Video intercom and Bill 25 in co-ownership: consent

Installing or modernizing a video intercom in a divided co-ownership raises privacy concerns. Bill 25, which modernizes the protection of personal information in Quebec, applies as soon as an image, audio recording or metadata makes it possible to identify a person. For a co-ownership syndicate in Montreal, the board of directors must therefore oversee consent, signage, access and the storage of images captured in the common portions, while complying with the declaration of co-ownership and the by-laws of the immovable.

This article guides you, as a co-owner or director, in making your video intercom compliant with Bill 25. We cover the minimum obligations, technical best practices, internal governance, as well as concrete ways to train your teams and document decisions at the annual general meeting and in the minutes.

What Bill 25 covers for video intercoms

• Personal information: an image, voice, timestamp or licence plate that identifies a person directly or indirectly is personal information covered by the Act respecting the protection of personal information in the private sector (Bill 25).
• Defined purpose: recording must serve a legitimate purpose (e.g., controlling access to the common portions, preventing intrusions), not generally monitoring co-owners.
• Proportionality and minimization: capture and retain the minimum information necessary to achieve the purpose.
• Accountability: the syndicate acts as the “data controller.” The board of directors must appoint a person responsible for the protection of personal information, publish that person’s contact information and document the policies.

To place these principles within your legal framework:

• The Act respecting the protection of personal information in the private sector governs consent, access to and retention of personal information in Quebec (ref.: LégisQuébec, P-39.1).
• The Civil Code of Quebec specifies the purpose of the syndicate and the obligations related to the maintenance, security and administration of the common portions (ref.: LégisQuébec, CCQ-1991).

Keep in mind that “video intercom, co-ownership and Bill 25” also involves managing a supplier (hosting, cloud services, mobile application) that must provide adequate security and privacy assurances.

Consent, signage and minimum information to provide

Consent may be implied as long as the information is clear, provided in advance and accessible. In practice, your board of directors should provide for:

• A visible sign at the entrance and near the cameras/intercoms: state that images/sounds are being captured, the purpose (access control, security), the contact information of the person responsible, and a link to the privacy policy.
• Communications to co-owners: email, signage and an addition to the by-laws of the immovable. At an annual general meeting, present the policy, put any required amendments to a vote and record the resolution in the minutes.
• A specific privacy policy: purposes, legal basis (legitimate interest and security), categories of data (image, audio, access logs), retention period, storage locations, access and rectification rights, and the complaints process.
• Rules of use: the video intercom must not be aimed at private portions or unnecessarily capture the public roadway or sensitive areas (e.g., co-owners’ windows). Use privacy-zone features where available.

Important point: audio is more intrusive than video. If your device captures sound, justify it based on the purpose (e.g., identifying a person at the entry phone) and disable continuous audio recording.

Storage, retention period and right of access

Keeping data for too long increases risks. Keeping it for too short a period can hinder investigations into damage or incidents. Bill 25 requires retention to be limited to what is necessary for the stated purpose.

Best practices for a video intercom in a condo:

• Retention period: define a short, justified period (for example, a few days), with a temporary extension in the event of a documented incident. Automatically delete data after that period.
• Storage: favour servers located in Quebec or in jurisdictions with equivalent safeguards; encryption at rest and in transit; access logging; encrypted backups.
• Access: restrict access to authorized persons (the condominium manager, a duly authorized board member) according to a written procedure. Use multi-factor authentication.
• Traceability: keep a register of consultations (who viewed what, when and why) and external disclosures (e.g., provision to an investigator).

Access and copy requests:

• A co-owner or filmed individual may request access to their personal information. Respond within the time period prescribed by law (generally 30 days) and provide an intelligible copy where possible, redacting identifiable third parties.
• In the event of a police investigation, document the request, verify the legal authority and provide only the necessary excerpt. Keep a note in the register.

Useful references:

• Access principles and rights: LégisQuébec, P-39.1

Choosing and installing a compliant system in Montreal

The technical choice directly affects compliance. Before purchasing or signing a contract with a supplier, the board of directors should assess the following criteria:

• Privacy features: zone masking, granular access controls, audit logs, precise retention settings, export with blurring.
• Security: end-to-end encryption, regular updates, identity management (MFA, roles, revocation), compliant hosting and backups.
• Entry phone and application: check where the data travels and how notifications, storage and logs are managed.
• Integration: compatibility with your access systems (fobs, smart locks) and your network (VLAN, firewall). Limit exposure to the Internet.
• Supplier: contractual clauses covering privacy, data location, subcontracting and the end of the contract (data deletion and portability).

Installation and licences:

• Deal with a properly licensed contractor. Check the contractor’s licence on the RBQ website: Verify a contractor’s licence (RBQ).
• Depending on the nature of the work (wiring, electrical integration), licence subclasses may be required. Obtain information from the RBQ: The contractor’s licence.

Operational tip: before putting the system into service, test it with a sample of co-owners and adjust the signage and retention settings. Document everything and retain the test results.

Board governance: policies, register and responses to requests

Good governance protects privacy and strengthens security. Here is a framework to adapt to your building:

• Appointment of the person responsible under Bill 25: the board of directors appoints a person and publishes that person’s contact information (website, signage). Provide for a substitute.
• Privacy policy: approved by board resolution, presented at the annual general meeting and incorporated into the by-laws of the immovable. Specify the purposes, retention periods and access procedures.
• Registers: keep a register of incidents, consultations, access requests, complaints and scheduled deletions. This will facilitate your responses and internal audits.
• Training: train the condominium manager, superintendent and directors on acceptable use, responding to requests and retention.
• Contracts and suppliers: add privacy clauses, technical requirements (encryption, retention, deletion at the end of the contract) and audit rights.

To facilitate implementation and follow-up, see our administrative and operational management services:

• Administrative management: policy templates, resolutions, communications to co-owners and preparation of the minutes. See our services.
• Operations management: supplier selection, calls for tenders, commissioning and maintenance procedures. See our operations services.

Industry resources: the RGCQ regularly publishes governance guidelines and best practices that are useful to syndicates.

Practical examples and pitfalls to avoid

• Glass doors and the street: avoid broadly capturing the public roadway. Point the camera toward the access area and use masking zones.
• Mechanical rooms: avoid recording areas where employees or subcontractors work continuously, unless there is a real and proportionate need.
• Informal sharing: prohibit sharing excerpts by text message or personal email. Use a secure channel and keep a register.
• Mobile application: if co-owners receive the live image on their phones, inform them of proper use and the limits (no capturing and sharing on social media).
• Updates: apply firmware updates. An outdated intercom can expose the co-ownership to unauthorized access.

FAQ

Is an intercom visitor’s image personal information?

Yes, if the person is identifiable directly or indirectly. The image is then protected by the Act respecting the protection of personal information in the private sector, and your policies must take this into account.

Is the co-owners’ express consent required for a video intercom?

Not necessarily. Implied consent may be sufficient if the use is legitimate (access control), the information is clear (signage, policy) and the recording is proportionate.

Can images be provided to the police?

Yes, when the request is justified and documented. Provide only the necessary excerpt, keep a record in the register and verify the legal basis before making any disclosure.

This article provides general information and does not constitute legal advice. For your situation, consult a lawyer or notary.

Do you manage a co-ownership in Quebec? Explore our packages or contact us to assess your needs.

For more practical advice, visit our blog.