By Sébastien Lebel and Chris Semerjian
Canadian employers have many ways to monitor and control their business operations. However, new technologies — if misused — may lead to violations of employees’ rights. In particular, this raises the question of the extent of employees’ right to privacy.
The monitoring of business operations may involve only buildings and equipment. But it sometimes also involves employees’ activities at work. For example, video surveillance, GPS, or other tracking systems are in common use. One issue when monitoring employees is to what extent you are collecting personal information, i.e., information about an identifiable individual.
Expectation of privacy in the workplace?
The law in Canada is unsettled in this area. But it seems safe to say that an employee may sometimes have a reasonable expectation of privacy, even in the workplace. This expectation varies in intensity depending on the circumstances and the type of information gathered by the employer. For example, an employee has a greater expectation of privacy in a dressing room than in a meeting with his or her supervisor. The greater the expectation of privacy, the more important it is to have a reason to collect personal information.
An employer should consider making a clear policy and then bringing it to employees’ attention. That will reduce their expectation of privacy in the workplace. It also might be desirable to obtain employees’ consent before monitoring them in certain activities.
Only when necessary?
Canadian employers clearly may collect personal information when the necessity to do so can be demonstrated. Some adjudicators have extended this to mean that an employer will need to demonstrate a good and sufficient reason to monitor employees.
The following four-question test has been proposed in some cases to evaluate whether monitoring or collecting other personal information is warranted:
- Is the collection of information demonstrably necessary to meet a specific need?
- Is the collection of information likely to be effective in meeting that need?
- Is the loss of privacy proportional to the benefit gained?
- Is this the least privacy-invasive way to achieve the employer’s specific need?
Decision is worth a thousand words
In the recent case of Canadian Pacific Railway Company and Teamsters Canada Rail Conference, an arbitrator had to determine whether an employer could request copies of its train operators’ personal cell phone records. The records were sought as part of the investigation of serious incidents or accidents. This was intended to verify whether the employees had been engaged in electronic communications at the time of the incident.
Applicable regulations and the employer’s policy required that all personal communication devices be turned off by train operators while on duty. The employer didn’t want to know with whom the employees were communicating or the purpose of the communication.
The arbitrator concluded that the employer’s policy was legal and didn’t violate the union agreement. The fact that the employer’s policy had been careful to preserve employees’ right to privacy was key to the ruling.
Indeed, the employer allowed its employees to cross out the phone numbers dialed and the content of any text messages. The fact that railway operations are among the most highly safety-sensitive industries also was important to the decision.
The case of PIPEDA Case Summary #2009-011 provides us with another interesting example of operational monitoring. It involved the use of a GPS tracking system in vehicles. The employer was a contractor retained by a city to provide transportation to mobility-impaired residents.
A driver complained to the Privacy Commissioner of Canada about the GPS. He alleged that it was improperly collecting personal information. The employer responded that the information was used for service improvement and client safety rather than for employee management. The four-prong test set out above was applied.
The assistant privacy commissioner dismissed the complaint. Service improvement and client safety were found to be good and sufficient reasons to justify the collection of information using the GPS.
Lessons for employers
Those decisions illustrate that sometimes it’s not an easy task to meet the applicable criteria to permit monitoring. Devices should generally be tailored to meet operational needs in order to avoid collecting unnecessary personal information.
Before monitoring, it may be prudent to ask the following questions: What is the reason behind such surveillance? Is there another way to achieve your goals that would be less invasive?