Privacy in the Workplace: Employee Monitoring and Surveillance

600 – 889 West Pender Street
Vancouver, BC V6C 3B2
Office: (604) 568-5464
http://www.overholtlawyers.com
PRIVACY IN THE WORKPLACE:
Employee Monitoring and
Surveillance
March 30, 2021 via Zoom
Jennifer S. Kwok
jennifer@overholtlawyers.com
604-676-4189 (direct)

Webinar Agenda
1) Privacy Protection Laws (PIPEDA and BC’s PIPA)
2) What is personal information in the context of employment?
3) Consent under privacy law
4) Surveillance and monitoring of employees – the various tests
5) Privacy decisions
4) Best practices (storage, access, retention, policies)

Statutory Framework
1) Personal Information Protection and
Electronic Documents Act (PIPEDA)
2) BC’s Personal Information Protection Act
(PIPA)
3) BC’s Freedom of Information and Protection
of Privacy Act (FIPPA)

APPLICABLE LEGISLATION
Which legislation applies to your organization?
1) PIPEDA
2) PIPA
3) FIPPA

 PIPEDA was created to balance competing interests of
allowing commercial activity to function and protection of
individual privacy and personal information
 PIPEDA, FIPPA and PIPA only protect “personal information”
 Personal information is defined as:
“Information about an identifiable individual.”
 If there is a possibility of associating anonymous info with an
identifiable person, this is not “anonymous”
PIPEDA – General Overview

 Under PIPEDA, PIPA, and FIPPA personal information
also includes “employee personal information” but does
does not include:
o (business) contact information
 Consent is not required for the collection, use and
disclosure of business contact information for the purpose
of communicating with an individual about their
employment, business or profession
“Personal Information” is Not…

 Under PIPA “personal information” also does not include “work
product” information
 This is “information collected or prepared as part of an individual's
or group's responsibilities/activities related to their employment or
business but does not include personal information about an
individual who did not prepare or collect the personal information.”
 Consent not required for its collection, use, disclosure
 PIPEDA also contains exceptions to consent requirements where
personal information is produced by an individual in the course of
their employment, business or profession.
“Personal Information” is Not…

 Personal information about employees is
interpreted very broadly, and may include:
o Personnel files, performance evaluations, employee
complaints, discipline
o Home address, birthdate, salaries, benefits
o Medical, biometric or health information
o Pictures and recordings of employees
“Employee Personal Information”

 The knowledge and consent of an individual is
required to collect, use or disclose their personal
information except under certain circumstances
as permitted by law
oWhat is the purpose of the collection?
oHow will it be used?
oHow and to whom will it be disclosed?
CONSENT IS REQUIRED

 Under FIPPA:
A public body is not required to collect personal
information directly from the individual if the
information is about an employee, and the
collection of the information is necessary for the
purposes of managing or terminating an
employment relationship between a public body
and the employee
CONSENT IS NOT REQUIRED…

 Under PIPEDA:
Employee personal information is excluded from
the consent requirements if the collection, use or
disclosure of the information is necessary to
establish, manage or terminate an employment
relationship between the federal work, undertaking
or business and the individual

 Under PIPA:
Employee personal information is excluded from
the consent requirements if it is being collected,
used or disclosed for the purposes reasonably
required to establish, manage or terminate an
employment relationship between the
organization and that individual

 Under PIPA:
o The collection, use or disclosure must be
reasonable
 Under FIPPA and PIPEDA:
o The collection, use or disclosure must be
necessary
REASONABLENESS / NECESSITY

 In addition, employees must be provided with notice, in
advance that the information will be collected
 They must also be advised of the employer’s
purpose(s) for collecting the information
 And, the information must only be used for the
purpose of establishing, managing or terminating the
employment relationship
BUT NOTICE IS REQUIRED…

What are some legitimate purposes your
organization might have to monitor
employees?
MONITORING EMPLOYEES

What are some legitimate purposes to monitor employees?
- Location information of employees for safety and physical security
reasons
- Location information to properly allocate business resources
- Employee productivity and performance/misuse of resources
- To prevent breaches of confidential information
- To deter workplace harassment or violence or other misconduct
- To deter fraud or theft
- To obtain evidence of employee malingering (abuse of benefits)
MONITORING EMPLOYEES

 What types of employee monitoring, if
any, is in your workplace or is being
contemplated?
MONITORING METHODS

The most common methods include:
a)Video surveillance (covert or overt)
b)Audio recording
c)GPS, RFID or other location tracking
d)Keystroke monitoring
e) Review of employee work emails/internet/computer systems
f)Wearables (apple watch, fitbit)*
g)Biometric data (iris scanning, fingerprints, voice prints)
MONITORING METHODS

 Something to keep in mind:
The existence of a legitimate purpose or
reason to monitor does not mean that the
method chosen to achieve the purpose is
also reasonable in the circumstances
IS THE METHOD APPROPRIATE?

