​While Canadian employers have some leeway to use technology to keep tabs on workers in certain circumstances, national and provincial privacy laws set limits on how and when they can proceed, according to legal experts.

“This is a particularly urgent and timely issue, especially since there are now many people working remotely and this is likely to continue,” said Stuart Rudner, an attorney at Rudner Law in Ontario.

Canadian news media recently reported that a school janitor in Alberta refused last fall to download a mobile app that would help her employer confirm workers were at work when and where they were scheduled. She was fired weeks later.

The boss of the cleaning company had asked employees to download the application on their personal cell phones; the employee, concerned about her privacy and the security of her personal data, lost her job after refusing, even though the boss said the refusal was not the only reason, the CBC reported.

Balancing rights

“The issue involves a balance of rights. Specifically, employers have the right to manage their workforce and ensure that workers do what they are supposed to do. Conversely, employees have privacy rights that are based on a combination of legislation and common law,” Rudner says.

Canadian privacy laws, however, generate some confusion, he said. The national law on private companies, the Personal Information Protection and Electronic Documents Act (PIPEDA) only applies to a limited part of the population, whereas three provinces have their own privacy laws, Rudner noted. Additionally, the federal government is working to legislation giving citizens more control over how companies manage their personal data, he said.

Among other features, PIPEDA’s Fair Information Principles require individual consent for data collection and use, with some exceptions: they limit data collection to business-identified purposes and limit use , disclosure and retention of data, according to the law of Canada. Office of the Privacy Commissioner.

Most Canadian privacy laws contain an overriding “reasonable standard” that requires employers to pursue a legitimate purpose and limit the data collected, according to Suzanne Kennedy, a lawyer at Harris & Co. in Vancouver, Columbia -British.

“It is not necessarily unreasonable or contrary to privacy laws to require employees to carry devices that would allow employers to track their location,” but the onus is on employers to show why the use technology is necessary and reasonable, he said.

If there’s a less invasive way to achieve the same goal, it’s harder to justify the tracking technology, he explains. Additionally, Kennedy said, it can make a difference if employees are asked to use their own devices rather than their employer’s.

Below Alberta Privacy Act, 2003a private sector employer may collect and use employees’ personal data without consent if reasonable and for certain limited purposes, but must give reasonable notice to current employees and disclose the reasons.

Employers may have compelling reasons to monitor their employees, Kennedy noted. If an employee is out in the community all day, for example, it might be helpful to both the employer and worker to set up tracking for safety reasons, she explained.

“Employers need to be very careful. There are many technologies that allow us to monitor what employees are doing in the workplace. They are cheap and easy to use,” Kennedy said.

Context matters

Canadian case law, however, clearly indicates that an employer who collects information about its employees “willy-nilly” will be violating privacy laws, according to Kennedy. If an employer simply adopts new technology and collects information without careful analysis of what the organization actually needs, he added, “that’s probably something regulators would be very interested in looking at from a point of view from a confidentiality perspective.

Most, if not all, privacy laws in Canada are based on principles requiring that tracking serve a legitimate purpose (for security, for example, or to effectively supervise and send employees to jobs at exterior), that it is not too intrusive and that it is clear how monitoring is carried out. the data is protected, Kennedy said.

Under British Columbia’s Personal Information Protection Act, which covers more than 380,000 private sector organizations, data collected about an employee’s location and behavior is considered personal information, regardless of ownership. of the device, according to Guidance document 2017 of the province’s Office of the Information and Privacy Commissioner (OIPC).

“Certain circumstances may permit the use of GPS to map employee travel routes, manage work hours and ensure employees drive safely and legally. These may require the employee’s knowledge and consent before their implementation and use,” the document states. . “Orders from this office have determined that, in most cases, B.C. [British Columbia] Privacy laws do not allow for continuous, real-time monitoring of employees outside of work hours via GPS tracking. Such widespread monitoring would most likely be considered excessive and invasive. »

Context matters, however, wrote the BC OIPC, citing a case in which an elevator company was allowed to use GPS and motor health data systems to monitor the location and behavior of employees during working hours, as the employer aimed to ensure worker safety and enable customer billing. . In this case, employees were dispatched from home and rarely worked on the employer’s property.

The surveillance would not have been permitted if the elevator company had used the technology to collect data about employees’ personal time, whether continuously, covertly, or for other purposes, the ICPO wrote.

Dinah Wisenberg Brin is a freelance writer based in Philadelphia.