The Federal Court of Appeal recently had occasion to consider the privacy implications of a decision by Telus Communications Inc. (Telus) to introduce a new technology called "e.Speak." e.Speak uses voice recognition technology to allow employees of Telus to access and use Telus’ internal computer network. When employees attempt to access e.Speak by telephone, their identity is verified through the voice recognition technology before they have access to the confidential data stored on the Telus network. The particular identification system used by Telus is a program known as Nuance Verifier.
McCarthy Tétrault Notes:
In order to become part of this new identification system, an employee must initially provide a voice template or voice print as part of the enrolment process. A sample of the employee’s voice is taken and a voice print is created and stored in the system. The voice print is not an audio sample. Rather, it is a matrix of numbers that represent the characteristics of the employee’s voice and vocal track.
Telus identified a number of employees who were expected to undergo the enrolment process and sought their consent to collect of their voice prints. Three employees refused. A fourth employee underwent the process but then withdrew his consent.
These four employees filed a complaint with the Privacy Commissioner with respect to the proposed use of the voice print technology and the "coercion" involved in obtaining their consent. They contended that their consent to the use of this technology was coerced. Telus had apparently made it known that a form of progressive discipline would be invoked against employees who were identified for the program but refused to enrol. The Commissioner conducted her investigation and found that Telus had not violated Personal Information Protection and Electronic Documents Act (PIPEDA). She found that the purposes for which the personal information was collected were appropriate in the circumstances, that the employees had been informed of these purposes and that appropriate measures and safeguards were in place to protect the voice print information.
The complainants then applied for a review by the Federal Court. The Trial Division Judge found that the purposes for which voice print was collected would be considered reasonable and appropriate in accordance with subsection 5(3) of PIPEDA. He then went on to find, in a rather odd conclusion, that the employees’ consents were not necessary because of an exception contained in paragraph 7(1)(a) of PIPEDA which allows for the collection of personal information without consent when the collection is clearly in the interests of the employees and their consent cannot be obtained in a timely manner. The trial division judge did not address the issue in the context of the employer/employee relationship that was involved, or address the allegation of coercion.
On appeal it was common ground, as indeed it seems to have been throughout the process, that the voice recognition technology required the collection of personal information within the meaning of PIPEDA. The Court of Appeal confirmed that the characteristics of a person’s voice are personal information.
This finding by the Court of Appeal should be contrasted with its decision in The Executive Director of the Canadian Transportation Accident Investigation and Safety Board v. The Information Commissioner of Canada and NAV Canada. In that case, requests were made for access to recordings and/or transcripts of air traffic control communications recorded by NAV CANADA and now under the control of the Canadian Transportation Accident Investigation and Safety Board. The requests were denied based on the application of section 19 of the Access to Information Act which is the "personal information" exemption. The Federal Court of Appeal found that the voice recordings were not personal information because the content of the recordings did not contain any personal information and consisted of discussions relating to the flying, landing and so forth of the aircraft. Leave to appeal that decision to the Supreme Court of Canada was sought, but leave was denied on April 5, 2007 even though, by that time, the Supreme Court had been made aware of the Federal Court of Appeal’s decision in the Telus case.
The Court of Appeal reiterated that privacy rights under PIPEDA are not absolute and that their "amplitude" needs to be determined through a balancing process. In the case at bar, the balancing involved the privacy interest of the employees and the business interests of the employer.
The Court of Appeal agreed with the reasons which had been expressed by the Commissioner that, while a voice print is an encroachment upon one’s person, and the information collected is the behavioural and physical characteristics that make a voice unique, on the other hand, a voice print does not actually tell anyone very much about the individual involved. In addition, Telus had demonstrated a legitimate and reasonable business requirement for using the voice print technology as a means of identification in the circumstances.
The Federal Court of Appeal identified three issues:
Whether the collection, use or disclosure of the voice characteristics was "only for purposes that a reasonable person would consider are appropriate in the circumstances" within the meaning of subsection 5(3) of PIPEDA?
Whether Telus has met its obligations under Principle 3 (clause 4.3 of Schedule 1) with respect to obtaining its employees’ consent? Whether PIPEDA prohibits an employer from disciplining employees who withhold their consent to the collection of personal information?
With respect to the first issue, the Federal Court of Appeal agreed with the trial judge’s statement saying that new uses and applications of technology for security reasons within a company are appropriate in the circumstances.
With respect to the second issue, the Federal Court of Appeal disagreed with the trial judge’s finding that subsection 7(1)(a) was applicable. The Federal Court of Appeal concluded that Telus was indeed under an obligation to obtain consent before collecting the voice characteristics of the complainants.
The court then focused on the final issue of whether the alleged threats of disciplinary measures vitiated any consent. The court indicated that normally it would agree that threats of disciplinary measures such as suspension or firing would vitiate a consent, but found that the evidence before it was not clear as to what disciplinary measures might in fact be invoked if the complainants refused to consent to providing the necessary voice print information. Not only was the Court unclear as to what disciplinary measures might be invoked, Telus had in fact not taken any disciplinary measures.
That led the court to determine the third issue. For the complainants’ part, they argued that paragraph 27(1)(b) of PIPEDA prohibits an employer from taking disciplinary action against employees. The court found that the section in question was clearly not applicable as it was directed to protecting employees from reprisals if they refused to comply with an employer’s direction to perform functions on the job which would result in a violation of the privacy rights of others. In the end, the court actually failed to address the central issue which was whether an employee could actually refrain from giving his or her consent, given the imbalance of power as between the employer and the employee. The court recognized that, in order for an employee to give an informed consent under PIPEDA, the employer would have to advise the employee that a refusal to consent could lead to some consequences on the employee’s employment. While the court found that fulfilling this duty would not be the same as making threats of disciplinary measures against the employee, the court did not come to grips with the fact that an employee who is faced with possible job consequences is not in a position to freely determine that he or she will not consent to providing the necessary personal information to the employer. There is no real choice.
The court did not provide a solution to this dilemma, but there might be one in the approach taken by the legislatures in B.C. and Alberta. The B.C. Personal Information Protection Act defines "employee personal information" as:
"personal information about an individual that is collected, used or disclosed solely for the purposes reasonably required to establish, manage or terminate an employment relationship between the organization and that individual, but does not include personal information that is not about an individual’s employment;"
Section 13(2)(b) then allows the employer to collect employee personal information if "the collection is reasonable for the purposes of establishing, managing or terminating an employment relationship between the organization and the individual."
The Alberta Personal Information Protection Act also defines "personal employee information" as:
"in respect of an individual who is an employee or a potential employee, personal information reasonably required by an organization that is collected, used or disclosed solely for the purposes of establishing, managing or terminating (i) an employment relationship, or (ii) a volunteer work relationship between the organization and the individual but does not include personal information about the individual that is unrelated to that relationship."
Subparagraphs 15(2)(a) and (b) provide for the collection of personal employee information of an employee if "(a) the collection is reasonable for the purposes for which the information is being collected, and (b) the information consists only of information that is related to the employment or volunteer work relationship of the individual."
In both cases, the employee must be notified before the information is collected.
These provisions provide a more realistic statutory framework of the reasoning undertaken by the Federal Court of Appeal to reach its decision.