2025-12-10 • by Will Coulter

Commercial Security Camera Privacy Laws: Ontario vs Michigan – A Complete Guide for Business Owners

Protecting your business with security cameras? Understanding the stark differences between Ontario and Michigan privacy laws isn’t just about compliance—it’s about protecting your business from costly legal pitfalls. When businesses install security cameras, they’re walking a tightrope between protecting their assets and respecting individual privacy rights. The legal frameworks governing commercial surveillance differ significantly between Ontario, Canada and Michigan, United States—both in their underlying philosophy and practical requirements.

TL;DR - Quick Answer

Ontario: Mandatory signage required under PIPEDA (federal law), must treat video as personal information, requires written policies, 30-90 day retention limits, must justify surveillance, no audio without all-party consent. Proactive compliance obligations with regulatory enforcement.

Michigan: Signage recommended but not universally required, no comprehensive data management mandates, focuses on preventing specific violations (no cameras in bathrooms/private areas), two-party consent for audio. More flexibility with reactive enforcement through lawsuits.

Key Difference: Ontario requires businesses to actively prove compliance with privacy regulations; Michigan prohibits specific bad acts but gives more operational freedom. When operating in both jurisdictions, follow Ontario’s stricter standards.

The stakes are higher than ever. In Ontario alone, businesses face mandatory compliance with PIPEDA (Personal Information Protection and Electronic Documents Act), which treats video footage as sensitive personal information. Michigan takes a different approach, focusing on preventing specific privacy violations rather than comprehensive data management. Get it wrong in either jurisdiction, and you’re looking at complaints, investigations, fines, and serious damage to your business reputation.

In this comprehensive guide, we’ll break down exactly what business owners need to know about security camera laws on both sides of the border, from signage requirements to data retention, employee surveillance, and cross-border considerations.

Understanding the Legal Foundations

Before diving into specific requirements, it’s crucial to understand the fundamentally different philosophies driving privacy law in each jurisdiction.

Ontario’s Privacy Framework

In Ontario, commercial surveillance is primarily governed by the Personal Information Protection and Electronic Documents Act (PIPEDA), a federal law that treats video footage as personal information requiring careful handling. Ontario also has provincial regulations under the Freedom of Information and Protection of Privacy Act (FIPPA) and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA).

The philosophy underlying Canadian law emphasizes transparency and consent. Businesses must justify their surveillance activities and demonstrate they’re using the least intrusive means necessary to achieve legitimate security objectives. This isn’t just bureaucratic red tape—it reflects Canada’s constitutional approach to privacy as a fundamental right.

Michigan’s Legal Framework

Michigan’s approach to security cameras is regulated through both federal laws and state-specific statutes, with particular emphasis on protecting privacy in areas where individuals have reasonable expectations of privacy. The state’s primary legislation includes Michigan Penal Code Section 750.539d, which prohibits installing recording devices in private places without consent.

Unlike Ontario’s comprehensive privacy legislation, Michigan takes a more targeted approach, focusing on preventing specific privacy violations (like recording in bathrooms or unauthorized audio surveillance) rather than establishing broad data management requirements. This reflects the American legal tradition of reactive enforcement and tort-based remedies.

Key Differences in Legal Requirements

The practical differences between Ontario and Michigan requirements can make or break your compliance strategy. Here’s what you absolutely need to know.

Notification and Signage Requirements

Ontario:

Ontario businesses are legally required under PIPEDA to notify employees and visitors that cameras are in use, typically through clear signs near entrances stating the area is under video surveillance for security purposes. These signs should include contact information for questions and how individuals can request access to their images.

The signage requirement isn’t merely a formality—it’s a fundamental component of obtaining implied consent. Signs must be posted before individuals enter the premises, giving people the option to not enter if they object to surveillance. Failure to provide adequate notice can result in complaints to the Office of the Privacy Commissioner of Canada and potential enforcement actions.

Michigan:

In Michigan, there is no universal legal requirement to post signs or notify guests about video recording in commercial settings (as long as audio isn’t being recorded). However, in workplaces, rental properties, and certain commercial contexts, notification is highly recommended and sometimes required.

Best practices for Michigan businesses include placing clear signs notifying people that surveillance cameras are in operation, with signage reading “This area is under video surveillance.” While not always legally mandated, this transparency acts as both a deterrent and legal protection against privacy claims.

The Key Distinction: Ontario makes notification mandatory under privacy law with specific content requirements, while Michigan recommends it as best practice without universal legal obligation. For businesses operating in Ontario, this isn’t optional.

Consent and Data Collection Principles

Ontario:

Under PIPEDA, organizations must obtain consent when collecting personal information, be open about their policies regarding personal information management, and limit collection to what is necessary for identified purposes. This includes both explicit and implied consent, with knowledge and consent required for the collection, use and disclosure of personal information.

