This article summarises the various privacy laws existing across Canada as related to the collection of employee personal information. It also provides practical guidelines for employers to consider when implementing monitoring measures.
By: Natasha Jategaonkar
Firm: Mathews, Dinsdale & Clark LLP
The ability to use technology to monitor and track workplace activity is a valuable and constantly evolving management tool. Some common examples include video surveillance, computer and phone use monitoring, GPS tracking, and biometric timekeeping. Each of these technologies can assist employers with maintaining a safe, secure, and productive workplace. Deciding to implement such monitoring requires employers to balance their business interests in collecting information through monitoring and the privacy interests of those individuals, particularly employees, whose personal information may be collected.
Privacy laws in Canada
Canada has a number of laws related to privacy that may apply to workplace monitoring, depending on the jurisdiction (federal or provincial/territorial), sector (public or private), the type of information being collected (health information or other personal information), and whether the workplace is unionised or not.
In the private sector, in particular, the various privacy laws have been described as a ‘patchwork’. Three provinces (Quebec, British Columbia and Alberta) have legislation governing the collection, use and disclosure of personal information in the private sector, while some other provinces (such as Ontario) have legislation only addressing personal health information in the private sector. Where no legislation exists to protect personal information, privacy protections must arise from the common law or from a collective agreement.
A common law right to privacy is now recognised in most jurisdictions in Canada. The right protects ‘a biographical core’ of personal information that individuals would wish to maintain and control from disclosure. The issue of what information falls within the ‘biographical core’ is still evolving. The Saskatchewan Court of Appeal has held that information ‘tending to reveal intimate details of the lifestyle and personal choices of the individual’ falls within this core (R. v. Trapp, 2011 SKCA 143). A workplace computer or mobile phone that an employee uses for incidental personal use may well contain such information.
In the unionised context, workplace privacy rights have been recognized by some labour arbitrators, particularly in relation to workplace monitoring, drug and alcohol testing, medical testing and searches of employees and their property. Such rights are generally assessed with reference to the applicable collective agreement.
Finally, several jurisdictions in Canada recognise torts for invasion of privacy, either under statute or common law. These claims arise less frequently in the context of workplace monitoring (perhaps due in part to the time and expense required for pursuing litigation), but the potential for high damages to be awarded against an employer is much greater.
Best Practices in Workplace Monitoring
Due to the ‘patchwork’ of laws governing privacy, particularly in the private sector, the risks and liabilities for employers may differ depending on the particular legal regime that applies. The following are best practices for all employers seeking to implement monitoring in their workplace:
1. Establish reasonable grounds
Privacy laws in Canada are grounded on a standard of reasonableness, with consideration given to the nature of the monitoring and the expectation of privacy in the circumstances. Before commencing any monitoring activity, employers should consider what their rationale is for engaging in the monitoring and whether that rationale justifies the type of monitoring that will take place.
Genuine concerns regarding safety, security, and property damage are generally considered reasonable bases upon which an employer may justify the use of some forms of workplace monitoring. Using monitoring as a measure of performance and productivity of employees is typically harder to justify, but may be considered reasonable in the circumstances depending on the nature of the monitoring being used. The more ‘invasive’ the monitoring, the stronger the employer’s rationale should be for using it
2. Disclose the monitoring activity
It is a good practice for employers to disclose monitoring activity to employees and others who may be affected, notwithstanding that disclosure may not be strictly required in all circumstances. Include a statement of the purposes for which the information is being collected or used.
3. Create a policy
Many employers choose to implement clear policies that outline their practices regarding the collection, use, and disclosure of employee information. While the enforceability of such policies will depend on a number of factors (including the extent to which the policy is consistently applied, the employees’ knowledge of the policy, and the compliance of the policy with any applicable laws), it is a good practice for employers to set out expectations in advance, before a dispute or complaint arises.
4. Obtain consent
Finally, employers seeking to implement monitoring should consider obtaining consent, preferably in writing, for the collection of the information. Obtaining consent will not guarantee the workplace monitoring complies with all privacy laws, but it can be a key factor in determining whether the collection of information was ‘reasonable’ or not.