Surveillance cameras could see inside Toronto apartment, tenant says

A complaint that a Toronto property management company’s security cameras are capturing footage from inside tenant apartments has exposed vulnerabilities in Canada’s privacy rights regime.

The advent of AI tools and facial recognition software makes the issue of what happens with footage collected by security and surveillance cameras far more complex than it was 20 years ago, when Canada’s federal government introduced the Personal Information Protection and Electronic Documents Act (PIPEDA). Privacy experts say this new reality puts Canadian privacy rights at risk.

“Privacy rights go well beyond recording your image,” said Alejandra Brown, a privacy expert with Kirke Management Consulting. “Video surveillance nowadays has a lot of other implications: Are you using a cloud-based vendor that is storing this information in places like the U.S.? Your vendors could use this information to train their own AI models. When you collect information for security, it doesn’t give you a blank cheque to use it for other things.”

In June, the Office of the Privacy Commissioner (OPC) issued a report that found MetCap Living Management Inc. has been inappropriately recording video from inside the apartments at 105 Isabella St., a building it manages in Toronto. Security cameras in its hallways had been angled such that when some doors opened, parts of a tenant’s private space inside could be recorded.

Moreover, the OPC report said MetCap’s failure to respond to the tenant’s request for his personal private information – and its failure to provide information about its security footage in its privacy policy – does not comply with federal law.

Opinion: Is it 2026 or 1984? There is no privacy in the digital age

Javier Ruiz-Soler began pushing MetCap for answers about its security cameras in late 2024. After multiple e-mails to property management and staff, Mr. Ruiz-Soler received an e-mail from a property manager that said “We disagree that PIPEDA requires us to disclose any of our internal policies to residents.”

The OPC report corrected the company on that view, noting PIPEDA’s principle 4.8 states, “Organizations shall be open about their policies and practices with respect to the management of personal information. Individuals shall be able to acquire information about an organization’s policies and practices without unreasonable effort.”

Mr. Ruiz-Soler is well-versed in privacy rights; he’s a civil servant working for the Information and Privacy Commissioner of Ontario, and believes the OPC needs to take MetCap to federal court to ensure the company changes its cameras to stop indiscriminately recording footage of the tenants, as outlined in its report.

But experts say that’s unlikely to happen.

“PIPEDA doesn’t currently have teeth the way people would normally use that phrase; the powers of the commission are limited to making recommendations,” said David Elder, chief privacy officer with law firm Stikeman Elliot. Without the ability to levy fines or make orders that a federal court will uphold, the commission or involved parties need to apply to the court, an expensive process that doesn’t happen often, according to Mr. Elder.

Instead, Mr. Elder said the commission’s main tool is “public shaming” when they release summaries of their investigations and name names. In this case, the OPC hasn’t published a final summary, though Mr. Ruiz-Soler shared the June report with media.

“MetCap continues to engage with the Office of the Privacy Commissioner of Canada regarding the matters raised in its report. As this remains an ongoing process, we are unable to comment further on specific details at this time,” wrote Michael Guyette, vice-president of operations for MetCap, which manages hundreds of buildings adding up to more than 22,000 apartments. In a different e-mail, Mr. Guyette wrote that “following a review of the camera positioning, the relevant camera angles were adjusted and supporting images were provided to the Office of the Privacy Commissioner,” but declined to answer follow-up questions as to whether the camera’s have been changed again since June, when the OPC concluded that the adjustments still left parts of tenant apartment interiors visible to security cameras.

“It would have been easy to move the cameras five inches,” Mr. Ruiz-Soler said. “If you have good intentions, why is it so hard for this landlord to comply with the law?”

In an e-mailed statement the OPC said MetCap had been co-operative and remains in communication with it about its recommendations, but declined to comment on the specifics about whether the cameras have been adjusted. “The OPC will continue to closely monitor the situation to ensure that its recommendations are complied with,” it said.

Mr. Guyette said the other issues related to privacy policy and contacts for tenants have been addressed. However, signage at the building warns tenants that a third-party contractor, SEQ Security Surveillance Services Inc., is collecting both video and audio. This may create another issue, namely that federal law makes it a criminal offence to record audio of individuals who do not consent.

MetCap’s new video surveillance policy says it does not use the cameras “for general tenant monitoring.” Mr. Guyette said SEQ’s equipment at Isabella does not collect audio.

On SEQ’s website, the company claims that its systems make use of sophisticated AI tools that allow for easy monitoring in buildings. “Follow anyone, anywhere in the building,” one description of its software reads. “One click follows a person’s path across every camera – lobby to elevator to floor – without touching a single camera name. Full picture, instantly.”

Ms. Brown argues that good privacy policies should disclose what kind of third-party vendors have access to video footage, and whether they are using AI tools for monitoring, since such software often comes with broad permissions to use any data fed into it for other applications.

“Consent is really the foundation,” said Mr. Elder. “So if you don’t have a privacy policy that tells people what you are doing and why, then that is really a core violation of the law.”