Focus on Quebec Employment and Labour Law
New access control systems which identify individuals by their biometric characteristics or measurements are now available to replace traditional systems (punch cards, magnetic cards, electronic keys). While there are undeniable advantages to using these new technologies, their generalized implementation in Quebec is restricted by strict legal rules.
THE NEW SYSTEMS
Certain control systems identify individuals according to their characteristics, in particular their voice. Once a database is created with voice samples of all persons who have access to a building, the system will identify any person wishing to gain entrance to the building and will prohibit access if the voice does not correspond to a sample in the database.
Other systems record biometric measurements; thus, various measurements of a person’s hand may be converted into an algorithm which is stored in a database. The process involves more than taking a picture of the hand or fingerprints. The hand of each person entering a building could therefore be identified by the system to determine if access should be allowed or not.
The advantages of these new systems are obvious: the possibility of fraud is greatly reduced, absenteeism management is facilitated and all problems relating to stolen, forgotten or lost passwords and magnetic cards are eliminated.
These new control systems are very popular in the United States. However, their implementation in Canada is more difficult due to legal impediments which complicate their use for most businesses which are interested in the systems for reasons of efficiency rather than being obliged to use them for compelling security reasons.
THE PROTECTION OF FUNDAMENTAL RIGHTS
These new technologies have been challenged among other things because they impinge on the privacy of the individual. In Wansink v. Telus Communications inc.,1 the Federal Court of Appeal found that a voice recognition system required the collection of personal information, since the characteristics of a person’s voice constitute personal information. Consequently, such a system could not be introduced by an employer pursuant to the Personal Information Protection and Electronic Documents Act2 without the consent of all employees concerned. Even if this decision involved an employer subject to federal jurisdiction in labour relations matters, it will generally be followed in all provinces since it involves privacy rights.
In another recent case, 407 ETR Concession Company Limited and National Automobile, Aerospace, Transportation and General Workers Union of Canada, CAW-Canada and its local 414,3 a grievance arbitrator, Christopher Albertyn, determined that imposing a new hand scanner identification system went against the religious convictions of three employees who believed that they risked damnation by allowing biometric measurement of their hands. They believed that scanning could impose the “Mark of the Beast” on them which would demonstrate their allegiance to the Anti-Christ and result in their eternal damnation. This belief arises from a very specific interpretation of certain Bible verses. The arbitrator ordered the employer to accommodate these employees by allowing them to use a different control system, such as a magnetic card linked to an individual password.
THE SITUATION IN QUEBEC
In Quebec, the employer’s right to introduce such an access control system must not infringe on a person’s fundamental rights, in particular, the right to privacy and freedom of religion. In addition, employers are subject to the provisions of An Act to establish the legal framework for information technology, more specifically sections 44 and 45. The rules which apply pursuant to these provisions may be summarized as follows:
- A person’s identity may not be verified by means of a process that allows personal characteristics or biometric measurements to be recorded, except with the express consent of the person concerned.
- The person’s identity may only be established by means of a minimum number of characteristics or measurements needed to link the person to an act; the person must have knowledge of the measures recorded.
- No other information revealed by the biometric characteristics or measurements recorded may be used as a basis for a decision concerning the person or for any other purpose whatsoever.
- Such information may only be disclosed to the person concerned, at the person’s request.
- These characteristics or measurements must be destroyed as soon as there is no more reason or purpose for their use.
- The existence or creation of a database of biometric characteristics and measurements, whether or not it is in service, must be disclosed to the Commission d’accès à l’information.
The Commission may make orders determining how such databases are to be:
- set up;
- used, consulted and released; and
- retained, and how measurements or characteristics recorded for personal identification purposes are to be archived or destroyed.
- If the database is not in compliance with the orders of the Commission or otherwise constitutes an invasion of privacy, the Commission may also:
- suspend or prohibit its bringing into service; or
- order its destruction.
Therefore, the legislator has provided very strict conditions which will apply to all businesses that choose to introduce such a control system. The Commission de l’accès à l’information has a full array of powers to ensure that this Act is enforced effectively, including the power to order that a database be destroyed if it violates these provisions.
Many employers will probably be tempted to use the new technologies which identify individuals on the basis of their personal characteristics or biometric measurements. However, the conditions for use of these technologies are so strict in Quebec that most businesses will have a hard time justifying their use. Accordingly, Quebec employers should ensure that basic human rights and the conditions provided in An Act to establish a legal framework for information technology are respected before acquiring such a system.