Finding the Right Workplace Privacy Balance

1. Finding the Right Workplace Privacy Balance Presentation Created by: Laura Burns CAW Local 4212 November 30, 2006Toronto, Ontario Address by Jennifer StoddartPrivacy Commissioner of Canada

2. Introduction • Research has made a considerable contribution to the ongoing debate about balancing the business concerns of employers and the privacy rights of employees. • One of its central messages is that employers have to start thinking more about workplace privacy and the potential implications of emerging surveillance technologies. • As a society, we are still struggling with the privacy implications of now-common technologies such as video surveillance – never mind the next generation of high-tech ways to monitor workers. • This Presentation is about finding the right balance in workplace privacy – and the key role of the Office of the Privacy Commissioner. • We believe workplace privacy principles must respect both the need of employers to know what workers are up to on company time, as well as the basic human right to privacy.

3. History • Workplace surveillance, of course, is nothing new. • What is new in workplace privacy are the ever-more intrusive technologies that allow bosses to track even the smallest movements of their workers. • Suspicious bosses no longer have to tail delivery workers – Global Positioning Systems can relay back to the office a truck’s every turn and stop. • Cell phones and high-tech ID cards can also be used to monitor workers’ movements. • One American company has actually implanted the bodies of its workers with Radio Frequency Identification tags (RFIDs). • The working world of the future could be a very scary place if we don’t hold the line on increasingly pervasive monitoring.

4. Searching for Balance • But – contrary to what SLSMC seems to believe – workers do not check their privacy rights at the Structure or Office door. • Workplace privacy is an important part of the basic autonomy rights of individuals in our society. • What happens in the workplace – including whether privacy is respected – can have a profound effect on employees’ sense of dignity, their sense of freedom, and their sense of autonomy. Continual surveillance is dehumanizing. It does not help create an enthusiastic workforce. And I wouldn’t even be surprised if it affects productivity in a negative way.

5. Some Surveillance Required • Of course, some surveillance in the workplace is required – and is acceptable. Employers have the right to know whether workers are doing the job they are paid to do. • Still, employers must find ways of weeding out the bad employees without shattering the dignity and privacy rights of the good employees – who make up the vast majority of the workforce. • Privacy remains a factor – even on company-owned property, on company-owned computers and in company-owned vehicles. • There is a line to be drawn when it comes to surveillance – and where this line is drawn cannot simply be dictated by whatever the latest technology can offer. • Just because we can put workers under extreme surveillance does not mean we should.

6. How OPC Strikes a Balance • The Office of the Privacy Commissioner is increasingly concerned about human dignity in the context of surveillance. • They have told employers covered by the laws we enforce that they cannot indiscriminately point video cameras at their workforce simply to keep tabs on what everyone is up to – what I call management by video camera. • In other areas, however, I see Canada adopting a more U.S.-style approach. Companies can look at what we’re doing on the Internet – if they tell us – because we are surfing on company time and with company equipment and energy. I think there is a qualitative difference between video surveillance and GPS in a vehicle. The information collected by a video camera is far more intimate. When a video camera is pointed at you, you can’t even pause to scratch your nose without that information being collected. GPS can’t do that.

7. “There’s No Privacy Here.” • As well, I don’t think it is necessary to have a knee-jerk negative reaction to any new technology that involves personal information. OPC has found that a phone authentication system involving a biometric – a voiceprint – was acceptable in that context. In findings released November 2006, OPC approved, with certain provisos, a company’s use of GPS in its fleet vehicles. • That said, employers cannot take away rights simply by posting a sign at their entrances warning everyone who enters: “There’s no privacy here.”

8. PIPEDA and Workplace Privacy • Canada’s private-sector privacy law, the Personal Information Protection and Electronic Documents Act, or PIPEDA, protects the information of employees working for companies operating in federally regulated sectors. These include telecommunications, broadcasting, inter-provincial transportation, aviation, banking, nuclear energy, maritime navigation and shipping. • Employers in the covered sectors must respect a set of widely accepted privacy principles.

9. Privacy PrinciplesBasically, these require the following: • Organizations must – except in a few limited circumstances – have an employee’s consent before collecting, using or disclosing personal information. • They can only use or disclose employees’ personal information for the purposes for which consent was given at the time the information was collected. • Even with consent, organizations must limit collection, use and disclosure of personal information to purposes that a reasonable person would consider appropriate in the circumstances. This is often the key issue we consider in our investigations related to workplace surveillance. • Finally, PIPEDA offers employees the right to see the personal information that their employer holds about them, and to correct any inaccuracies.

