Attempting to breach privacy law isn’t the same as actually breaching it
Employers in Canada have now lived with the Personal Information and Protection of Electronic Documents Act (PIPEDA) — the federal privacy law — for more than a year since it came into force for most organizations on Jan. 1, 2004.
In that time, the Office of the Privacy Commissioner has issued a number of decisions in complaints filed by employees against their employers.
But a recent complaint, that the commissioner said was not well-founded, was taken to the Federal Court. In that case the court has made it clear that, unless PIPEDA is changed by Parliament, merely attempting to breach PIPEDA is not the same as actually doing so.
Alberta woman takes privacy battle to court
Janice Morgan complained to the Office of the Privacy Commissioner after she found an audio recording device in an employee break room at Alta Flights (Charters) Inc.
The privacy commissioner ruled there was no breach of PIPEDA because the recording device did not contain any conversations on it when it was found.
Morgan wanted the Federal Court to:
•issue an order declaring that her complaint was well-founded;
•direct Alta Flight to refrain from surreptitiously intercepting, collecting, using and disclosing private communications of its employees and to comply with PIPEDA;
•direct Alta Flight to publish notice of this order in its employee newsletter; and
•award damages to her in the amount of $5,000 for humiliation.
Morgan was employed as a customer service representative with Alta Flights in Edmonton from Sept. 7, 2000, to April 5, 2003. On April 1, 2003, while in the break room, she and another employee discovered a digital recorder that had been attached to the underside of a coffee table.
A manager admitted she hid the recorder in the room on the night in question with the intention of recording the conversations of Morgan and a few other employees. She said this was necessary in order to further investigate allegations of wrongdoing by Morgan and other employees.
Morgan and two other employees filed a formal written complaint under PIPEDA on April 4, 2003. The next day she was fired due to a conflict between her and the manager.
Upon concluding its investigation into Morgan’s complaint, the privacy commissioner told her on April 12, 2004, that although it disapproved of the actions taken by Alta Flights in seeking to make the recording, there was no collection of any personal information since no recording had actually been made of the break room conversation. Consequently, there was no violation of PIPEDA and the commissioner ruled the complaint was not well-founded.
Morgan argued the privacy commissioner erred in ruling against her complaint. The recorder was working, and the manager’s voice could be heard on it saying “test, test test.”
There was a possibility that in trying to play the recording, the employees might have inadvertently erased it, she said. Morgan argued that since the recorder was tested and clearly working, it should be assumed that a recording was successfully made and that personal information was discussed and recorded before it was discovered.
Alta Flights argued the privacy commissioner was correct in ruling PIPEDA only provides for remedies following the unauthorized collection, use and disclosure of personal information and there is no authority in PIPEDA or case law to create “attempts” to violate PIPEDA’s provisions as a separate breach of the act.
The Federal Court said there was no dispute that if Alta Flights had successfully recorded its employees’ conversations, there would be a violation of PIPEDA.
But the evidence did not back up that claim. The court said it could not agree with Morgan’s submission that since a test was done on the recording device before it was installed that it was logical to assume more information was registered by the recorder.
The court said the only conclusion it could make based on the evidence was that no conversation was recorded and thus no personal information collected.
There is no provision in PIPEDA stating that the attempted collection of personal information constitutes a violation of the act. The actions contemplated by the act are those involving the actual collection, use and disclosure of information.
Justice Camilien Nöel said Morgan’s frustration at the lack of a remedy under PIPEDA is understandable.
“But until Parliament indicates otherwise, one cannot take so liberal an approach to the interpretation of PIPEDA so as to change its fundamental shape and remedies,” said Justice Nöel.
The court said Morgan might have other remedies, such as pursuing a claim under s. 184 of the Criminal Code. That section states that:
“Every one who, by means of any electromagnetic, acoustic, mechanical or other device, wilfully intercepts a private communication is guilty of an indictable offence and liable to imprisonment for a term not exceeding five years.”
The Criminal Code allows for damages of up to $5,000 for anyone convicted under s. 184.
For more information see:
• Morgan v. Alta Flights (Charters) Inc., 2005 CarswellNat 798, 2005 FC 421 (F.C.)
How privacy disputes are handled
When the Office of the Privacy Commissioner receives a complaint, it conducts an investigation and issues a formal finding that concludes the complaint is well-founded, not well-founded or resolved.
