The Need To Notify: Evidence Ruled Inadmissible Due To Privacy Violation
January 2018
Article by:
Jacqueline D. Gant
Previously printed in the LexisNexis Labour Notes Newsletter.
The importance of providing notice to employees prior to collecting and using employee personal information is highlighted in Zelstoff Celgar Ltd. v. Public and Private Workers of Canada, Local 1 (Negreiff Grievance), [2017] B.C.C.A.A.A. No. 28 (Blasina).
Facts
The Grievor, a lead hand welder at the Employer’s pulp mill, grieved the termination of his employment for “theft of time”.
The Employer had two forms of timekeeping: a self-reporting system and a swipe card system. The self-reporting system allowed employees to report when they clocked in and out of work. The swipe card system was introduced by the Employer in 2015. Employees needed to use swipe cards in order to enter and exit the site as well as to gain access to safety-sensitive areas. The data from the swipe cards identified the person and the location and time of the employee’s entry and exit and was recorded on the Employer’s computer system.
When the Employer implemented the swipe card system, it had intended to use the data it collected for attendance purposes. However, the Employer told employees – in both meetings and written communications – that the system was to enhance the safety of the mill and, in particular, to account for employee whereabouts in the event the mill had an emergency and needed to be evacuated. Employees were not told that the information could be used for attendance management. Despite this, company supervisors had access to the swipe card data and reviewed it for employee management purposes.
In December 2016, the Grievor was discharged for theft of time. The Employer had discovered discrepancies between the Grievor’s self-reported entry and exit times in comparison to the data on the swipe card system. It was determined that the Grievor was manually reporting his time at eight hours but his swipe card times showed he was arriving late and leaving early.
Argument and Decision
The Union brought a preliminary motion at the hearing challenging the admissibility of the swipe card data. The Union took the position that the information was “employee personal information” under the Personal Information Protection Act (“PIPA” or the “Act”). The Union argued that the information had been collected without consent or notification and used by the Employer in contravention of the Act.
The Employer argued that there was no breach of PIPA as: (1) the data was not “personal information”; and (2) using the information for attendance and management purposes did not breach the Act. In addition, the Employer argued that labour arbitrators were able to use their discretion to admit evidence which would not otherwise be admissible in court.
Arbitrator Robert (Bob) Blasina found the Employer breached PIPA and declined to exercise his discretion to admit the evidence. He held that the information collected through the swipe card system was clearly “employee personal information” as defined by PIPA because it was about an identifiable individual and used for the purpose of managing the employment relationship, including termination of the Grievor’s employment. Although the Act did not require the Employer to obtain the consent of employees for the collection of the swipe card data, it did impose an obligation on the Employer to notify the employees of the purpose for the collection and use.
The notification needed to be “meaningful”. It needed to have some degree of specificity. While the Employer had told the Union and employees that the information would be collected and used for safety-related objectives and “accountability”, it did not advise employees that the information could be used for disciplinary purposes. In particular, the arbitrator was critical of the Employer’s failure to communicate its intention to use the information for disciplinary purposes when the swipe card system was implemented as it would have been very simple to do so at the time.
The swipe card data was ruled inadmissible and a hearing on the merits did not occur because the Employer has lost its key evidence to prove theft of time.
Lessons for Employers
- Employers must notify employees of the purpose for the collection, use and disclosure of employee personal information: information that is about an identifiable individual used to manage or terminate the employment relationship.
- When in doubt, employers should err on the side of caution when notifying employees of the potential use of information. If the employer intends to collect or use personal information or may do so in the future, it is best to notify employees at the outset.
- Notification must be meaningful and specific. It is advisable to expressly include the purposes of the collection, use and disclosure of information in company policies and provide training on such policies.
January 2018
Previously printed in the LexisNexis Labour Notes Newsletter.
The importance of providing notice to employees prior to collecting and using employee personal information is highlighted in Zelstoff Celgar Ltd. v. Public and Private Workers of Canada, Local 1 (Negreiff Grievance), [2017] B.C.C.A.A.A. No. 28 (Blasina).
Facts
The Grievor, a lead hand welder at the Employer’s pulp mill, grieved the termination of his employment for “theft of time”.
The Employer had two forms of timekeeping: a self-reporting system and a swipe card system. The self-reporting system allowed employees to report when they clocked in and out of work. The swipe card system was introduced by the Employer in 2015. Employees needed to use swipe cards in order to enter and exit the site as well as to gain access to safety-sensitive areas. The data from the swipe cards identified the person and the location and time of the employee’s entry and exit and was recorded on the Employer’s computer system.
When the Employer implemented the swipe card system, it had intended to use the data it collected for attendance purposes. However, the Employer told employees – in both meetings and written communications – that the system was to enhance the safety of the mill and, in particular, to account for employee whereabouts in the event the mill had an emergency and needed to be evacuated. Employees were not told that the information could be used for attendance management. Despite this, company supervisors had access to the swipe card data and reviewed it for employee management purposes.
In December 2016, the Grievor was discharged for theft of time. The Employer had discovered discrepancies between the Grievor’s self-reported entry and exit times in comparison to the data on the swipe card system. It was determined that the Grievor was manually reporting his time at eight hours but his swipe card times showed he was arriving late and leaving early.
Argument and Decision
The Union brought a preliminary motion at the hearing challenging the admissibility of the swipe card data. The Union took the position that the information was “employee personal information” under the Personal Information Protection Act (“PIPA” or the “Act”). The Union argued that the information had been collected without consent or notification and used by the Employer in contravention of the Act.
The Employer argued that there was no breach of PIPA as: (1) the data was not “personal information”; and (2) using the information for attendance and management purposes did not breach the Act. In addition, the Employer argued that labour arbitrators were able to use their discretion to admit evidence which would not otherwise be admissible in court.
Arbitrator Robert (Bob) Blasina found the Employer breached PIPA and declined to exercise his discretion to admit the evidence. He held that the information collected through the swipe card system was clearly “employee personal information” as defined by PIPA because it was about an identifiable individual and used for the purpose of managing the employment relationship, including termination of the Grievor’s employment. Although the Act did not require the Employer to obtain the consent of employees for the collection of the swipe card data, it did impose an obligation on the Employer to notify the employees of the purpose for the collection and use.
The notification needed to be “meaningful”. It needed to have some degree of specificity. While the Employer had told the Union and employees that the information would be collected and used for safety-related objectives and “accountability”, it did not advise employees that the information could be used for disciplinary purposes. In particular, the arbitrator was critical of the Employer’s failure to communicate its intention to use the information for disciplinary purposes when the swipe card system was implemented as it would have been very simple to do so at the time.
The swipe card data was ruled inadmissible and a hearing on the merits did not occur because the Employer has lost its key evidence to prove theft of time.
Lessons for Employers
- Employers must notify employees of the purpose for the collection, use and disclosure of employee personal information: information that is about an identifiable individual used to manage or terminate the employment relationship.
- When in doubt, employers should err on the side of caution when notifying employees of the potential use of information. If the employer intends to collect or use personal information or may do so in the future, it is best to notify employees at the outset.
- Notification must be meaningful and specific. It is advisable to expressly include the purposes of the collection, use and disclosure of information in company policies and provide training on such policies.