Medical Group Management Association of Canada

1. Medical Group Management Association of Canada Employment Developments in the Digital Age • Presented by: • Darcie C. Yale dyale@darcydeacon.com • Michael Merner mmerner@darcydeacon.com • www.darcydeacon.com

2. Introduction • The workplace is an ever evolving landscape. • Rapid advances in technology have added complexity in balancing employee rights in the workplace. • New technologies have changed the way we work. • They have also changed the way we may want to monitor our employees. • This has resulted in a tension between the right of the employer to require accountability at work and the employee’s right to privacy. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

3. Introduction • It is to important to have an understanding of the privacy rights that an employee is entitled to expect. • And how those rights impact the employer’s ability to manage the workplace. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

4. The Employee’s Right to Privacy • There are federal and provincial privacy rights. • Broadly speaking, they limit the manner in which personal information from an individual can be collected, the steps that are to be taken to protect against unauthorized use and disclosure of that information. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

5. Use of Information • An employer may only collect as much personal information as is reasonably necessary to accomplish the purpose for which it is collected. • The individual who is the subject of the information must be informed about the collection of the information. • The information collected can only be used for the purpose it is collected. • The information can only be disclosed to those who need to know the information. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

6. Tort of Privacy • Individuals also have a common law right to privacy and indeed a right to sue if their privacy has been breached. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

7. Tort of Privacy • Jones v. Tsige 2012 ONCA 32 • The defendant employee committed an “intrusion upon seclusion” when she: • Engaged in intentional or reckless conduct; • That invaded without lawful justification the plaintiff’s private affairs or concerns (in this case, banking records); • That a reasonable person would regard as highly offensive; causing distress, humiliation or anguish. • Damages of $10,000.00 were awarded. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

8. Privacy Legislation • Canada has two federal privacy laws: • The Privacy Act - which covers personal information handling of federal government departments and agencies; and • Personal Information Protection and Electronic Documents Act (“PIPEDA”) – which is ground rules for how private sector organizations collect, use and disclose personal information. PIPEDA does not apply to an organization within a province that has substantially similar legislation (Ab, BC, Que) and in terms of employee information, PIPEDA only applies to federally regulated organizations. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

9. Privacy Legislation • Many jurisdictions in Canada also have health sector provincial privacy legislation. • Alberta, Saskatchewan, Ontario, New Brunswick, Newfoundland and Labrador have privacy legislation that applies to health information. • Other jurisdictions • Personal privacy rights are also co-defined in British Columbia, Saskatchewan, Manitoba and Newfoundland and Labrador. • These acts establish a limited right of action where liability can be found if the dependent acts willfully (not a requirement in Manitoba) and without claim of right to breach another’s reasonable expectation of privacy. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

10. Balancing Competing Rights • People expect to enjoy some degree of privacy at work. • At the same time, employees should recognize that working for someone means giving up some degree of privacy. • An employee’s right to privacy is not absolute. • The work and time paid for will be evaluated and monitored in a reasonable way. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

11. Significant Cases: • 2 key cases: • Jones v. Tsige • R v. Cole Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

12. Jones v. Tsige • Sandra, a bank employee discovered Winnie (also a bank employee) was looking at her banking records. The two did not know each other, even though they worked at the same bank (BMO). Winnie looked at Sandra’s records at least 174 times over 4 years. Winnie was living with Sandra’s ex-husband. Winnie did not do anything with the information. She said she was looking at it because she had a dispute with Sandra’s ex over whether he was paying child support. This did not line up with the number of times and frequency of the access. The employer suspended Winnie for 1 week without pay and denied her a bonus. Sandra sued Winnie for invasion of privacy. Court awarded $10,000 without proof of damages. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

13. Outcome of Jones v. Tsige • Tort of intrusion of seclusion • Damages can be awarded without proof of loss Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

14. R v. Cole • Ontario High School teacher who was discovered to have pornographic material (including nude pictures of a grade 10 student) on the laptop computer issued by the school. • Pictures had been found and downloaded by the teacher in the course of monitoring the use of student computers connected to the school network. • School had a policy in place which allowed for personal use of computers but expressly provided that the user should not assume that files stored on network servers or hard drives of computers would be private. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

15. R v. Cole • Material was discovered by a technician during a routine virus scan and turned over to the school board who provided the information to the police. • The case concerned whether the police breached the teacher’s Charter rights by conducting an unreasonable search and seizure of the electronic files when they searched the laptop. • Remarks that will have significant impact for privacy rights in the workplace. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

16. Outcomes of R v. Cole • Employees have a reasonable expectation of privacy with regard to the personal information contained on workplace computers where personal use is permitted or expected. • Ownership of the computer is only one factor to consider in determining the privacy rights. • The existence of an employer policy and/or practice regarding the entitlement to privacy is only one factor. • The scope of an employee’s expectation of privacy depends on the totality of the circumstances. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

17. Monitoring Options • Employee’s email • Internet • Tracking of employees through the use of GPS or other telematic devices • Network forensic software • Video • Iris or hand scanners • Oral fluid swabs Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