A formal finding gives the complainant the right to go to Federal Court. But most complaints don’t head down that path.
Most complainants just want the matter rectified. Often the complaint is the result of a miscommunication between the complainant and the organization, and the privacy commissioner works with each side to clarify the issue. In other instances, the organization is not fully in compliance with PIPEDA. In those cases, the commissioner works with the organization to ensure it is adhering to the law.
Where a formal finding has been issued, the privacy commissioner brings this to the attention of the organization and a prompt resolution is frequently the result.
Recent decision by the privacy commissioner
An employee at the Canadian Food Inspection Agency (CFIA) working at a federally registered meat processing plant complained the plant was collecting his personal information by way of video cameras without his consent, and had disclosed it to his employer in an attempt to undermine his work and the work of other federal inspectors.
The company installed video cameras in 2001. There are 15 cameras at the plant, located at entry and exit points, and in all areas of the plant, including the room where CFIA employees have their workstations.
The company said the cameras were used to address security concerns and to monitor hygiene, safety and product safety. The CFIA employee did not dispute the cameras could provide security, and did not take issue with their installation at entry and exit points for such a purpose.
When the CFIA employee asked about the cameras at the time of installation, he was told they would not be used to observe him.
But there were documented incidents where the company had disclosed information about him to CFIA managers to show them videotape footage of his workstation to support the company’s contention that he was overly zealous in his work.
The Office of the Privacy Commissioner focused on the camera used to monitor the CFIA employee’s workstation. The company cited product safety as the reason for installing that camera. But the commissioner said the company presented no information to back its claim that it was monitoring food safety.
The CFIA inspectors are responsible for food safety and quality assurance, and are on site whenever the production line is operating. The commissioner found it difficult to understand how having a camera in this area — a camera that could not provide a clear picture of animals — ensures product safety when the very people responsible for ensuring safety are in the room.
The commissioner concluded the complaint was well-founded. But because the incidents where the employer handed video evidence to CFIA managers happened before PIPEDA came into force on Jan. 1, 2004, and the company has not made any other attempts since that date to use the video in such a manner, it could not rule on the part of the complaint.
The commissioner recommended that the company remove the camera from the room where CFIA staff have their workstations.
For more information see:
• PIPEDA Case Summary #290 online at www.privcom.gc.ca.
In that time, the Office of the Privacy Commissioner has issued a number of decisions in complaints filed by employees against their employers.
But a recent complaint, that the commissioner said was not well-founded, was taken to the Federal Court. In that case the court has made it clear that, unless PIPEDA is changed by Parliament, merely attempting to breach PIPEDA is not the same as actually doing so.
Alberta woman takes privacy battle to court
Janice Morgan complained to the Office of the Privacy Commissioner after she found an audio recording device in an employee break room at Alta Flights (Charters) Inc.
The privacy commissioner ruled there was no breach of PIPEDA because the recording device did not contain any conversations on it when it was found.
Morgan wanted the Federal Court to:
•issue an order declaring that her complaint was well-founded;
•direct Alta Flight to refrain from surreptitiously intercepting, collecting, using and disclosing private communications of its employees and to comply with PIPEDA;
•direct Alta Flight to publish notice of this order in its employee newsletter; and
•award damages to her in the amount of $5,000 for humiliation.
Morgan was employed as a customer service representative with Alta Flights in Edmonton from Sept. 7, 2000, to April 5, 2003. On April 1, 2003, while in the break room, she and another employee discovered a digital recorder that had been attached to the underside of a coffee table.
A manager admitted she hid the recorder in the room on the night in question with the intention of recording the conversations of Morgan and a few other employees. She said this was necessary in order to further investigate allegations of wrongdoing by Morgan and other employees.
Morgan and two other employees filed a formal written complaint under PIPEDA on April 4, 2003. The next day she was fired due to a conflict between her and the manager.
Upon concluding its investigation into Morgan’s complaint, the privacy commissioner told her on April 12, 2004, that although it disapproved of the actions taken by Alta Flights in seeking to make the recording, there was no collection of any personal information since no recording had actually been made of the break room conversation. Consequently, there was no violation of PIPEDA and the commissioner ruled the complaint was not well-founded.
Morgan argued the privacy commissioner erred in ruling against her complaint. The recorder was working, and the manager’s voice could be heard on it saying “test, test test.”
