Because privacy law has become increasingly codified over the last few years - the federal government, Alberta, British Columbia and Quebec all have privacy statutes - it''s easy to forget that reasonableness is still a significant consideration in privacy law, particularly for employers.
"Even with consent, organizations may collect, use or disclose personal information only for purposes that a reasonable person would consider to be appropriate in the circumstances," says Jeffrey Goodman of Heenan Blaikie LLP's Toronto office.
Illustrating the point are two decisions from the Office of the Alberta Information and Privacy Commissioner (OIPC).
SAS Institute involved an application for an administrative assistant/receptionist position. During the employment interview, the interviewer obtained the applicant's consent for a pre-employment background check, which the company conducted on all prospective hires and which included a credit check.
The company had three reasons for conducting such a check:
- To assess the applicant's suitability to manage petty cash;
- To minimize credit card fraud; and
- To validate employment history.
"The difficult with credit reports is that they can contain a lot more information than credit history," Goodman says. "They can reveal age, residence history, marital and family status, education, and prior employment."
In order to justify such a check, then, there must be a clear employment-related need to collect each piece of personal information and the collection of the information must effectively address that need.
"The employer also has to turn its mind to whether there are less intrusive means to achieve the same results," Goodman adds.
The OIPC agreed with the applicant that collection of some of the personal information contained in the credit report violated the Alberta Personal Information Act because it was unreasonable: some of the information was irrelevant and some of the relevant information could have been obtained by less intrusive means.
In OIPC's view, there was not a necessary correlation between anyone's ability to manage their finances and their ability to manage cash on the job. As well, SAS had not established that it had legitimate grounds for concern about theft of petty cash or fraudulent use of corporate credit cards.
Precision Drilling arose when an employer installed an event data recorder in the employee's car, which he also used for work purposes. When the employee had an accident, he gave the employer written consent to retrieve the recorder's data.
After reviewing the data, the employer concluded that the employee had broken traffic laws and contravened company safety policy. The company fired the employee for cause.
The OIPC concluded that the employer had not violated the provincial privacy act. The collection of the information was reasonable because it related only to matters directly relevant to the employment relationship, being the manner of the employee's driving while on the job.
"Precision Drilling provides a clear illustration of the extent of an employer's right to use [data recorders] and transponders to monitor employee driving activities," Goodman says. "But this is a case where the employer did not collect or use data that related
to personal use, although it was likely available."
Although Ontario does not have a general privacy statute, these cases are instructive because reasonableness is as central to common law doctrines relating to privacy as it is to the legislation.
Reasonableness is also central to the federal legislation that affects federally regulated companies in Ontario.
To some extent, this is comforting, because many employers operate in more than one province. On the other hand, Barbara McIsaac, of McCarthy Tétrault's Ottawa office, says jurisdiction is the "big looming issue out there" in terms of privacy law.
"There's a huge trans-border flow of customer and employee information for a lot of organizations like banks and national retailers," she says. "One day the courts will have to sort out what this means in a country where we have a federal privacy law, some provincial privacy laws, and some provinces where privacy is still a matter for the common law."
Another problem is that employers' huge information-gathering capacity, both regarding employees and customers, is a rich target for governments seeking information.
Recently, the B.C. government backed down on a request for information about big-box store Costco's members - but it could just as easily have been about Costco employees.
The government made its demands under the Social Services Tax Act, legislation aimed at identifying consumers who did not pay B.C. sales tax on purchases they made in Alberta. It wanted the names of all B.C. Costco members who had shopped at Costco's Alberta warehouse. It also wanted the details of all purchases by these customers.
The case did not proceed, so the result is unknown.
Costco took the position that the request was a "fishing expedition" since the government could not pinpoint any particular customers.
While the Social Services Tax Act authorizes the government to make the demand, it says nothing about particularity. Interestingly, however, several privacy commissioners across Canada supported Costco's stance.
