Volume V

Issue : 2: January 25, 2007

• HP Settles Lawsuits by Lexmark for Breach of Non Compete
• Defamation and Breach of Fiduciary Duty
• Airline Improperly Declines Access Request In Contemplation of Litigation
• B.C. Privacy Decision Considers Employee Personal Information
• Default Judgment Issued Against Daughter of Famous Music Downloading Defendant
• Google Heads to the Mall but Not to Shop
• Ontario Company Fires Employees for Internet Posting
• U.S. Court Issues Decision on Use of a Competitors Trade marks in Online Advertising

Home > Volume V > Issue 2: January 25, 2007 > B.C. Privacy Decision Considers Employee Personal Information

B.C. Privacy Decision Considers Employee Personal Information

The Information and Privacy Commissioner of British Columbia issued a decision in late 2006 addressing various issues relating to employee personal information.

British Columbia’s Personal Information Protection Act (“PIPA”) creates a specific category of personal information relating to employees: employee personal information means “personal information about an individual that is collected, used or disclosed solely for the purposes reasonably required to establish, manage or terminate an employment relationship between the organization and that individual, but does not include personal information that is not about an individual’s employment”.

In this particular case, the complainants had several complaints regarding the collection, use and disclosure of their personal information by their employer, a condominium corporation. The specific issues considered by the Privacy Commissioner included:

• Customer Complaints. The employer would occasionally receive verbal complaints about the performance of particular employees. In those situations, the employer would ask that the complaints be put in writing, and would include the written complaints in the relevant employees’ files. The employer did not solicit complaints from customers. The employees argued that the employer had not informed them that it would be collecting, using or disclosing such complaints.

The Privacy Commissioner held that the complaints definitely constituted “employee personal information” and that the information was collected for the purposes of the employment relationship. The key issue was whether such collection was “reasonably required” for the purposes of that relationship; where an organization’s employees’ duties involve interacting with customers or clients of the organization, can the organization receive complaints or commendations about the job performance of individual employees? The Commissioner concluded that in this case PIPA authorized the employer to collect and use information that it received about its employees’ job performance without its employees’ consent.

• Disclosure of Personal Information. The employees complained that their employer inappropriately disclosed their personal information in the minutes of board meetings. The Commissioner pointed out that it is one thing for board minutes to contain personal information which the directors have a reasonable need to know, and another for those minutes to be made available to residents and others. This second sort of disclosure can certainly violate PIPA. In this case, some of the meeting minutes disclosed personal information that did not qualify as “employee personal information”. The employer acknowledged that it was trying to remedy this practice, and the Commissioner suggested that personal information should be discussed in private, with minutes of the private discussions not being made generally available.

• Reasonable Security. PIPA requires organizations to make “reasonable security arrangements” to prevent unauthorized access, collection, use, disclosure, copying, modification, etc., of personal information. The employees complained that their personal information was kept in an unlocked filing cabinet in a room which was not always locked. The employer maintained that the room was always locked. The Commissioner stated that it was not reasonable to place personal information in an unlocked cabinet in a room with ready access to any number of individuals, regardless of whether the room was locked. The organization had therefore not met the reasonable security standard required by PIPA.

The Privacy Commissioner considered each of the complaints and decided that even though the employer had not complied with PIPA in all respects, it was making ongoing efforts to comply and therefore no legitimate purpose would be served by making any orders against the employer.

For a copy of the decision, visit:

http://www.oipc.bc.ca/PIPAOrders/2006/OrderP06-06.pdf