Security cameras and Law 25: what a business may actually film

Installing a camera in a store takes an hour with a drill. Working out whether you're allowed to keep the footage, film your staff, or bolt facial recognition onto the whole thing is a different matter. And that matter falls under Law 25, which most business owners associate with email and website cookies, not the camera above the till. For the broad picture, our summary of Law 25 obligations for SMBs sets the base; this article goes deep on one concrete case.

The starting point is one sentence, and it's counterintuitive: the image of an identifiable person is personal information. Quebec's Commission d'accès à l'information (CAI) says so plainly in its video surveillance guide. The moment your camera captures recognizable faces, you aren't just "filming", you are collecting personal information, and the full machinery of the Act respecting the protection of personal information in the private sector (P-39.1), modernized by Law 25, applies.

The good news: the rules are reasonable and well documented. The bad news: almost nobody follows them, and two recent CAI decisions show that improvising gets expensive.

The short answer, for the busy

In Quebec, filming customers or employees amounts to collecting personal information, which triggers the Act respecting the protection of personal information in the private sector (P-39.1), modernized by Law 25. Before installing a camera, a business must pass the CAI's necessity test: the purpose must be legitimate, important, urgent and real, and the surveillance must be proportionate, with no less intrusive means available. You must clearly post that cameras are present before people enter the filmed area, limit the field of view, secure the footage, and destroy it once it no longer serves its purpose: the CAI recommends keeping it around 30 days. Facial recognition is a different category: creating a bank of biometric data requires express consent and a declaration to the CAI at least 60 days before it goes into service. Sound recording and employee surveillance call for extra caution.

Filming is collecting: the step everyone skips

Most owners reason in terms of security: a camera deters thieves, end of story. The CAI reasons in terms of personal information. To it, every identifiable face captured on a medium is data about a person, no different from a name in a customer file. That shift in perspective changes everything, because it pulls the camera into the regime of necessity, transparency, limited retention, and security.

That doesn't make video surveillance illegal. It means it has to be justified, framed, and documented. A business asked the question by an employee, a customer, or the CAI has to be able to explain why it films, what it films, how long it keeps the footage, and who can watch it. If the answer is "we never really thought about it", the problem isn't the camera, it's the missing file.

The necessity test: the real filter

Before you even pick a camera model, the CAI expects a necessity analysis. Its guide breaks it into questions. Is the purpose legitimate, important, urgent and real? Is capturing images proportionate to that purpose? Is there a less intrusive way to get the same result?

That last point is the one people skip most. The CAI explicitly asks you to list the other measures you considered before the camera: better lighting, an alarm system, door access control, a human presence at strategic hours. Video surveillance is justified only if it is the least intrusive way to effectively achieve a real objective. And beware the "everyone does it" reflex: the guide states outright that other businesses using cameras in a similar context does not establish your own necessity.

In practice, that means a precise objective (prevent shoplifting in a specific aisle, protect the till overnight) rather than blanket store surveillance "just in case". The vaguer the objective, the harder the camera is to defend.

Post it before you film

Transparency isn't optional. The private-sector act requires informing people that you're collecting information about them, and for a camera, the CAI recommends clearly visible signage in the monitored areas. The principle is simple: a person should know they're entering a filmed space before they enter it, not discover it afterward.

A discreet notice stuck behind the counter doesn't cut it. The notice has to be visible at the entrance to the area concerned. The CAI also encourages a cheap good practice: post a phone number where a responsible person can be reached with questions. That defuses half the friction before it escalates.

Sound is a separate question

Many modern cameras capture audio by default. That's a trap. Recording a conversation collects far more than an image: it's the content of what people say. The minimization principle requires collecting only what's necessary for the objective, and preventing shoplifting almost never requires hearing customers talk at the till.

The CAI's guide covers recordings "with or without sound", which signals that audio is treated as an added layer of collection to be justified separately. The prudent rule is clear: by default, turn the microphone off. If you believe you need sound, you have to be able to show why, and that will be much harder to defend than image alone.

How long to keep footage

This is the question that trips up the most businesses. The intuitive logic ("keep everything, it might come in handy") is the exact opposite of what the law asks. Footage must be destroyed once it's no longer necessary for the purpose that justified collecting it.

The CAI gives a useful number: retention of around 30 days is generally sufficient and recommended. It isn't an absolute legal ceiling, but it's the reference bar. Keeping six months of recordings "to be safe" isn't prudent, it's a risk surface: every retained recording is data that can be lost, stolen, or viewed without authorization. Destruction must be irreversible, and access to footage limited to people whose duties justify it. If you keep footage beyond 30 days, you need a documented reason.

Filming employees: the line you don't cross

Filming employees is possible, but it's the most sensitive ground. The same rules apply (necessity, proportionality, transparency), with one added requirement: the CAI recommends consulting the people directly concerned, including employees, before putting a system in place.

Two limits are non-negotiable. First, places with a high expectation of privacy are off-limits: the guide expressly names washrooms, changing rooms, and fitting rooms. A camera there has no justification that holds. Second, surveillance must not become continuous performance monitoring dressed up as security; the stated objective has to match the actual use. Filming "for security" and then using the footage to track breaks is using information for a purpose other than the one announced.

The biometric step: facial recognition and mandatory declaration

This is where the ground gets genuinely mined. Facial recognition doesn't just film: it turns a face into a biometric template, a particularly sensitive kind of data. The regime shifts category. Creating a bank of biometric characteristics requires express consent from the people concerned, and above all a declaration to the CAI at least 60 days before the bank goes into service, under the Act to establish a legal framework for information technology.

Two recent decisions show how high the CAI holds the bar. In September 2024, it ordered Imprimeries Transcontinental to stop using facial recognition for access control to its premises and to destroy the biometric information collected, finding the practice broke the law. In February 2025, it blocked a Metro pilot project that wanted to use facial recognition to spot suspected shoplifters in stores, for lack of the required express consent, which can't be obtained from every person who walks through the door.

The lesson for a business is direct: anti-theft facial recognition, the kind several vendors sell as a turnkey solution, runs head-on into the CAI's position. Before you consider it, the real question isn't technical, it's legal.

Where to start

The camera isn't the problem; the absence of thought is. The sensible sequence is a few steps: name precisely the problem you're solving, confirm no less intrusive means would do, limit the field of view and the retention period, post clear signage, turn sound off by default, and keep anything touching biometrics away from your plans without legal advice. A system designed right from the start costs less than one you have to dismantle under order.

That's the kind of check we build in when we design or rebuild a compliant digital setup for a Quebec business. If you want to talk through your situation, reach out.

→ Let's talk about your compliance

This article explains personal-information rules to help a business ask the right questions; it is not legal advice. Concrete cases (necessity, biometrics, employee surveillance) depend on the facts and are assessed case by case. For a decision, validate your situation with legal counsel and consult the Commission d'accès à l'information's official guides.