A private security firm operating in Alberta is contracted to monitor CCTV footage for a shopping mall. They discover a recurring pattern of a specific individual shoplifting. The mall management requests the security firm to provide all collected personal information, including high-resolution images and entry/exit times, to a third-party analytics company for 'loss prevention research'. Under which condition, if any, is the security firm most likely permitted to disclose this information without the individual's consent, assuming the analytics company is not directly involved in law enforcement or a fraud investigation related to this specific individual?

Question: A private security firm operating in Alberta is contracted to monitor CCTV footage for a shopping mall. They discover a recurring pattern of a specific individual shoplifting. The mall management requests the security firm to provide all collected personal information, including high-resolution images and entry/exit times, to a third-party analytics company for 'loss prevention research'. Under which condition, if any, is the security firm most likely permitted to disclose this information without the individual's consent, assuming the analytics company is not directly involved in law enforcement or a fraud investigation related to this specific individual?

Answer options: ✅ If the disclosure is for a purpose consistent with the purpose for which the information was collected and the individual would reasonably expect such a disclosure.

• Only if a court order compels the disclosure of the information.
• If the disclosure is to an agent of the security firm or the mall management for internal administrative purposes.
• If the third-party analytics company pledges to anonymize the data before use and delete all identifiable information after an arbitrary period.

Correct answer: If the disclosure is for a purpose consistent with the purpose for which the information was collected and the individual would reasonably expect such a disclosure.

Explanation: Under PIPA (Alberta), personal information can be disclosed without consent if it is for a purpose consistent with the original collection and the individual would reasonably expect such a disclosure. However, 'loss prevention research' by a third-party not directly involved in law enforcement or specific investigation likely falls outside the reasonable expectations for CCTV footage collected for security.