Access Control: Best Practices for Security Guards in Quebec

Access control is one of a security guard's most common duties: greeting visitors, checking who comes in, keeping a visitor log, handing out badges and receiving deliveries. It is also a duty where the guard handles personal information every day, often without thinking about it. Here are the best practices and what Quebec law says, checked against the official texts.

What does access control involve?

Depending on the site (office tower, plant, warehouse, hospital, residence), the access control post generally covers:

• Reception: greeting, asking the reason for the visit and the person being visited, calling that person to confirm the appointment.
• Identity verification: looking at a piece of ID when the site's orders require it.
• The visitor log: recording arrival and departure, on paper or on screen.
• Access cards and badges: handing out a visitor badge, collecting it on departure, reporting any card that is lost or not returned.
• Deliveries: checking the delivery slip, directing the driver to the dock or to receiving, and not giving the driver access to areas that do not concern them.

Post orders come from the client (the owner or occupant of the premises) and from your agency. They are what sets the conditions of entry: who can pass, at what hours, with which ID. Follow them to the letter and ask for them in writing if they are vague.

What can the guard ask for, and what can the guard refuse?

The guard can ask a visitor to comply with the site's conditions of entry: identify themselves, sign the log, wear a badge, be escorted. If the person refuses, they do not come in. Refusing entry is not detaining someone. The guard has no power to hold a person because they refuse to identify themselves. The guard lets them leave, records the event and notifies the supervisor. The rare situations where a guard can arrest someone, and their limits, are explained in our article on citizen's arrest and the powers of a security guard.

Bag checks at the entrance follow the same logic of consent. We covered it in detail in our article on event security guards and bag searches.

However, the law limits what can be required in exchange for a service. Section 9 of the Act respecting the protection of personal information in the private sector forbids refusing a good or a service because a person refuses to provide personal information, unless the collection is necessary to perform the contract, is authorized by law, or there are reasonable grounds to believe the request is not lawful. The Act adds: “In case of doubt, personal information is deemed to be non-necessary.” In other words, the client's order must itself be reasonable. It is not up to the guard to invent requirements.

What does the law say about personal information collected at reception?

A name, a signature, a plate number, a photo or a camera image are personal information. In Quebec, private businesses are subject to the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), modernized by the 2021 statute often called “Law 25”. Here are the rules that directly affect access control.

How long logs are kept and how they are destroyed is up to the business, not the guard: follow your client's procedure. If there is none, report it to your supervisor.

Can the guard photocopy or scan a piece of ID?

As a general rule, no. In its fact sheet for businesses, the Commission d'accès à l'information (CAI) states that simply being shown a piece of ID is generally enough to identify a person or confirm their identity. Making a copy of it, “in any way whatsoever”, or writing down its numbers is ordinarily not necessary within the meaning of the law, barring exceptions, for example if another Act requires it.

The CAI also points out that the person's consent does not make it permissible to collect information that is not necessary. It gives the example of a business that wrote down the numbers of its customers' ID to check their age: it had to stop, since looking at the ID was enough. Finally, it stresses that some ID serves specific purposes: a driver's licence proves that you can drive, a health insurance card is for health care.

The right habit for a security guard presented with a piece of ID: look, compare the photo and the name, hand the card back. Do not keep it in exchange for a badge, and do not photograph it with your phone.

If your client requires a copy, ask on what basis. It is up to the business to justify the need for the collection, not you.

What are the rules for surveillance cameras?

For the CAI, the image of an identifiable person captured by a camera is personal information. Its practical advice on video surveillance (2019, document under revision) recommends, among other things:

• installing cameras only if the objective is legitimate, important, urgent and real, and if the invasion of privacy is proportionate
• notifying the public with clearly visible signs
• avoiding places where the expectation of privacy is very high, such as washrooms, locker rooms or fitting rooms
• locking the viewing room and limiting access to the people whose duties require it
• destroying the images as soon as they are no longer necessary. The CAI considers that keeping them for 30 days is a generally sufficient and recommended period.

For the guard at the monitoring post, this means: never film a screen with your phone, never show images to a third party without authorization, and record every request for access to the images.

Which habits should you adopt at the access control post?

1. Never as a favour. A “familiar” employee who forgot their card follows the same procedure as everyone else.
2. Watch for tailgating: a person who slips in behind an authorized employee. Step in politely and ask each person to present their card.
3. Collect the badges on departure and check that the log is closed for each visitor, which is useful in an evacuation.
4. Forgotten items: record them with the time and place, store them in a safe place, and do not search a forgotten bag beyond what the procedure provides. A suspicious package is reported, not handled.
5. Confidentiality: what you see in the log or on screen stays at the post. Do not comment on who visits whom.
6. Write everything down. Refused entry, lost card, incident: write a clear report, as shown in our incident report template for security guards.

Access control is also at the heart of work in health care settings, where entry rules change from unit to unit: see our article on working as a hospital security guard.

This article is for information purposes. It is not legal advice. If you have doubts about an order, speak to your employer or consult the Commission d'accès à l'information.

Frequently asked questions

Can a visitor refuse to sign the visitor log?

Yes. The guard cannot force them to or hold them. If signing is part of the site's conditions of entry, the guard can refuse them access, then record the event.

Can the guard keep my ID card during my visit?

The CAI states that being shown the ID is generally enough to confirm identity. Copying it or writing down its number is ordinarily not necessary, unless an Act requires it.

How long should camera images be kept?

The law requires information to be destroyed or anonymized once its purpose is achieved (s. 23). The CAI recommends 30 days as a generally sufficient period for video surveillance images.

Sources

• Loi sur la protection des renseignements personnels dans le secteur privé, CQLR, c. P-39.1, sections 4, 5, 8, 9, 10, 12, 14 and 23 (LégisQuébec)
• Entreprises : faites de bonnes affaires en ne collectant que ce qui est nécessaire (pièces d'identité), Commission d'accès à l'information
• Pièces d'identité, Commission d'accès à l'information
• La vidéosurveillance : conseils pratiques à l'intention des organismes publics et des entreprises (janvier 2019), Commission d'accès à l'information