As video surveillance grows more powerful in capturing easily identifiable information, it’s also becoming more affordable. Many industries in the U.S. and Canada are required to implement security cameras and those not required find they need to add them to their security toolbox for more effective security.
Nonetheless, laws surrounding video surveillance, security cameras, and video surveillance retention vary by local, state, and federal regulations. Understanding video surveillance retention laws can be an exacerbating experience. More so when your company has offices in various states around the U.S. and Canada. These requirements can get very detailed especially in the cannabis industry.
Not only do video surveillance requirements differ greatly by location but also not all states have a vertical. For example, marijuana is only legal in some states. The same goes for gambling. It’s critical for affected companies to review all the local, state, and national mandates to verify they’re in compliance.
Video surveillance requirements often contain rules about the minimum and maximum time period that the company has to store the video surveillance footage. Here’s what you need to know about video surveillance laws.
How to Find Video Surveillance Laws That Affect Your Business
A good place for U.S. businesses to start is at Cornell Law School Legal Information Institute. You can search for state regulations exploring the state statutes by topic. For example, a cannabis dispensary in Colorado would select “health,” then “Colorado” and search for “cannabis” to get the relevant statutes. Another resource is eLaws.us, which has laws, regulations, and codes of ordinances at the city, county, state, and federal levels.
Alternatively, you can go to your favorite search tool and enter your state or province and the vertical. A search for “Colorado cannabis business laws” pulls up the right resource on the first page of the search engine results.
If you search for “California police bodycam laws,” the search engine will provide you with the link to California’s statute. This page talks about where the camera data will be stored and how many days the recorded video and audio must be retained among other details. Here are some examples of video surveillance retention requirements in verticals that tend to have specific regulations.
Law Enforcement: Body-Worn Cameras Retention Requirements
Based on review of California’s body-worn camera statute, the specifications are very detailed. The rules diverge based on whether the footage is evidentiary or non-evidentiary. It’s a very complicated process when you consider New York Police Department’s body-worn camera page indicates the NYPD has over 24,000 staff members equipped with body cameras.
At least it’s easy to find how long NYPD keeps the recordings. According to that page, they will retain all video recordings for 18 months. However, there are cases when they may need to retain the footage for a longer time.
In some cases, the state or commission will have a requirement that applies to those affected. For instance, the Texas Commission on Law Enforcement contains body-worn camera policies that agencies must include. One of those states they will retain video for at least 90 days.
Financial Institutions Retention Requirements
Financial institutions must comply with federal regulations from the Federal Deposit Insurance Corporation (FDIC). They require financial institutions to have remote video surveillance. The security program provision states that banks must maintain a camera that records activity in the banking office and use identification devices.
That’s not all. Your state or municipality may have its own rules. The Delaware Bank Commissioner requires retaining a security camera surveillance log for one year.
Maine Bureau of Financial Institutions audit / security section states that security audio and videotapes not used as evidence must be retained for two months. New York’s ATM Safety Act requires banking institutions to preserve camera recordings for at least 45 days.
Gambling and Casinos
One of the few states where casino gambling and sports betting are legal across the state is in Nevada. The state gaming commission requires all casinos to have video surveillance. What’s interesting is that retention requirements in this vertical are not as strict as in other industries.
It’s a good thing to because casinos tend to have many, many more cameras than businesses in other industries. They have so many cameras that their storage and maintenance costs would soar drastically.
Nevada, of course, isn’t the only place where gambling is legal. There are casinos on Native American reservations. Indiana Gaming Commissions requires Native American casinos to retain videos containing a routine activity for at least seven days. Any video of suspicious activities such as the questioning of a detained person, procedural errors, or criminal activity must be kept for at least 60 days.
Again, check the state laws as well as U.S. laws such as the U.S. Department of the Interior’s minimum internal control standards for Tier A gaming operations.
Cannabis: A Unique Vertical with Strict Regulations
Here are examples from the cannabis vertical to give you an idea of how complicated video surveillance requirements can be. First of all, in the U.S., ordinances vary by state. In some states, ordinances can be different within the state.
Take a look at these video surveillance requirements from the Modesto, California Code of Ordinances:
- Must be of high quality (HD) to determine the identity of individuals present.
- Must be remote and real-time running 24/7.
- Must monitor the interior, main entrance, and all entries and exits.
- Video surveillance must be remotely accessible by the Chief of Police or a designee.
- Footage needs to be compatible with the city’s hardware and software.
- Dispensary must retain video surveillance for 45 days.
