EMPLOYEE SCREEN-MONITORING SOFTWARE MAY BREACH PRIVACY LAWS

An employer’s surveillance of its employees in the workplace is anything but a straightforward topic. PIPEDA requires – broadly – that employer surveillance must be reasonable and that with some exceptions, employers must obtain the consent of their employees. And like almost every privacy law topic, context is key – especially following the leading decision in the area: the Federal Court’s decision is Eastmond [Eastmond v Canadian Pacific Railway, 2004 FC 852]. The key takeaway from Eastmond is that although the employer was allowed to maintain video cameras in the workplace, the Canadian Pacific Railway (employer) included many limitations and safeguards on this practice making it acceptable under PIPEDA.

In Eastmond, the Court allowed CP to monitor its employees via workplace cameras, despite the Privacy Commissioner’s decision to the contrary.

Reasonableness

The test that the Court used to determine that CP’s video surveillance was permissible has four parts:

(1)    The employer must have a purpose for its surveillance practice, which makes its surveillance necessary, and,

(2)    The surveillance must accomplish the purpose that the employer sought to accomplish, and,

(3)    The loss of privacy must be proportional to the benefit gained, and,

(4)    There could not have a less privacy-invasive way of achieving the same purpose.

The important factors that swayed the Court to allow surveillance in this context were:

  1. That CP warned its employees that they were being observed via video camera,
  2. The cameras were in a fixed position and could not follow employees,
  3. The information (video tapes) collected did not measure employees’ work performance,
  4. The tapes were kept under a lock and key and only available to CP managers or police,
  5. The tapes were only viewed when there was an incident reported,
  6. The tapes were always destroyed after a 96 hour period had passed (see para 176),
  7. The cameras would, on a balance of probabilities, be effective in deterring theft (see para 179),
  8. The loss of privacy was minimal because the cameras were rarely viewed, and were only viewed when required (see paras 180 and 181), and,
  9. Other options such as security guards or fencing were not as cost effective or were disruptive of CP’s operations (see para 182).

Consent

Regarding PIPEDA’s consent requirement, the Court found that CP did not require its employees’ consent to be videotaped because of the section 7(1)(b) exception, allowing personal information to be collected without consent if:

“…it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.”

The Court gave a lot of weight to the fact that the videotapes were not being observed in real time by CP staff when it concluded that the consent exception applied. CP staff would only view the tapes when an incident was reported, and thus, to ask for employee consent would defeat the purpose of the investigation – of course the employee would not consent, and the employer’s purpose of combatting theft would be defeated (see para 189).

PIPEDA and screen-monitoring software

A relatively new technology allows for employers to monitor their employees’ computer screens. The software allows a business to monitor productivity, check attendance, collect proof of hours worked, and ensure security (among other possible applications).

The legality of screen-monitoring technologies under PIPEDA is dependent upon the purpose for which the software is employed. Consider, for example, an employer who seeks to deter its employees from accessing gambling sites during working hours – preventing time theft. Assuming that, like in Eastmond, the employer warned its employees of this surveillance, the analysis under Eastmond would proceed something like this:

Reasonableness

(1)    Purpose of the surveillance.

(2)    Accomplishing that purpose.

Surveillance to prevent the use of gambling sites arguably seeks to prevent time-theft, i.e., employees paid for time not worked. So long as the employer has a way of holding employees accountable once caught with the monitoring technology, this branch is likely met.

(3)    Privacy loss proportional to benefit of surveillance.

(4)    A less privacy-invasive way of achieving the same purpose.

Moreover, like in Eastmond, so long as an employer implements its screen-monitoring with several, self-imposed limitations like CP, the technology is likely permissible under PIPEDA. However, these limitations are not yet available: by its nature, screen-monitoring technology must track all of an employee’s activities and cannot be narrowed to a particular “space” like the cameras in Eastmond. In this context, the technology affects the privacy interests of the employees more intimately, tracking activities such as personal emails and banking. And importantly, most workplaces do not have firm policies preventing employees from taking short breaks throughout the workday to conduct these personal activities. Thus, unlike in Eastmond, employers using screen-monitoring technology may be unable to effectively impose restrictions on the use of this technology. Thus, short of a change in the technology that limits its scope, the technology is likely an unreasonable invasion of employee privacy and a breach of PIPEDA.

Consent The consent point is thus moot. However, it is notable that the section 7(1)(b) exception to PIPEDA’s consent requirement likely applies in the same way as it did in Eastmond. That is, if an employer can find a way to use the screen-monitoring software reasonably (which I have pointed out to be difficult if not impossible with the current technology), then in the time-theft context, employers will not need to get their employee’s consent. The situation is analogous to Eastmond: informing suspect employees that they will be monitored would prevent employers from catching them in the act. Consent would defeat the employer’s purpose.

Disclaimer: This article is provided as an information resource. This article should not be relied upon to make decisions and is not intended to replace advice from a qualified legal professional. In all cases, contact your legal professional for advice on any matter referenced in this document before making decisions. Any use of this document does not constitute a lawyer-client relationship. Please note that this information is current only to the date of posting. The law is constantly changing and always evolving. I encourage you to reach out with any specific questions.