 Privacy commissioners, judges, and
arbitrators have developed different tests to
evaluate whether monitoring or surveilling
of employees is acceptable.
THE DIFFERENT TESTS

1) Is the measure demonstrably necessary to meet a
specific need?
2) Is the measure likely to be effective in meeting
that need?
3) Is the loss of privacy proportional to the benefit
gained?
4) Is there a less privacy-invasive way of achieving
the same end?
The Federal Privacy Commissioner

 Considers the overriding criteria of
reasonableness in assessing compliance
with PIPA.
The BC Privacy Commissioner

 Relevant factors the BC OIPC will consider include:
1) Is the personal information sensitive?
2) How much personal information is being collected or used?
3) Is the collection, use, disclosure of the personal information
likely to be effective in fulfilling the employer’s objectives?
4) Do alternatives exist and have they been given reasonable
consideration?
5) Is the monitoring covert or overt?
THE BC APPROACH - FACTORS

 Video that captures an individual’s physical image or movement
usually constitutes personal information
 Covert and overt surveillance are treated differently, with covert
monitoring treated as extremely privacy-invasive only permissible
in limited cases
 Arbitrators have also consistently adopted the reasonableness test
in situations involving covert video surveillance conducted outside
of the workplace
 Misconception – it is not the case that privacy obligations do not
apply if surveillance conducted in a public place
VIDEO SURVEILLANCE

The employer suspected employee engaged in a construction
business outside of his work. The employee called in sick on a
Friday and advised that he would also be sick on the following
Monday. The employer engaged a third party investigator to
covertly monitor the employee’s activities on Monday. The
investigation did indeed show that the grievor was working on a
construction project when he claimed to be sick. The employer
terminated his employment. The union argued that the
surveillance video was inadmissible as an invasion of the
employee’s privacy.
VIDEO SURVEILLANCE - SCENARIO

 1) Reasonable
 2) Not reasonable
 Doman Forest Products Ltd. v. I.W.A.-Canada, Local 1-357,1990 CarswellBC 2030 British Columbia
Arbitration
POLLING QUESTION

The grievor had been off work receiving workers’ compensation
benefits. The employer suspected that the employee was abusing his
sick leave benefits and was suspicious of him as it had heard rumours
that he was involved in a private contracting business. It retained a
private investigator to monitor the grievor's activities. Based on the
investigator's report and a video tape which showed the grievor
working at two construction sites while he was on sick leave, the
Employer concluded that the grievor had been engaged actively in
supervising construction work, and therefore was fraudulently on sick
leave. An issue arose during the hearing as to the admissibility of the
video tape evidence obtained by the private investigator.

 1) Reasonable
 Steels Industrial Products Ltd. v. Teamsters, Local 213, 1991 CarswellBC 3326 British Columbia Arbitration
POLLING QUESTION

 Different considerations apply when cameras are visible to
employees.
 Does the surveillance represent a legitimate exercise of
management rights?
 The tests for evaluating the permissibility of overt monitoring
are the same
 Employers need to define the objectives which should related
to addressing actual past incidents
 Employees need to be informed!!
VIDEO SURVEILLANCE - OVERT

 In determining whether video surveillance cameras are
reasonable in a workplace, the OIPC has stated the following:
“Video surveillance should only be used as a last resort after
exhausting less privacy-invasive alternatives, such as
improved workplace supervision or implementation of theft-
prevention controls. Organizations need to consider whether
video surveillance will achieve the intended purpose and whether
the concerns are serious enough to warrant implementing this
highly invasive technology.”

 The BC Privacy Commissioner has said that video
camera cannot – and should not – replace adequate
employee supervision
 Other considerations:
• Even if video is not a breach of PIPA, this does not
necessarily mean that all images captured by the system
would be admissible as evidence in a proceeding, such as
a wrongful dismissal case

The employer installed six digital recording surveillance cameras
in its mechanical facility area. The rationale was that it was
necessary to reduce vandalism (following 2 incidents) and deter
theft, as well as to provide security for staff; (there were reports of
female staff feeling vulnerable). The surveillance was not
surreptitious and was not limited to employees. Visitors, suppliers
and trespassers would be captured.

