Privacy Commissioner of Canada says employer’s use of voice recognition software okay, case highlights growing connection between technology and privacy
As technology evolves, companies have access to new methods of improving productivity, efficiency and security. Each new technological development provides innovative ways for organizations to improve the way in which they conduct business.
But many of these new technologies, either deliberately or indirectly, intrude upon the privacy of the workers employed by those companies. This is something that must be kept in mind when deciding whether to use new technology and, if so, how to implement it.
A failure to respect employee privacy rights can result in a finding that the employer has breached applicable privacy legislation.
Trend toward privacy rights
In recent years there has been significant attention directed toward the privacy rights of individuals. Employees are one group for whom this is particularly important since their privacy rights are often at odds with the needs and goals of their employers.
Recent legislation seeks to achieve a balance between the often conflicting goals of employer privacy, on the one hand, and corporate security and efficiency on the other.
A recent decision by the Privacy Commissioner of Canada provides a good example of the principles to be applied when considering the imposition of new technology that affects the privacy of workers.
Voice identification controls access
In that case, the employer adopted a futuristic technology that uses the voice prints of workers in order to control access to various applications.
Employees would speak a specific set of digits, allowing the system to process the behavioural and physical characteristics of their manner of speaking. Subsequently, in order to gain access, the employee would have to speak into the system, at which time the software would compare their speech to the recorded information and determine whether there was a match.
In other words, the employees’ speech patterns replaced typed passwords. The employees complained the company was forcing them to consent to the collection of biometric information — their voice print.
By way of background, the commissioner noted the company held vast databases containing private customer information and that the protection of that information was of utmost importance. The company had determined that the voice password technology provided the highest level of security for this information and was also less expensive than traditional password-based systems.
The company also assured the commissioner that access to the voice database was highly restricted and there was no other use that could be made of the voice samples without the employee’s knowledge and participation.
Issues the commissioner considered
In considering whether the complaint was justified or not, the commissioner addressed several key issues, including:
•the purposes of the impugned measures;
•the existence of other methods to achieve the stated purposes;
•the relative efficiency of those other methods; and
•whether the loss of privacy was proportionate to the benefits.
When considering the purposes of measures such as the one in this case, the commissioner used the “reasonable person” test to determine their legitimacy. The company in this case put forward three reasons for the new technology: security, efficiency, and cost-effectiveness.
Generally the purpose was seen as, “safeguarding the personal information of customers and meeting the expectation of customers that their data will be protected.”
The commissioner agreed with the reasonableness of this purpose and also agreed that the voice technology was more efficient and cost-effective than other methods of protecting the data.
With respect to proportionality, the commissioner found that although the voice print was an encroachment upon employee privacy rights, it did not reveal much about the individuals and could not be used for spying or other nefarious purposes. As a result, the commissioner found the use of the voice prints to be fairly benign. The complaint was deemed not to be well-founded.
Video surveillance
Contrast this decision with one recently reported in Canadian Employment Law Today. (“Privacy commissioner blasts video surveillance of employees,” page 3325, CELT #425, Nov. 10, 2004.)
In that case the company in question had installed surveillance cameras aimed at the sales and marketing staff and the technical support staff. The company advanced two purposes for the surveillance: to ensure security and to manage productivity.
On the first point the company stated that employees had accidentally set off alarms on a number of occasions, requiring the security company to call a manager who would then access a web camera image to confirm that it was a legitimate employee using the site.
The assistant commissioner noted the company did not place cameras at the main entrance to the building; the cameras were only focused on areas where people were working. The company also relied upon occasional allegations of theft and harassment on the part of employees, and stated there had been no such allegations since the cameras were installed.
On the productivity issue the company argued a need to monitor performance in order to identify problem employees. The assistant commissioner noted the company already monitored many aspects of performance using other technologies.
In analyzing the reasonableness of the stated purpose, the assistant commissioner noted that unauthorized entry to the building did not seem to be a primary issue since the company did not place cameras at the entrance or exit points. The assistant commissioner also felt the issue of accidentally triggering alarms could be dealt with in a less intrusive manner. Furthermore, the assistant commissioner was not satisfied that the alleged problems with theft and harassment were significant enough to warrant the intrusiveness of the surveillance cameras. As a result she determined a reasonable person would not have considered security to be an appropriate purpose in the circumstances.
On the productivity issue, the assistant commissioner noted the other tools already in place, the company’s apparent reluctance to consider alternative options aside from the surveillance cameras and the fact that it was inappropriate to intrude upon the privacy of all employees simply because a few posed problems for management. She found that, in this case, the necessary balance between the purpose being pursued and the infringement of privacy rights did not exist and said the complaint was well-founded.
For employers considering the implementation of new technology, they should bear in mind that the purpose and methodology may well be scrutinized if the technology will infringe upon the privacy of employees.
Employers should be prepared to justify the reasonableness of the purpose, and also show that less intrusive methods are not viable. Otherwise the initiative may be trumped by the employees’ privacy rights.