For commercial establishments, this means:

• Clearly communicating why cameras are being used (security, loss prevention, safety monitoring)
• Limiting footage to what’s necessary for the stated purpose
• Ensuring individuals understand what’s being collected and why through signage and policies
• Only using footage for the purposes disclosed (you can’t collect for “security” then use it for “marketing analysis”)

Michigan:

Michigan doesn’t have equivalent consent requirements for general video surveillance. The law permits businesses to use security cameras to safeguard their premises, monitor employee activities (with limitations), and prevent theft, provided they comply with privacy laws regarding restricted areas.

The focus is on avoiding specific violations (recording in bathrooms, unauthorized audio recording, stalking) rather than obtaining proactive consent for collection. This gives Michigan businesses more operational flexibility but requires vigilance about prohibited areas.

Permissible Camera Locations

Ontario:

Commercial establishments must position cameras to protect relevant areas such as points of entry, sales floors, and cash registers, while avoiding private areas like washrooms or changing rooms where individuals have reasonable expectations of privacy. Additionally, cameras should not be directed toward neighboring properties or public sidewalks, as this could lead to privacy violations.

The “reasonable expectation of privacy” test applies, but Ontario’s interpretation tends to be broader than Michigan’s. Even inadvertent capture of areas beyond your property could trigger complaints if not properly justified.

Michigan:

Businesses can use security cameras in most areas, but areas like restrooms and employee break rooms are strictly off-limits. Cameras should not be placed in locations where employees expect privacy, such as restrooms, changing areas, break rooms, or private offices (without proper notice and justification).

Michigan courts apply a “reasonable expectation of privacy” standard that focuses on truly private spaces rather than limiting incidental capture in commercial areas.

Both Jurisdictions Agree: Bathrooms, changing rooms, and similar private spaces are absolute no-go zones. The difference lies in Ontario’s stricter requirements about neighboring properties and more expansive privacy expectations in commercial settings.

Audio Recording Restrictions

Ontario:

Ontario laws are particularly strict about audio surveillance, with recording conversations without explicit consent from all parties potentially leading to legal complications including privacy infringement allegations. The advice for businesses is generally to use audio recording cautiously, as recording conversations without consent is typically not allowed under Canadian law.

Beyond PIPEDA, audio recording without consent can violate the Criminal Code of Canada’s provisions against unauthorized interception of private communications, carrying potential criminal penalties.

Michigan:

Michigan is a two-party consent state for audio recordings, meaning you cannot record audio of a conversation unless all parties involved consent to being recorded. Recording video with audio in areas where people talk—like lobbies or customer service counters—can violate state wiretapping laws if not properly disclosed.

Michigan law specifically prohibits the willful use of a device to eavesdrop on a conversation without prior consent of all parties, with violations constituting criminal offenses punishable by imprisonment and fines.

Critical Similarity: Both jurisdictions have strict requirements for audio recording, requiring all-party or two-party consent. The practical advice in both locations is to disable audio features on security cameras unless there’s a compelling need and proper consent is obtained. For most businesses, video-only surveillance is the safest approach.

Data Management and Retention

How you handle the footage you collect is just as important as whether you can collect it in the first place.

Ontario Requirements

Commercial establishments in Ontario must have clear policies regarding storage, access, and duration of retention of surveillance footage. These policies should ensure footage is accessed only by authorized personnel for legitimate purposes, stored securely to prevent unauthorized access, and retained only as long as necessary for the purposes collected.

Typical retention periods are 30-90 days before footage should be deleted or overwritten. The Information and Privacy Commissioner of Ontario suggests a 72-hour retention period for institutions it oversees, providing sufficient time to determine if an incident occurred while minimizing privacy intrusion.

Ontario businesses must also:

• Limit who can access footage with documented authorization procedures
• Maintain security measures to prevent breaches (encryption, secure servers, access logs)
• Provide individuals with access to their own recorded images upon request
• Allow individuals to challenge the accuracy of information
• Document data handling procedures in written policies

Michigan Requirements

There is no specific Michigan state law dictating how long video footage can be stored; however, businesses often follow industry best practices for retention. For business purposes, it’s recommended to store footage for a minimum of 30 days before deleting it, with longer periods (60-90 days) common for businesses in high-risk industries.

Michigan law focuses more on securing systems against unauthorized access than on prescriptive retention periods. Employers should ensure surveillance systems have solid security measures, as systems vulnerable to hackers could compromise entire networks if connected to main technology infrastructure.

The Critical Difference: Ontario mandates comprehensive data management policies under PIPEDA with specific retention limitations, while Michigan relies on general business practices and cybersecurity standards. Ontario businesses face active compliance obligations; Michigan businesses have more flexibility but should still implement reasonable safeguards.