 1) Reasonable
 Eastmond v. Canadian Pacific Railway, 2004 FC 852
POLLING QUESTION

 The employer had video cameras at a coal mine throughout the site and
in its office area. The stated purpose in the operational areas was to
monitor and oversee production and to ensure work was being
performed safely. In the non-operational areas, the primary purpose was
safety and security. Cameras focused on tool cribs were for the purpose
of deterring employee theft. The cameras recorded continuously for up to
30 days then the footage was erased. The supervisors could also view
the camera recordings in real time.
 The employer informed the Union of the purpose of the collection, use
and disclosure of employee personal information through the use of
video cameras. It also provided a full list of cameras, their location and
who can access them.

 1) Reasonable
 3) Some of the cameras are reasonable
 Teck Coal Limited, 2020 BC OIPC 24
POLLING QUESTION

 Best practices:
1. Implement a policy that sets out the criteria that must be
met before video surveillance is undertaken
2. Detail who is authorized to operate the system and view
3. Limit the collection to that which is necessary to achieve
the stated purpose(s) and limit the use of the surveillance
to its stated purpose(s)
4. Address the location and areas of capture of the recording
equipment as well as the placement of cameras/angles of
vision/zoom/stop motion

 Best practices:
5. State the times that the recording will be in effect, the period
of surveillance, and the areas covered
6. State the period of retention of the data, how it will be
stored in a secure manner, and how it will be securely
destroyed
7. It should not be used in areas where people have a high
expectation of privacy (washrooms, change areas)
8. Notify the public (appropriate signage)

 Legitimate purposes might include:
• Making sure employee’s use of technology is limited to work-related
activities
• Protecting against leaks of confidential information
• Measuring employee productivity
• Protection of business assets and equipment (from viruses)
• Protection of the company against risks of improper use of systems,
illegal downloads, harassment, time-theft
IT MONITORING (EMAILS/INTERNET)

 Information collected through IT monitoring is usually
considered personal information
 For example, information in emails sent using a business
account could contain personal information respecting
employees or others
 Therefore, the tests for assessing whether IT monitoring is
necessary/reasonable apply
IT MONITORING (EMAILS/INTERNET)

The employee was employed by a library (public body) as a computer
technician. During his probationary period, the employer some concerns that
he needed to adopt a more consultative or 'teamwork' approach in fulfilling
his duties. A keystroke logging program was installed on the Applicant's
computer and it logged everything the user did on the computer. The
Applicant was not informed this had been done, but he discovered the
program about a month later. The Applicant immediately disabled the
program on his computer, and eventually removed it. No one other than the
Applicant ever viewed the information that had been logged by the program
from his computer. The Public Body had given the Applicant permission to
conduct personal internet banking on his work computer during non-working
time. The Public Body's computer use policy also allowed such use during
non-working hours.
IT MONITORING - SCENARIO

 1) Reasonable
 F2005-003 Parkland Regional Library – OIPC Alberta, 2005 CarswellAlta 2348
POLLING QUESTION

From the decision:
 Because such key-stroke monitoring programs involve a
continuous monitoring of an employee's working life, they are
highly intrusive into the privacy of employees. Where such
programs are employed surreptitiously, the encroachment on
an employee's personal privacy is even greater
 Surreptitious use of the software will result in "necessary"
information only where forewarning employees that such a
program will be used means that information needed for
management cannot be collected
ALBERTA PRIVACY COMMISSIONER

 The employee was a teacher and was charged with
possession of child pornography which was discovered after
the school’s computer technician remotely accessed the
contents of his work laptop and found explicit images of a
grade 10 student. The school board provided the laptop to the
police who conducted further searches on the computer.
ACCESSING LAPTOP - SCENARIO

 There were a number of factors that both supported and
diminished his reasonable expectation of privacy in the
contents of the laptop:
o the School’s policy permitted incidental personal use of its IT
o the policy stated that teachers’ emails remained private
o the school board permitted users to password protect their laptops
o the policy states all data generated on the laptop was considered the
exclusive property of the school board
o the acceptable use policy warned users not to expect privacy in
connection with files on the hard-drive
o teachers were explained the policy annually
R. v. Cole

Did this constitute an unreasonable search and seizure?
 1) Yes
 2) No
POLLING QUESTION

Guiding principles for a higher expectation of privacy:
 When employee owns the device
 The more personal or private in nature
 Data stored in personal email account
 Folders marked as personal
 Use of a password/encryption
POLLING QUESTION

