Foreman had no business accessing employee’s disability claim in relation to medical absence and discussing it with other employee
A recent decision dealing with the collection, use and disclosure of employees’ personal information provides a noteworthy lesson for employers when managing sensitive employee medical information.
In a December 2013 decision of the Alberta Information and Privacy Commissioner, an employee made a complaint under Alberta’s privacy legislation, the Personal Information Protection Act (PIPA), alleging that her personal employee information had been improperly collected, used and disclosed by her employer.
The alleged incident occurred while the employee was on medical leave. A foreman called the employee to inquire about her absence from work and her possible date of return. In the discussion, the foreman indicated he had read the employee’s personnel file, which contained a letter from her insurance provider denying her disability claim. The foreman also discussed the employee’s condition with a co-worker who was a friend of the employee. In that discussion, he disclosed that the employee’s disability claim had been denied.
The employee brought a complaint to the Information and Privacy Commissioner, in which she complained the foreman should not have had access to her disability claim information and the foreman should not have disclosed that information to another employee.
As the employer did not make any submissions, the adjudicator relied on the employee’s evidence. The adjudicator found that as the information in question related to the employee’s medical leave and disability benefits, this met the definition of personal employee information under PIPA. While an employer in Alberta is permitted to collect, use and disclose personal employee information for the purpose of establishing, maintaining or terminating the employment relationship, in this case no evidence was shown to demonstrate that the employer had the employee’s consent to collect her personal employee information. Moreover, in examining the actions of the foreman, the adjudicator concluded it was not reasonable that the foreman had access to the letter denying disability coverage, nor was it reasonable that he disclosed the status of the employee’s disability claim to another employee. While the adjudicator speculated that it may have been possible that the employee signed a consent form when she signed up for her insurance plan that gave her employer the authority to collect, use and disclose personal information, as the employer led no evidence, the adjudicator concluded this was not the case.
This decision is significant not only for delineating the consent and disclosure requirements around employee medical information in Alberta, but for privacy legislation in other Canadian jurisdictions such as Quebec and British Columbia.
For more information see:
• Alberta Office of the Information and Privacy Commissioner Order #P2013-08 (Dec. 17, 2013) A. Swanek — Adj. (Alta. OIPC).
