In January 2015, the mayor of Saanich publicly complained that the District of Saanich had installed “spyware” on his office computer. The BC Information and Privacy Commissioner initiated an investigation pursuant to the Freedom of Information and Protection of Privacy Act (the “Act”) in order to determine whether the District of Saanich had complied with the privacy requirements under the Act.
The Commissioner’s investigation report was released on March 30, 2015. The Commissioner found that the District of Saanich had installed a monitoring program called Spector 360 on 13 employee workstations. The Spector 360 program provided for, inter alia, collection of the following data:
- automated screenshots at 30 second intervals
- monitoring of chat and instant messaging
- a log of all websites visited
- recording of all email activity
- a log of every keystroke
The District of Saanich allowed the employees to use their workstations for personal use. The employees therefore had a reasonable expectation of privacy with respect to any personal information that they entered on their computer or viewed on line.
That meant that the District of Saanich was collecting information concerning employees personal emails, online banking, messaging, and websites visited by the employee. The courts have ruled that websites visited by an employee are personal and private information. The employer is not permitted to collect that information.
The Commissioner stated that the “personal information that is accessed online during the routine daily activities of any individual can range from the mundane such as vacation planning through to the highly sensitive such as viewing medical laboratory results.”
The Commissioner concluded that the collection of that personal information was not authorized by the legislation and was contrary to the Act. Because the personal information was inextricably intermingled with business information, the Commissioner advised the District to “destroy all information collected by the monitoring software.” In addition, the Commissioner advised the District to “disable the keystroke logging, screenshot recording, program activity logging, email recording,” and certain other aspects of the Spector 360 program.
The report by the Commissioner confirms that employers must respect the privacy rights of employees when those employees are using computers in the workplace. As we have previously reported, if employees are allowed even incidental personal use of the employer’s computer systems, the employees then have a reasonable expectation of privacy with respect to any personal emails, data, websites visited, as well as any all other information that would be expected to be created when the employee is permitted to use the employer’s computer system.