The policy should include:
1.Clear permissions and prohibited use of computer systems
2.The employer’s right to access technological devices and the
reasons for such access
3.The fact that employees have no reasonable expectation of
privacy in technology or equipment provided by the employer
for business purposes
4.The fact that employees may not use work-issued technology
for personal purposes
ACCEPTABLE USE POLICY

 Employers should be able to demonstrate that the benefits of
email monitoring are proportional to the invasion of the
employees’ reasonable expectation of privacy
 In other words, the employer must prove that the business
interests outweigh the employees’ loss of privacy and less
intrusive methods (such as blocking websites) were
considered but rejected as insufficient to fulfill the legitimate
purpose(s)
ACCESS TO COMPUTERS/DEVICES

 GPS and RFID devices can provide continuous and fairly
accurate location data and the if tracking device is associated
with a particular individual, then clearly that individual’s
movements can be tracked
 Ability to monitor employee activities on a continuous, real-
time basis
 Generally the same tests used for video monitoring are
applied by privacy commissioners and arbitrators wrt GPS
GPS AND LOCATION TRACKING

Employees were a mobile workforce that attended client sites to
service elevators and generally worked alone. They almost always
went directly from their home to the client work site to begin their
workday. The employer issued cellphones to collect and use GPS
information in part for employee management purposes. The phones
were specifically assigned to each mechanic. They inputted when they
were on duty and off duty. They also inputted when they arrived at or
left client sites. The GPS information was only sent to the employer for
times when a mechanic’s phone was set to “on duty” status which
would be throughout the workday, except during break periods. The
GPS info was transmitted every 11 minutes and was accurate to a
range of 3 to 15 metres.
GPS AND TELEMATICS - SCENARIO

 1) Reasonable
 Kone Inc. (Re), [2013] BCIPCD No. 23
POLLING QUESTION

 Biometrics refers to range of techniques, devices, systems
that enable machines to recognize individuals or authenticate
their identities (retina scanning, fingerprinting, palm vein
scanning, voice recognition, DNA)
 The Federal Privacy Commissioner views all biometrics as
privacy invasive to a certain extent because they involve the
collection of an individual’s physical characteristics, but not all
biometrics are highly privacy invasive in and of themselves.
NEW TOOLS - BIOMETRICS

 An employee was terminated for alleged time theft. The
employer required employees to swipe an access card and to
perform a biometric hand scan in order to gain entry to the
protected area of a nuclear facility. They had to repeat the
process in order to exit. This entry and exit data was recorded
and kept for an extended but unspecified period. The union
argued that the employer’s use of these records for
disciplinary purposes was an unreasonable violation of privacy
rights and therefore, not admissible.
HAND SCAN - SCENARIO

 1) Reasonable and admissible
 2) Not reasonable and inadmissible
 Ontario Power Generation v Society of Energy Professionals,
2015 CanLII 26177
POLLING QUESTION

 Assessment of the legitimate use of employee monitoring
devices has not changed from pre-pandemic
 Be wary of jumping on the bandwagon of new technology
simply because it exists, is easily available and inexpensive
 Be cautious about using technology to supervise your
employees. Best practice is always to outline expectations,
have clear and unambiguous policies and only use technology
as a very last resort and as minimally as needed when no
other options are available
SUMMARY

 “I will underscore a key point about technological change and PIPA. The
range of circumstances that may be relevant in a given case will
undoubtedly change as technological innovation drives changes in
employment relationships and ways of working… As technology-enabled
work practices evolve, employers may implement practices with novel
implications for personal information protection in the employment
setting. As the line between one’s work and one’s personal life grows
fainter through ubiquitous computing and connectivity, new
considerations will arise. Technological change will raise new challenges
for determining what is reasonable for the purposes of PIPA’s
employment related provisions.”
Schindler Elevator Corp, 2012 BCIPC No. 25
FINAL THOUGHTS

Questions?
Thank you for attending!
Want to learn more about Law @ Work?
Subscribe to our blog at http://www.overholtlawyers.com/blog/
– or –
Follow Us on Social Media
Carman J. Overholt, QC Brent Mullin Gurpreet Gill
Jennifer S. Kwok Preston I.A.D. Parsons Kai Ying Chieh
Main: (604) 568-5464
trustedadvisors@overholtlawyers.com

Privacy in the Workplace: Employee Monitoring and Surveillance

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Privacy in the Workplace: Employee Monitoring and Surveillance

Similar to Privacy in the Workplace: Employee Monitoring and Surveillance (20)

More from Overholt Law

More from Overholt Law (11)

Recently uploaded

Recently uploaded (20)

Privacy in the Workplace: Employee Monitoring and Surveillance