There was a possibility that in trying to play the recording, the employees might have inadvertently erased it, she said. Morgan argued that since the recorder was tested and clearly working, it should be assumed that a recording was successfully made and that personal information was discussed and recorded before it was discovered.
Alta Flights argued the privacy commissioner was correct in ruling PIPEDA only provides for remedies following the unauthorized collection, use and disclosure of personal information and there is no authority in PIPEDA or case law to create “attempts” to violate PIPEDA’s provisions as a separate breach of the act.
The Federal Court said there was no dispute that if Alta Flights had successfully recorded its employees’ conversations, there would be a violation of PIPEDA.
But the evidence did not back up that claim. The court said it could not agree with Morgan’s submission that since a test was done on the recording device before it was installed that it was logical to assume more information was registered by the recorder.
The court said the only conclusion it could make based on the evidence was that no conversation was recorded and thus no personal information collected.
There is no provision in PIPEDA stating that the attempted collection of personal information constitutes a violation of the act. The actions contemplated by the act are those involving the actual collection, use and disclosure of information.
Justice Camilien Nöel said Morgan’s frustration at the lack of a remedy under PIPEDA is understandable.
“But until Parliament indicates otherwise, one cannot take so liberal an approach to the interpretation of PIPEDA so as to change its fundamental shape and remedies,” said Justice Nöel.
The court said Morgan might have other remedies, such as pursuing a claim under s. 184 of the Criminal Code. That section states that:
“Every one who, by means of any electromagnetic, acoustic, mechanical or other device, wilfully intercepts a private communication is guilty of an indictable offence and liable to imprisonment for a term not exceeding five years.”
The Criminal Code allows for damages of up to $5,000 for anyone convicted under s. 184.
For more information see:
• Morgan v. Alta Flights (Charters) Inc., 2005 CarswellNat 798, 2005 FC 421 (F.C.)
How privacy disputes are handled
When the Office of the Privacy Commissioner receives a complaint, it conducts an investigation and issues a formal finding that concludes the complaint is well-founded, not well-founded or resolved.
A formal finding gives the complainant the right to go to Federal Court. But most complaints don’t head down that path.
Most complainants just want the matter rectified. Often the complaint is the result of a miscommunication between the complainant and the organization, and the privacy commissioner works with each side to clarify the issue. In other instances, the organization is not fully in compliance with PIPEDA. In those cases, the commissioner works with the organization to ensure it is adhering to the law.
Where a formal finding has been issued, the privacy commissioner brings this to the attention of the organization and a prompt resolution is frequently the result.
Recent decision by the privacy commissioner
An employee at the Canadian Food Inspection Agency (CFIA) working at a federally registered meat processing plant complained the plant was collecting his personal information by way of video cameras without his consent, and had disclosed it to his employer in an attempt to undermine his work and the work of other federal inspectors.
The company installed video cameras in 2001. There are 15 cameras at the plant, located at entry and exit points, and in all areas of the plant, including the room where CFIA employees have their workstations.
The company said the cameras were used to address security concerns and to monitor hygiene, safety and product safety. The CFIA employee did not dispute the cameras could provide security, and did not take issue with their installation at entry and exit points for such a purpose.
When the CFIA employee asked about the cameras at the time of installation, he was told they would not be used to observe him.
But there were documented incidents where the company had disclosed information about him to CFIA managers to show them videotape footage of his workstation to support the company’s contention that he was overly zealous in his work.
The Office of the Privacy Commissioner focused on the camera used to monitor the CFIA employee’s workstation. The company cited product safety as the reason for installing that camera. But the commissioner said the company presented no information to back its claim that it was monitoring food safety.
The CFIA inspectors are responsible for food safety and quality assurance, and are on site whenever the production line is operating. The commissioner found it difficult to understand how having a camera in this area — a camera that could not provide a clear picture of animals — ensures product safety when the very people responsible for ensuring safety are in the room.
The commissioner concluded the complaint was well-founded. But because the incidents where the employer handed video evidence to CFIA managers happened before PIPEDA came into force on Jan. 1, 2004, and the company has not made any other attempts since that date to use the video in such a manner, it could not rule on the part of the complaint.
The commissioner recommended that the company remove the camera from the room where CFIA staff have their workstations.
For more information see:
• PIPEDA Case Summary #290 online at www.privcom.gc.ca.
