While Canadian employers have some leeway in using technology to keep tabs on workers in certain circumstances, national and provincial privacy laws set limits on how and when they may go about it, according to legal experts.
"This is a particularly compelling and timely issue, especially since there are so many people working remotely now and that is likely to continue," said Stuart Rudner, an attorney with Rudner Law in Ontario.
Canadian news media reported recently about a school janitor in Alberta who refused last fall to download a mobile app that would help her employer confirm workers were on the job where and when scheduled. She was fired weeks later.
The boss at the cleaning company had told employees to download the app to their personal mobile phones; the employee, concerned over her privacy and personal-data security, lost her job after refusing, although the boss said the refusal wasn't the only reason, the CBC reported.
Balancing of Rights
"The issue involves a balancing of rights. Specifically, employers have the right to manage their workforce and to ensure that workers are doing what they are supposed to. Conversely, employees have privacy rights that are based on a combination of legislation and common law," Rudner said.
Canada's privacy laws, however, generate some confusion, he said. The national law for private-sector businesses, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies only to a limited portion of the population, while three provinces have their own privacy laws, Rudner noted. In addition, the federal government is working on legislation to give citizens more control over the way companies manage their personal data, he said.
Among other features, PIPEDA's fair information principles require individual consent for data collection and use, with some exceptions: It limits data collection to the purpose the company has identified, and it limits the use, disclosure and retention of the data, according to Canada's Office of the Privacy Commissioner.
Most Canadian privacy statutes contain an overriding "reasonableness standard" that requires employers to have a legitimate purpose and to limit the data collected, according to Suzanne Kennedy, an attorney with Harris & Co. in Vancouver, British Columbia.
"It's not necessarily unreasonable or contrary to privacy laws to ask employees to carry devices that would allow employers to track their location," but the onus is on employers to show why use of the technology is necessary and reasonable, she said.
If there's a less invasive way to achieve the same goal, it's harder to justify the tracking technology, she explained. In addition, Kennedy said, it can make a difference if employees are asked to use their own devices rather than their employer's.
Under Alberta's 2003 Personal Information Protection Act, a private-sector employer may collect and use personal employee data without consent if it's reasonable and for certain limited purposes—but must give current employees reasonable notice and disclose the reasons.
Employers may have compelling reasons to monitor employees, Kennedy noted. If an employee is out in the community all day, for example, it might be valuable for both employer and worker to have tracking in place for safety reasons, she explained.
"Employers have to be quite careful. There are so many technologies out there that allow us to monitor what employees are doing in the workplace. They're cheap, and they're easy to use," Kennedy said.
Context Counts
Canadian case law makes clear, though, that an employer that "willy nilly" collects information on employees will run afoul of privacy laws, according to Kennedy. If an employer simply adopts a new technology and collects information without a careful analysis of what the organization really needs, she added, "that's probably something that the regulators would be quite interested in looking at from a privacy perspective."
Most if not all privacy laws in Canada operate from principles requiring that tracking have a legitimate purpose—for safety, for example, or to effectively supervise and dispatch employees to outside jobs—that it not be overly invasive, and that it be clear how the data is protected, Kennedy said.
Under British Columbia's Personal Information Protection Act, which covers more than 380,000 private-sector organizations, data gathered on an employee's location and behavior is considered personal information, no matter who owns the device, according to a 2017 guidance document from the province's Office of the Information & Privacy Commissioner (OIPC).
"Certain circumstances may allow the use of GPS to map employee travel routes, manage hours of work, and ensure that employees drive safely and lawfully. These may require the knowledge and consent of the employee prior to their implementation and use," the document says. "Orders from this office have determined that in most instances BC [British Columbia] privacy laws do not allow continuous, real-time monitoring of employees outside of work hours by GPS tracking. Such pervasive tracking would most likely be considered excessive and invasive."
Context matters, though, the British Columbia OIPC wrote, citing a case in which an elevator company was allowed to use GPS and engine status data systems to monitor employee location and behavior during work hours because the employer aimed to ensure worker safety and enable client billing. In this case, employees were dispatched from home and rarely worked at the employer's property.
The monitoring wouldn't have been allowed if the elevator company was using the technology to collect data on employees' personal time, continuously, covertly or for other purposes, the OIPC wrote.
Dinah Wisenberg Brin is a freelance writer based in Philadelphia.