Volume 9 • Number 8 July 2012 PRIVACY PROTECTION IN THE DIGITAL WORKPLACE In This Issue: Privacy Protection in the Digital Workplace Pat Flaherty and Sarah Whitmore...........73 Pat Flaherty Sarah Whitmore Partner Associate Torys LLP Torys LLP We as a society don’t tolerate discrimination in the workplace, or harassment. Why would we tolerate invasion of privacy?1 Privacy has been described by the Supreme Court of Canada as “an essen- tial component of what it means to be ‘free.’”2 Protection of an individual’s right to privacy is “predicated on the assumption that all information about a person is in a fundamental way his own, for him to communicate or re- tain.”3 The importance of privacy has been acknowledged as a fundamental human right; but just as no other recognized human rights or Charter rights are absolute, the right to privacy must also yield to competing rights in cer- tain circumstances. In the workplace, the employer’s rights to monitor quality control and employee productivity as well as to ensure a safe and harassment-free workplace often warrant an incursion on employees’ rights to privacy. Governing the appropriate balance to be struck between employers’ rights and employees’ privacy interests is a patchwork of privacy legislation, in- dividual employment contracts, Charter rights, and the newly recognized tort of intrusion upon seclusion.4 CANADIAN PRIVACY LAW REVIEW • Volume 9 • Number 8 As technology has advanced and facilitated the spread of in- Canadian Privacy formation and the ease with which organizations can com- Law Review municate and store personal information, the need for The Canadian Privacy Law Review is published monthly by LexisNexis Canada Inc., employers to monitor their employees has become more 123 Commerce Valley Drive East, Suite 700, acute. Employees’ use of computers, the Internet, e-mail, and Markham, Ont., L3T 7W8, and is available by subscription only. social media at work (for work-related and non-work-related Web site: www.lexisnexis.ca purposes) presents new concerns for employers, including the Design and compilation © LexisNexis Canada Inc. effect of such use on productivity, workplace harassment, 2012. Unless otherwise stated, copyright in and their liability for their employees’ online activities. individual articles rests with the contributors. Employers may be found liable for their employees’ online ISBN 0-433-44417-7 ISSN 1708-5446 ISBN 0-433-44418-5 (print & PDF) defamatory remarks, copyright and trademark infringement, ISBN 0-433-44650-1 (PDF) harassment, and other illegal conduct in the course of em- ISSN 1708-5454 (PDF) ployment. Workplace harassment may be more readily facili- Subscription rates: $230.00 (print or PDF) tated through the use of company e-mail or through the $350.00 (print & PDF) sharing of hateful or offensive material from the Internet. As Editor-in-Chief: a result of these concerns, many employers take the position Professor Michael A. Geist that monitoring their employees’ computer usage and online Canada Research Chair in Internet and E-Commerce Law activities is necessary to detect activity that may negatively University of Ottawa, Faculty of Law affect the business. Furthermore, employers may have a duty E-mail: [email protected] to monitor employees in order to meet the legal occupational LexisNexis Editor: health and safety obligations to provide a harassment-free Boris Roginsky 5 LexisNexis Canada Inc. and non-discriminatory workplace. Tel.: (905) 479-2665 ext. 308 Fax: (905) 479-2826 On the other hand, the digital workplace also presents new E-mail: [email protected] and increased risks to employees’ privacy. A reality of the Advisory Board: digital workplace is that employees use employer-owned • Ann Cavoukian, Information and Privacy technology to send and share personal information over the Commissioner of Ontario, Toronto Internet, e-mail, and social-media sites. For example, em- • David Flaherty, Privacy Consultant, Victoria • Elizabeth Judge, University of Ottawa ployees communicate with other employees and unrelated • Christopher Kuner, Hunton & Williams, third parties over their employer’s e-mail server; they store Brussels • Suzanne Morin, Research in Motion, Ottawa their financial records on their employer-owned computers; • Bill Munson, Information Technology they access and use social-media sites from their employer’s Association of Canada, Toronto Internet network; and they use employer-owned smart phones • Stephanie Perrin, Service Canada, Integrity Risk Management and Operations, Gatineau and other PDAs as if the devices were their own. These • Patricia Wilson, Osler, Hoskin & Harcourt LLP, practices and other new technologies have also given Ottawa employers the ability to more readily track or monitor their