A recent privacy decision1 released by Alberta's Office of the Information and Privacy Commissioner ("OIPC") serves as a caution to employers about the use of employee personal email and contact information.
On February 6, 2013, Alberta Education used a contact list maintained by its Professional Standards Branch to send an email from the Minister of Education (“Minister”) to 34,328 teachers – some to their personal email accounts. The email came amidst salary negotiations between the province and school boards and addressed contract negotiations, urging teachers to contact the Minister with their thoughts on education.
The email addresses used to send the Minister's email were originally collected by the Professional Standards Branch from teachers applying for teacher certification in Alberta and from school authorities updating the province's teachers' registry. The addresses were disclosed from the Professional Standards Branch to the Communications Branch for the specific purpose of sending the Minister's email.
The Minister's email generated a lot of controversy, prompting the OIPC to launch its own investigation into the matter without the need for an originating individual complaint. Nonetheless, the Commissioner subsequently received 34 separate individual complaints.
In Alberta, the Freedom of Information and Protection of Privacy Act ("FOIP") places certain obligations on public sector organizations with respect to personal information, including restricting the use of personal information to the purposes for which the information was originally collected (or for a use consistent with such purposes) and limiting disclosure of personal information to the extent necessary to enable the public body to carry out the purposes in a reasonable manner.
At issue in this case was whether Alberta Education’s Professional Standards Branch complied with FOIP in disclosing the email addresses to its Communications Branch and whether the Communications Branch and the Minister complied with FOIP in using such addresses to send the Minister's email.
The OIPC found that FOIP authorizes the use and disclosure of a business email address, and, as such, the main focus of OIPC's decision was limited to the disclosure and use of personal (as opposed to business) email addresses.
Alberta Education submitted that it collects teacher names and contact information for the following purposes: (i) issuing and administering certificates of qualifications; (ii) establishing and maintaining the teachers' registry; and (iii) conducting statistical, evaluative and financial analyses and forecasting relating to teachers.
Alberta Education argued that the disclosure and use of the personal email addresses was consistent with the purposes for which the information was originally collected, falling squarely under: "conducting statistical, evaluative, or financial analyses and forecasting related to teachers." The OIPC disagreed, concluding that the email addresses were not studied nor used to predict future events and were not reasonably and directly connected to conducting analyses or forecasting. The OIPC also dismissed Alberta Education's arguments that use and disclosure was: (i) authorized by an enactment; (ii) necessary for the performance of Alberta Education's duties; or (iii) consented to by the teachers.
In the result, the OIPC found that the disclosure and use of the teacher personal email addresses by Alberta Education was not authorized under any exceptions in FOIP and that Alberta Education contravened FOIP when sending the Minister's email to any such addresses.
The OIPC investigation report recommended that Alberta Education:
- remove personal email addresses from the teacher contact list provided by the Professional Standards Branch to the Communications Branch;
- state, in all future mass email communications from the Minister to teachers, the authority for the collection, use and disclosure of the teacher personal information;
- provide clear instructions to school authorities that only business email addresses assigned by the school authorities or that teachers identify for business use be included in the province's teachers' registry;
- update all notifications on application forms for teacher certification (and any other forms used to directly collect personal information for the teachers' registry) to include the purposes for which the personal information is collected.
This decision confirms the importance of ensuring that use and disclosure of personal employee information is limited to the purposes for which it was originally collected. In Alberta, the lesson is not limited to public sector employers but can also be applied to private sector employers governed by similar restrictions on the use and disclosure of personal employee information under Alberta’s Personal Information Protection Act.
Well drafted privacy policies setting out the specific purposes for which personal employee information will be collected, used and disclosed along with training for employees on such policies can go a long way in limiting an employer’s risk of liability.