose, retention and access makes every other decision easier.

Where this lands by property type

Strata & Condo Managers

Strata managers serve volunteer councils, answer to owners and keep records the law expects them to keep. The work is document-heavy, deadline-driven and full of personal information. Typical exposure: council records spread across personal email accounts.

Senior Living Operators

Senior living is a property business with a care obligation. Connectivity, safety systems and privacy of resident information all carry weight. Typical exposure: wi-Fi gaps in resident suites and care areas.

Co-Working Operators

Co-working runs on member experience: Wi-Fi that works, doors that open and a printer that prints. Operators also host many separate companies on one network. Typical exposure: member traffic needing isolation from operator systems.

Services that address this topic

Guidance like this works best inside a coordinated programme, not as a one-off fix. These PropertyIT services cover the topic directly.

Next step: a building technology survey

PropertyIT is a sub-brand of SAZ.ca, led by Ali Sedighi, MBA, combining senior-partner strategy with hands-on IT delivery for property teams. If this article describes a situation in your buildings, book a free 30-minute consultation: call (604) 632-4959 or email info@SAZ.ca. We will give you a plain-language view of your options, and a fixed-price scope if you want one. No lock-in, no pressure and no obligation.