New technologies are constantly being introduced into workplaces. Employers have many ways to monitor and control their business operations. However, the new techniques and devices made available by the progress of technology may lead to the violation of employees' rights, if misused. The employees' right to privacy is frequently called into question.

The monitoring of business operations may involve only buildings and equipment. But it sometimes also involves employees' activities during their work time. For example, video surveillance, GPS or other tracking systems are in common use. A frequent concern when monitoring employees is the collection of personal information, i.e. information about an identifiable individual.

An Expectation of Privacy in the Workplace?

The law is still unsettled in this area. But it seems safe to say that an employee may sometimes have a reasonable expectation of privacy, even in the workplace. This expectation varies in intensity depending on the circumstances and the type of information gathered by the employer. For example, an employee has a greater expectation of privacy in a dressing room than in a meeting with his supervisor. The greater the expectation of privacy, the more important the reason to collect personal information will have to be.

An employer should consider issuing a clear policy, that is brought to the attention of employees, that would reduce their expectation of privacy in the workplace. It might also be desirable to obtain the consent of its employees before monitoring them in a certain activities.

Only When Necessary?

Canadian employers clearly may collect personal information when the necessity to do so can be demonstrated. Some adjudicators have extended this to mean that an employer will need to demonstrate a good and sufficient reason to monitor employees.

The following 4-question test has been proposed in some cases, to evaluate whether monitoring or other personal information collection is warranted:

  1. Is the collection of information demonstrably necessary to meet a specific need?
  2. Is the collection of information likely to be effective in meeting that need?
  3. Is the loss of privacy proportional to the benefit gained?
  4. Is this the least privacy-invasive way to achieve the employer's specific need?

A Decision is Worth a Thousand Words

In the recent case of Canadian Pacific Railway Company and Teamsters Canada Rail Conference, an arbitrator had to determine whether an employer could request copies of its train operators' personal cell phone records. These were sought as part of the investigation of serious incidents or accidents. This was intended to verify whether the employees had been engaged in electronic communications at the time of the incident. Applicable regulations and the employer's policy required that all personal communication devices be turned off by train operators while on duty. The employer did not want to know with whom the employees were communicating, nor the purpose of the communication.

The arbitrator concluded that the policy of the employer was legal and did not violate the union agreement. The fact that the employer had been careful in its policy to preserve employees' right to privacy was key to the ruling. Indeed, the employer allowed its employees to cross out the phone numbers dialed and the content of any text messages. The fact that railway operations are amongst the most highly safety-sensitive industries was also important to the decision.

The case of PIPEDA Case Summary #2009-011 provides us with another interesting example of operational monitoring. It involved the use of a GPS tracking system in vehicles. The employer was a contractor retained by a city to provide transportation to mobility-impaired residents. A driver complained to the Privacy Commissioner of Canada about the GPS. He alleged that it was improperly collecting personal information. The employer responded that the information was used for service improvement and for client safety, rather than for employee management. The four-pronged test set out above was applied. The Assistant Privacy Commissioner dismissed the complaint. Service improvement and client safety were found to be good and sufficient reasons that justified the collection of information using the GPS.

Lessons for Employers

These decisions illustrate that it is sometimes not an easy task to meet the applicable criteria to permit monitoring. Devices should generally be tailored to meet operational needs, in order to avoid collecting unnecessary personal information.

Before monitoring, it may be prudent to ask the following questions: what is the reason behind such surveillance? Is there another way to achieve your goals which would be less invasive?