AI video analytics have moved from a premium add on to a default feature on many cameras and recorders sold in Canada. Object classification, line crossing, loitering detection, license plate reads, and people counting now ship in mid range gear. The capability is useful. It also raises the privacy stakes of any deployment, because the system is now interpreting people, not just recording them.
The Canadian privacy frame
In the private sector, the federal law is PIPEDA, enforced by the Office of the Privacy Commissioner of Canada. PIPEDA governs the collection, use, and disclosure of personal information in the course of commercial activity. Several provinces have their own private sector laws deemed substantially similar, including British Columbia, Alberta, and Quebec, and Quebec’s regime is stricter on several points. Public bodies fall under separate federal and provincial public sector statutes. A camera that captures identifiable individuals is collecting personal information, and analytics that profile behavior raise the sensitivity of that collection.
Minimization and retention
The OPC has long emphasized that surveillance should be necessary and proportionate. For an analytics deployment, that means collecting only what the stated purpose requires. If the goal is counting people at an entrance, the system does not need to store identifiable footage indefinitely or run identity matching. Retention should be defined, documented, and short enough to serve the purpose, with automatic deletion after the window closes. Signage informing people that monitoring is in use is a basic expectation, and the purpose should be one a reasonable person would consider appropriate.
Facial recognition deserves caution
Facial recognition sits in a category of its own. It collects biometric information, which is sensitive, and it has drawn specific scrutiny from Canadian regulators. The OPC and provincial commissioners have investigated facial recognition uses and have published guidance discouraging deployment without a strong, clearly justified purpose, a privacy impact assessment, and meaningful safeguards. Treat any analytics feature that matches or identifies individuals as high risk. Confirm whether you actually need identity, or only an anonymous count or alert.
Practical steps
Document the purpose before turning a feature on. Run a privacy impact assessment for anything that profiles or identifies people. Configure retention to the minimum. Restrict who can access analytics output and log that access. Keep faces and plates out of the system unless the purpose genuinely requires them, and check the rules in the specific province where the cameras sit. Analytics that are scoped tightly and documented well are far easier to defend than ones bolted on because the box supported them.