Note: This Review solicits manuscripts for consideration by the Editor-in-Chief, who reserves the right to reject any manuscript or employees’ personal information and performance. Tech- to publish it in revised form. The articles included in the Canadian Privacy Law Review reflect the views of the individual authors and do nologies exist to allow employers to scan e-mails, track not necessarily reflect the views of the advisory board members. This Review is not intended to provide legal or other professional advice Internet usage, monitor keystrokes, search hard drives, and and readers should not act on the information contained in this Review monitor an employee’s movements on and off the job. As a without seeking specific independent advice on the particular matters with which they are concerned. 74 CANADIAN PRIVACY LAW REVIEW • Volume 9 • Number 8 result, the quantity and accessibility of employees’ Electronic Documents Act.7 PIPEDA applies to all personal information in the workplace have expo- collection, use, and/or disclosure of “personal in- nentially increased, giving rise to greater concern formation” in the course of “commercial activity” for their privacy rights. by an “organization” and imposes several main pri- This article examines the balance that is currently vacy-related obligations on organizations subject to 8 being struck in the private sector digital workplace its provisions. Personal information is defined between Canadian employers’ rights to monitor broadly in PIPEDA and currently includes informa- their employees to ensure performance and work- tion about an employee other than name, title, and 9 place safety, on the one hand, and employees’ business address and telephone number. PIPEDA rights to privacy, on the other. More specifically, has limited application in most workplaces. With we focus on the employer’s right to monitor em- respect to personal information about employees, ployees’ use of e-mail, social media, and company- consistent with the constitutional division of pow- owned computers and vehicles. We also consider ers in Canada, PIPEDA applies only to federally the issue of employers conducting background regulated employers (those engaged in a “federal checks on prospective employees via social media. work, undertaking or business” and employers in Before examining these various issues, we outline the three territories). Consequently, PIPEDA does the legislative framework surrounding Canadian not apply to provincially regulated employers. employees’ privacy rights in the workplace. 2) Provincial Legislative Protection A. Privacy Rights With the exception of employment related to fed- in the Canadian Workplace eral works, undertakings, and businesses governed A private sector employee’s right to privacy is con- by PIPEDA, the provinces have jurisdiction tained in a patchwork of rights codified in various over matters pertaining to employment. Quebec, pieces of legislation and arising from the common Alberta, and British Columbia have each enacted 10 law. The nature and scope of protection given to an privacy legislation that regulates the collection, employee’s personal information vary according to use, and disclosure of employees’ personal infor- the province and sometimes the sector in which the mation by organizations that are not otherwise fed- employee is working. In Ontario and several other erally regulated. As an aside, each of these laws has 6 been deemed “substantially similar” to PIPEDA provinces, there is a gap in legislative protection by the federal privacy regulator, the Privacy for private sector employees’ privacy rights. These Commissioner of Canada, though the manner in provinces have not enacted private sector privacy which they deal with employees’ personal informa- legislation of general application, and, as discussed tion is not uniformly consistent with PIPEDA. below, the federal privacy legislation does not ex- These provincial laws apply to employees’ personal tend to provincially regulated private sector em- information in private sector organizations within ployers’ collection, use, and disclosure of each of those provinces, but they do not regulate employees’ personal information. the personal information of employees working for 1) Federal Legislative Protection federally regulated employers; that personal infor- Canada’s main private sector privacy legislation is mation is regulated by PIPEDA. Outside Quebec, the federal Personal Information Protection and Alberta, and British Columbia, therefore, a legisla- 75 CANADIAN PRIVACY LAW REVIEW • Volume 9 • Number 8 tive gap exists with respect to the rules governing that a court would find that the employee had an the protection of employees’ personal information expectation of privacy in the