10. OPC Workplace Privacy Investigations • PIPEDA has been in full force for almost six years. Investigating a number of workplace-related complaints. • Many come from workers who have had difficulty accessing their personal information. • Other complaints have dealt with surveillance of one kind or another – from audio and videotaping to more advanced technologies such as biometrics and Global Positioning Systems. • Most of the workplace surveillance cases have involved video cameras.

11. Video Surveillance • One of those investigations involved an Internet service provider that had pointed web cameras at its workers. Among the company’s chief concerns was that staff working on the weekend – when it didn’t want to pay supervisors to come in – were leaving phones unattended and taking too many breaks. We found there were less privacy intrusive ways to address the company’s concerns. • Companies thinking about installing video cameras or other surveillance measures in the workplace should consider the four-part test OPC generally uses: • Is the monitoring demonstrably necessary to meet a specific need? • Is it likely to be effective in meeting that need? • Is the loss of privacy proportional to the benefit gained? • Is there a less privacy-intrusive way of achieving the same end?

12. Employer Attitudes • OPC was disappointed by some of the employer attitudes reflected in Under the Radar? Some apparently see workplace privacy as a privilege granted to employees. No one agrees with the notion that workers are entitled to some measure of privacy that cannot be taken away. This is deeply concerning to a privacy advocate. • Perhaps those employers need to ask themselves some questions. How would you like to have cameras in the executive washroom? How would you feel if a video camera were pointed at your desk all day long? • Employers apparently think privacy is a non-issue and that their employees are not concerned about it. This is not our experience.

13. “Common Sense” • I would also like to address comments in the report from employers who believe privacy is a matter of “common sense” and therefore no policies are necessary. Common sense is clearly not enough. • Investigators from OPC have encountered employers who believe they have an unfettered right to monitor everything an employee does on company time. • The current trend is more monitoring, not less. “Common sense” does not tell us where to draw the line. • Surveys also suggest there is sometimes a gap between what employers and employees think is an acceptable privacy practice. 

14. Human Resource Survey • A survey by the U.S.-based Society for Human Resource Management found 90 per cent of human-resources managers think organizations have the right to monitor employees’ computer and phone use, versus about 70 per cent of employees. • The vast majority of HR professionals – almost 90 per cent – believed organizations have the right to monitor Internet use, compared with about 60 per cent of employees. • Again, I come back to the issue: Where do we draw the line?

15. The Road Ahead There is no clear-cut answer to that question. • At a minimum, however, employers need to tell employees – very, very clearly – what will and will not be monitored. • Policies on privacy issues must be developed and given to employees. Tell people. You cannot assume people know anything about how they are – or are not – being watched. • And, when companies develop such policies, they should always look to the least privacy intrusive way of getting the information needed to run the business. • In the workplace, good privacy practice is not just about avoiding complaints, grievances, or lawsuits. • Fostering a workplace culture where privacy is talked about, valued and respected contributes to morale and mutual trust.

16. Privacy Right’s Protected under Law • We would like to see the privacy rights of every worker in Canada protected under law. • Unfortunately, federal-provincial jurisdictional issues make that impossible under PIPEDA. I hope the provinces which have not already passed workplace privacy legislation will turn their attention to this. • We need to be constantly vigilant. Privacy gets eroded bit by bit. I worry that one day employers will tell workers: You have a job; not privacy. • As Canada’s privacy guardian, OPC will continue trying to hold the line on the growing ability of employers to subject their workers to various forms of monitoring and surveillance.

17. The Bottom Line • Sometimes organizations – in a quest to be proactive – resort to technology in anticipation of problems or as a means to maintain competitiveness. The worker’s rights are slowly eroded by the cumulative effects of measures intended to meet the bottom line. • The effects on the dignity of employees of all the potentially privacy-intrusive measures in place must be considered in balancing the rights of the individual to privacy and the needs of organizations to collect, use or disclose personal information. • I hope I’ve given you some food for thought today about why you should also be fighting for the cause of maintaining the right of workers – the right of people – to privacy, even while on the job.