Employee Surveillance Considerations

Monitoring your own employees adds another layer of complexity to commercial surveillance compliance.

Ontario Workplace Monitoring

Ontario businesses must inform employees about camera purpose, placement, and storage duration. Under updated PIPEDA guidance, employers cannot tell employees that loss of privacy is a condition of employment, nor can employees waive their privacy rights as a condition of getting or keeping a job.

Employee monitoring should be specific, targeted, and appropriate in the circumstances, with employers conducting privacy risk assessments before implementing surveillance. This means:

• Justifying why monitoring is necessary (can’t just be “we want to watch employees”)
• Considering less invasive alternatives first
• Limiting monitoring to work-related activities in work areas
• Not using surveillance to intimidate or micromanage
• Consulting with unions where applicable before implementation

The Ontario approach recognizes that employees, despite being in a workplace, retain significant privacy expectations that employers must respect.

Michigan Workplace Monitoring

Employers must consider whether monitoring might violate an employee’s reasonable expectation of privacy and should conduct video monitoring only if it serves a legitimate business interest. Best practices include spelling out surveillance policies in employee handbooks and requiring employees to acknowledge their understanding in writing.

While video surveillance is generally permitted in Michigan workplaces, employers with unionized workforces must generally bargain with union employees before using video surveillance, as monitoring can be considered a mandatory subject of bargaining under labor law.

Michigan employers have more latitude than Ontario businesses but should still:

• Provide clear notice to employees about surveillance
• Avoid monitoring in private areas (break rooms, restrooms, locker rooms)
• Document legitimate business purposes
• Apply monitoring consistently across the workforce
• Consider union consultation requirements

Penalties for Non-Compliance

Understanding what happens when you get it wrong is crucial for appreciating why compliance matters.

Ontario

Ignoring Ontario’s camera privacy laws can lead to complaints, investigations, and fines under PIPEDA, beyond legal risks causing potential harm to business reputation and customer trust. The Office of the Privacy Commissioner of Canada investigates complaints and issues findings, which can lead to Federal Court proceedings.

Penalties can include:

• Compliance orders requiring changes to practices
• Monetary damages to affected individuals
• Publication of findings damaging business reputation
• In extreme cases, criminal charges for unauthorized collection of personal information

Beyond regulatory penalties, Ontario businesses face civil liability for privacy breaches, with courts increasingly recognizing damages for privacy violations even without proof of economic harm.

Michigan

Violating Michigan’s security camera laws can lead to serious legal consequences, including criminal charges under the state’s eavesdropping and wiretapping laws, with penalties including fines, imprisonment, or both. Individuals whose privacy has been infringed may also file civil lawsuits seeking compensation for damages.

Specific consequences include:

• Criminal prosecution for unlawful surveillance (especially in private places)
• Civil lawsuits for invasion of privacy, with potential for both compensatory and punitive damages
• Termination of business licenses in regulated industries
• Reputational damage and loss of customer trust
• In employment contexts, wrongful termination claims if surveillance was used improperly

The Bottom Line: Both jurisdictions take privacy violations seriously, but Ontario’s compliance-focused approach means businesses face more proactive enforcement, while Michigan’s system relies more heavily on individual complaints and civil litigation.

Best Practices for Compliance

Practical steps to ensure your business stays on the right side of the law.

For Ontario Businesses

1. Conduct a Privacy Impact Assessment: Determine if surveillance is necessary and whether less intrusive alternatives exist before installing cameras.

2. Develop Written Policies: Create comprehensive video surveillance policies explaining purposes, retention periods, access controls, and individual rights.

3. Install Clear Signage: Post notices at all entrances and camera locations with contact information for privacy inquiries and how to request footage access.

4. Limit Collection: Only monitor areas necessary for legitimate security purposes; avoid over-surveilling.

5. Secure Footage: Implement technical and organizational safeguards to protect recorded data (encryption, access controls, secure storage).

6. Train Staff: Ensure employees understand proper handling procedures and ethical considerations of surveillance.

7. Regular Audits: Periodically review camera placements and practices for continued compliance with evolving standards.

8. Disable Audio: Unless absolutely necessary with proper consent, avoid audio recording features entirely.

9. Establish Retention Limits: Delete footage after the minimum necessary period (typically 30-90 days maximum).

10. Document Everything: Maintain records of your privacy compliance measures, including PIAs, policies, and training records.

For Michigan Businesses

1. Notify Employees: Include surveillance policies in employee handbooks and obtain written acknowledgment of understanding.

2. Post Warning Signs: While not always legally required, signage protects the business legally and acts as a crime deterrent.