Stuart Rudner practices civil litigation and employment law with Miller Thomson LLP’s Toronto office. He can be reached at (416) 595-8672 or via email at [email protected].
But many of these new technologies, either deliberately or indirectly, intrude upon the privacy of the workers employed by those companies. This is something that must be kept in mind when deciding whether to use new technology and, if so, how to implement it.
A failure to respect employee privacy rights can result in a finding that the employer has breached applicable privacy legislation.
Trend toward privacy rights
In recent years there has been significant attention directed toward the privacy rights of individuals. Employees are one group for whom this is particularly important since their privacy rights are often at odds with the needs and goals of their employers.
Recent legislation seeks to achieve a balance between the often conflicting goals of employer privacy, on the one hand, and corporate security and efficiency on the other.
A recent decision by the Privacy Commissioner of Canada provides a good example of the principles to be applied when considering the imposition of new technology that affects the privacy of workers.
Voice identification controls access
In that case, the employer adopted a futuristic technology that uses the voice prints of workers in order to control access to various applications.
Employees would speak a specific set of digits, allowing the system to process the behavioural and physical characteristics of their manner of speaking. Subsequently, in order to gain access, the employee would have to speak into the system, at which time the software would compare their speech to the recorded information and determine whether there was a match.
In other words, the employees’ speech patterns replaced typed passwords. The employees complained the company was forcing them to consent to the collection of biometric information — their voice print.
By way of background, the commissioner noted the company held vast databases containing private customer information and that the protection of that information was of utmost importance. The company had determined that the voice password technology provided the highest level of security for this information and was also less expensive than traditional password-based systems.
The company also assured the commissioner that access to the voice database was highly restricted and there was no other use that could be made of the voice samples without the employee’s knowledge and participation.
Issues the commissioner considered
In considering whether the complaint was justified or not, the commissioner addressed several key issues, including:
•the purposes of the impugned measures;
•the existence of other methods to achieve the stated purposes;
•the relative efficiency of those other methods; and
•whether the loss of privacy was proportionate to the benefits.
When considering the purposes of measures such as the one in this case, the commissioner used the “reasonable person” test to determine their legitimacy. The company in this case put forward three reasons for the new technology: security, efficiency, and cost-effectiveness.
Generally the purpose was seen as, “safeguarding the personal information of customers and meeting the expectation of customers that their data will be protected.”
The commissioner agreed with the reasonableness of this purpose and also agreed that the voice technology was more efficient and cost-effective than other methods of protecting the data.
With respect to proportionality, the commissioner found that although the voice print was an encroachment upon employee privacy rights, it did not reveal much about the individuals and could not be used for spying or other nefarious purposes. As a result, the commissioner found the use of the voice prints to be fairly benign. The complaint was deemed not to be well-founded.
Video surveillance
Contrast this decision with one recently reported in Canadian Employment Law Today. (“Privacy commissioner blasts video surveillance of employees,” page 3325, CELT #425, Nov. 10, 2004.)
In that case the company in question had installed surveillance cameras aimed at the sales and marketing staff and the technical support staff. The company advanced two purposes for the surveillance: to ensure security and to manage productivity.
On the first point the company stated that employees had accidentally set off alarms on a number of occasions, requiring the security company to call a manager who would then access a web camera image to confirm that it was a legitimate employee using the site.
The assistant commissioner noted the company did not place cameras at the main entrance to the building; the cameras were only focused on areas where people were working. The company also relied upon occasional allegations of theft and harassment on the part of employees, and stated there had been no such allegations since the cameras were installed.
On the productivity issue the company argued a need to monitor performance in order to identify problem employees. The assistant commissioner noted the company already monitored many aspects of performance using other technologies.
In analyzing the reasonableness of the stated purpose, the assistant commissioner noted that unauthorized entry to the building did not seem to be a primary issue since the company did not place cameras at the entrance or exit points. The assistant commissioner also felt the issue of accidentally triggering alarms could be dealt with in a less intrusive manner. Furthermore, the assistant commissioner was not satisfied that the alleged problems with theft and harassment were significant enough to warrant the intrusiveness of the surveillance cameras. As a result she determined a reasonable person would not have considered security to be an appropriate purpose in the circumstances.
On the productivity issue, the assistant commissioner noted the other tools already in place, the company’s apparent reluctance to consider alternative options aside from the surveillance cameras and the fact that it was inappropriate to intrude upon the privacy of all employees simply because a few posed problems for management. She found that, in this case, the necessary balance between the purpose being pursued and the infringement of privacy rights did not exist and said the complaint was well-founded.
For employers considering the implementation of new technology, they should bear in mind that the purpose and methodology may well be scrutinized if the technology will infringe upon the privacy of employees.
Employers should be prepared to justify the reasonableness of the purpose, and also show that less intrusive methods are not viable. Otherwise the initiative may be trumped by the employees’ privacy rights.
Stuart Rudner practices civil litigation and employment law with Miller Thomson LLP’s Toronto office. He can be reached at (416) 595-8672 or via email at [email protected].
