Privacy Commissioner Underlines Importance of Workplace Technology Policies
By Vicki Giles
A recent Order of the Alberta Privacy Commissioner underscores the importance of having, and properly implementing, policies related to the use and monitoring of company-owned technology like Blackberries and laptops.
In the Order, the employer undertook an investigation of the personal use of a company-issued Blackberry by one of its employees. The employer believed that the employee had used the Blackberry to make personal phone calls contrary to its policy that Blackberries could only be used for work purposes. It investigated by making calls to the phone numbers it believed were questionable. It obtained the numbers from the monthly invoice it received from its phone/data plan provider.
When the employer confronted the employee about his personal calls, the employee filed a complaint with the Privacy Commissioner alleging that the employer had collected and used his personal information contrary to the Personal Information Protection Act.
The Privacy Commissioner determined that in tracing the calls and confronting the employee, the employer had collected and used the employee’s personal information. The personal information consisted of the identity of the recipients of the non-work-related calls and the nature of the calls.
The employer argued that it was entitled to collect the personal information without consent because it had a verbal policy which restricted Blackberries to work-related use. PIPA allows employers to collect, use and disclose personal information without consent for the purpose of investigating possible breaches of employer policies (being a breach of the employment agreement). However, after examining the evidence, the Privacy Commissioner found that no such policy existed. As there was no policy, there could be no possible breach of the employment relationship that justified an investigation.
The employer also argued that it was entitled to collect the personal information without consent because it was “personal employee information”. PIPA allows employers to collect, use and disclose “personal employee information” without consent. However, in order for personal information to be considered “personal employee information”, the information must be reasonably required by the employer solely for the purposes of establishing, managing or terminating the employment relationship. Further, employees must be given notice of the personal employee information which will be collected, used and disclosed by the employer, and the purposes for the collection, use and disclosure. Again, the lack of a policy governing Blackberry use was fatal to the argument of the employer. As there was no policy in place preventing Blackberries from being used for personal use, the collection of the personal information about the calls was unreasonable. Further, there was no prior notice that monitoring would occur.
Finally, the Privacy Commissioner disagreed with the employer that the employee had impliedly consented to the tracing of the calls because he knew the phone numbers would appear on the monthly invoices. While the employee knew that the employer would monitor air time usage, he did not know it might trace those numbers for the purpose of determining if they were work-related. As such, he could not impliedly consent to the phone numbers being used for the purpose.
This Order shows just how careful employers have to be in drafting and implementing acceptable use policies for workplace devices. As most employees are entitled to use these devices for personal use (and have a reasonable expectation of privacy with respect to that use confirmed by the Supreme Court of Canada), employers must ensure that their acceptable use policies are clear as to what is and is not allowed. They must also advise employees that use will be monitored and the purposes for that monitoring. Also, employers must of course be sure to properly implement the policy and ensure that it is brought to the attention of all employees.