• TTC's collection of personal information through the use of video surveillance
• Section 2(1) - (Definition of personal information) - the information qualifies as personal information.
• Section 28(2) - (Collection of personal information) - the collection was in accordance with the Act
• Section 29(2) - (Notice of Collection) - Notice is provided in accordance with the Act
• Section 32 - (Disclosure of personal information) - the disclosure to the Toronto Police Service is in compliance with the Act.
• Section 3 of Regulation 823 - (Security) - The TTC has adequate security measures in place to protect personal information
• Destruction - The TTC has proper destruction processes in place
• Retention - The TTC should amend its retention periods
• Consultation - the TTC must engage in additional consultation as it expands its video surveillance system
• Audit - TTC must subject its surveillance system to an audit by a third party
• It is recommended that the TTC:

1. Amend draft MOU with the Toronto Police
2. Amend Policy to reflect conditions set out in the MOU
3. Amend the Policy to require the signing of a written undertaking by all TTC employees dealing with the video surveillance system
4. Advise IPC of progress in installing signs
5. Amend retention periods to a maximum of 72 hours
6. Amend policy to reflect revised retention periods
7. Take additional steps to inform the public, including additional public consultations
8. Incorporate audit requirement into Policy
9. Provide first annual audit to the IPC for review
10. Provide IPC with a revised Policy no later than one month after the date of the Report
11. Keep abreast of emerging research on privacy-enhancing technologies and adopt these technologies whenever possible
12. Select a location to evaluate privacy-enhancing technology developed by K. Martin and K. Plataniotis
13. Provide update to IPC on compliance within three months of the date of the Report.