So, Modesto requires dispensaries to retain video recordings for 45 days. Yet, Pasadena has a different requirement. The Pasadena, California Code of Ordinances has a 90-day video retention requirement. Oregon does too. And Canada? Their video retention requirement is for one year.
It’s stressful and exhausting for cannabis businesses to manage security. This is in addition to managing the store, farm, or manufacturing facility. Adding security and video surveillance is a tall order. That’s where security companies that specialize in the cannabis industry can help.
National and International Industry Regulations
On top of everything, there are national and international regulations that companies need to pay attention to in addition to their local, state, or province statutes. A good example is the Payment Card Industry Data Security Standard (PCI DSS) Compliance regulations. These regulations apply to companies that accept, transmit, or store credit card payments.
When a company is PCI compliant, it means they’ve taken steps to comply with the PCI Security Standard Council’s measures to ensure the data of the cardholders are kept safe and private.
Any company that accepts, transmits, or stores cardholder data must be PCI compliant. This compliance applies to companies across the globe. PCI requires retaining video surveillance for 90 days in areas where the data is stored. It does not necessarily apply to where business is transacted. Clear as mud, right?
The U.S. Department of the Interior has a guide on how to find public laws and federal statutes. But this only applies to U.S. regulations. If you’re a North American company with customers in the EU, you also must comply with General Data Protection Regulation (GDPR).
Know Your Video Surveillance Retention Requirements
If you only take one thing away from reading this article, it’s this: do your homework on your requirements. You’ll want to check local, state, federal, and international regulations for your industry. Some regulations have detailed specifications to the point that they tell you where to place cameras, what resolutions they must have, and of course, how long you must retain the video recordings.
Be aware that video footage retention timeframes will affect media storage. That’s why it’s important to ask about storage when talking to security providers. Some providers retain footage for much longer than 45 days as it’s possible for something to come up much later that would require reviewing older footage.
Of course, you’ll need to look into regulations outside of your industry like the PCI DSS regulations that apply to any business that accepts card payments. Just about every industry allows customers to pay with cards.
Every business needs to take steps to protect itself. This is especially true with crimes moving from homes to businesses as more people work from home. Regardless of how strict the regulations are, it’s far cheaper to comply with them than to pay the price for noncompliance. In some cases, it may be possible to lose your license.
Considering video surveillance and security requirements fluctuate from state to state and Canadian province to province, it’s crucial to work with a security company that has experience working in your industry. What a cannabis business needs are different from healthcare organizations and gambling businesses.
Using the right equipment is just one part of setting up security cameras and remote video surveillance. A lot can go wrong if it’s not correctly installed. That’s why it’s crucial to find a highly qualified security company to select, install, and maintain the video surveillance system. They’re more likely to do the job right the first time.
Working with a firm that specializes in your industry increases the likelihood of your complying with all the laws and regulations. Simply put, there are no shortcuts. This is not the time to be a company’s first client in your industry.
So, what’s the process for finding a highly qualified video surveillance company with experience in your industry and its associated regulations? Start by asking the prospective company for client referrals and case studies. You might want to check out security resources to see if there is one for your industry.
You don’t have to go at it alone. We can help you with security cameras and video surveillance. Contact us.
FAQ: What You Need to Know About Video Surveillance Retention Requirements
Video surveillance retention requirements vary widely depending on local, state, and federal laws. It is essential to check specific regulations that apply to your industry and location.
You can start by visiting resources like Cornell Law School Legal Information Institute and eLaws.us. Additionally, using search engines with specific terms related to your industry and location can help.
Requirements differ by state. For instance, the NYPD retains all video recordings for 18 months, while the Texas Commission on Law Enforcement requires a minimum of 90 days.
Federal regulations, like those from the FDIC, require remote video surveillance. Additionally, states have specific requirements, such as Delaware’s one-year retention and Maine’s two-month retention for non-evidentiary footage.
Requirements vary, but in Nevada, routine activity videos must be kept for seven days, while videos of suspicious activities must be retained for at least 60 days.
These can vary significantly even within the same state. For example, Modesto, California requires 45-day retention, while Pasadena requires 90 days. Oregon mandates a one-year retention period.
Yes, businesses with international customers must comply with regulations like the General Data Protection Regulation (GDPR) in the EU and PCI DSS for credit card transactions, which mandates 90-day retention.
Companies need to account for retention timeframes that affect media storage. It’s important to discuss storage capabilities with your security provider to ensure compliance with all regulations.
An experienced security company is more likely to ensure compliance with all applicable laws and regulations, provide the correct equipment, and ensure proper installation and maintenance of the video surveillance system.
Start by asking for client referrals and case studies from prospective companies. Checking industry-specific security resources can also help identify companies with the right experience.