3. Respect Privacy Areas: Never place cameras in bathrooms, changing rooms, or break rooms under any circumstances.

4. Secure Systems: Use encryption, strong passwords, and separate networks for surveillance systems to prevent breaches.

5. Address Audio Carefully: Obtain two-party consent for any audio recording or disable audio features entirely.

6. Consider Union Requirements: Consult with unions before implementing workplace surveillance if employees are represented.

7. Limit Camera Range: Adjust cameras to avoid capturing neighboring properties unnecessarily and respect property boundaries.

8. Professional Installation: Work with licensed security providers who understand legal requirements and proper camera positioning.

9. Document Business Purpose: Maintain clear records of why surveillance is necessary and how it serves legitimate interests.

10. Regular Review: Periodically assess whether cameras remain necessary and properly positioned as business needs evolve.

Cross-Border Considerations for Businesses

For businesses operating in both jurisdictions or near the border, the safest approach is to comply with the stricter requirements—generally Ontario’s PIPEDA obligations. This means:

• Always posting clear signage with contact information and retention details
• Developing comprehensive written policies accessible to employees and customers
• Implementing strict data retention and access controls with documented procedures
• Conducting regular privacy audits and impact assessments
• Disabling audio recording unless explicitly necessary with full documented consent
• Training staff on both jurisdictions’ requirements if they work across borders
• Consulting legal counsel familiar with both Canadian and U.S. privacy law

For Businesses Near the Border: If your cameras could capture activity on the other side of the border (even inadvertently), consult with legal counsel about potential cross-jurisdictional privacy issues. A camera in Windsor capturing Detroit street traffic, or vice versa, could create complex legal questions.

The Philosophical Divide

The fundamental difference between Ontario and Michigan’s approaches reflects broader legal philosophies that shape how privacy is protected:

Ontario/Canada: Privacy is treated as a fundamental right requiring active protection through comprehensive legislation. The burden is on businesses to justify surveillance, minimize data collection, and demonstrate ongoing compliance. The approach is proactive and regulatory, with businesses expected to build privacy protection into their operations from the ground up.

This reflects Canada’s Charter of Rights and Freedoms, which recognizes privacy as a fundamental value, and the country’s willingness to impose positive obligations on private businesses to protect individual rights.

Michigan/United States: Privacy protections are more targeted, focusing on preventing specific abuses (recording in bathrooms, unauthorized wiretapping) rather than establishing comprehensive data management requirements. The approach relies more on common law, tort principles, and reactive enforcement.

This reflects the American legal tradition of limited government intervention in private business operations, with enforcement driven more by individual lawsuits and specific statutory violations than proactive regulatory compliance.

What This Means for Business: Ontario businesses must think about privacy compliance as an ongoing operational obligation requiring documentation, policies, and active management. Michigan businesses have more flexibility but must still be vigilant about clearly prohibited activities and responsive to complaints.

Conclusion: Navigating the Surveillance Landscape

Both Ontario and Michigan permit commercial security cameras, but Ontario’s requirements are significantly more prescriptive and compliance-oriented. Ontario businesses face mandatory signage, explicit data management policies, retention limitations, and ongoing obligations to justify surveillance activities. Michigan businesses have more flexibility but must still respect privacy expectations, avoid audio recording without consent, and notify employees as best practice.

For businesses in either jurisdiction, the key to compliance is understanding that security cameras collect sensitive personal information deserving of careful handling. Whether driven by legal mandate or ethical responsibility, respecting privacy while maintaining security isn’t just about avoiding penalties—it’s about building trust with employees and customers.

The surveillance landscape continues evolving with advancing technology, and businesses should stay informed about legal updates while consulting with legal professionals for specific compliance questions. When in doubt, err on the side of transparency and privacy protection—it’s not only good legal practice but good business practice.

Key Takeaways:

• Ontario requires proactive compliance: Signage, policies, retention limits, and ongoing justification are mandatory under PIPEDA
• Michigan focuses on specific prohibitions: Avoid private areas and unauthorized audio, but fewer prescriptive requirements
• Audio recording is highly restricted in both: Two-party consent requirements make audio surveillance risky
• Employee monitoring needs special care: Both jurisdictions protect worker privacy, with Ontario imposing stricter limitations
• When in doubt, choose the stricter standard: Following Ontario’s requirements will generally ensure Michigan compliance too
• Documentation is your best defense: Written policies, training records, and compliance audits protect you in both jurisdictions

Ready to ensure your business surveillance practices are fully compliant with Ontario and Michigan privacy laws? Understanding these requirements isn’t just about avoiding penalties—it’s about protecting your business, your employees, and your customers while maintaining the security you need.

Need expert guidance on implementing compliant security camera systems for your business? Contact Databending to ensure your surveillance practices meet all legal requirements while protecting what matters most.