18. Reasons to Monitor • There are a number of reasons why employers might monitor employees: • The need to ensure employees and customer safety (i.e. from attacks, robberies, violence, workplace injuries, etc.) • Protection of the employer’s confidential and proprietary information (the employer may wish to ensure its protected information is not being shared, copied or used improperly). • Workplace liability and investigations (criminal conduct and harassment). • Network and system performance (to protect against viruses, improper downloads, excessive internet use, etc.) • Employee productivity (how much time is being lost to non-work related computer use). Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

19. Striking the Balance • An employer’s need for information should be balanced with an employee’s right to privacy. Follow these basic rules: • The employer should say what personal information it collects from employees, why it collects it, and what it does with it. • Collection, use or disclosure of personal information should normally be done only with an employee’s knowledge and consent. • The employer should only collect personal information that is necessary for its stated purpose, and collect it in a fair manner and by lawful means. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

20. Striking the Balance • The employer should normally use or disclose personal information only for the purposes that it collected it for, and keep it only as long as it is needed. • Employees’ personal information needs to be accurate, complete and up-to-date. • Employees should be able to access their personal information. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

21. Computer Surveillance • How much time an employee spends productively and how much time is lost to web surfing, emailing, Facebooking and other non-productive online activities are issues that are faced by most employers. • A number of cases provide guidance on how closely an employer can monitor its employee’s online conduct. • Lethbridge College Faculty Association v. Lethbridge College (Bird Grievance)2007 CanLII (A.B. G.A.A.) – employees have “some expectation of privacy in the receipt and transmission of emails from an internet provider that is not their employer’s “but are accessed from an employer owned computer”. • Calgary Police Service (re) (Alberta Information and Privacy Commissioner) Order F2012-07. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

22. Computer Surveillance • Surreptitious monitoring of employee’s computer use at work included any forms of electronic monitoring such as computer “keystroke” logging and “spyware” tracked and revealed detailed information with respect to the computer user’s internet activity violated the privacy rights of employees. Order F07-18-re University of British Columbia (British Columbia Information and Privacy Commissioner). • A detailed audit of an employee’s internet use which provided a full record of every website that the employee had visited concluded that the employer was justified in the investigation of time theft and had not violated provincial privacy legislation. (Health Sciences Association of British Columbia v. Fraser Health Authority (Surrey Memorial Hospital), [2011] B.C.C.A.A.A. No.60 (QL) (Glass)) Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

23. Computer Surveillance • Technology creates “real limits on the privacy and security of an email message… Email users ought to know that when they put sensitive or offensive material into cyberspace, they can never know where the message may ultimately come to rest.” (Naylor Publications Co. (Canada) v. Media Union of Manitoba Local 191 [2003] MGAD No. 21 (Peltz)). Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

24. Computer Surveillance • This area of the law is developing quickly, it appears from the trends of recent cases that the following principles apply: • Employees do not have an absolute expectation of privacy of their online conduct when at work, and when using the employer’s equipment. • Employers should have in place clear policies which provide that the employee should not expect privacy in their online activities on workplace computers. • Employers should consider other less intrusive means of managing employment conduct, if possible, before examining an employee’s browser history or electronic communications. • If an employer determines there is a clear need to examine an employee’s computer use, the employer should only examine that use to the extent necessary to address the concern (ie. if the allegation is sending and receiving of emails, the employer needs only to identify the excessive emails and not review their content). Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

25. Social Media Comments • Generally, what an employee does on his or her time is his or her own business. • However, Facebook status updates, twitter tweets and blog posts are now becoming an issue when statements made relate back to the workplace. • Employers are entitled to discipline employees for off duty conduct when it has an impact on the workplace or the employment relationship. • The employee may be required to respond to issues such as engage in workplace discrimination, bullying or harassment. • Employers must also be alert to other activities, for example, an employee divulging confidential information about the employer, customers or clients, suppliers or other employees. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

26. Social Media • Employers are encouraged to develop social media policies and to communicate these policies to their employees. • They should be consistent in the enforcement of these policies. • Employers also need to ensure that employees understand the policies. • Employees should be warned against: • disclosing confidential information; • making negative comments about co-workers or the workplace; • engaging in harassing conduct or anything that can damage the employer’s reputation. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

27. Social Media • The types of things employees have said and done online stretches the imagination. • Employers are encouraged to evaluate such behavior against the five fold test developed in the case of Oil, Chemical and Atomic Workers International Union, Local 9-670 v. Melhaven Fibers Ltd. [1967] O.L.A.A. No. 4 (Anderson) under which an employer seeking to justify discipline or discharge must show that: • The conduct of the employee harm has the employer’s reputation or product; • The employee’s behavior renders him unable to perform his duty satisfactorily; Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

28. Social Media • The employee’s behavior leads to refusal, reluctance or inability of other employees to work with him; • The employee has been guilty of a serious breach of the Criminal Code thus rendering his or her conduct injurious to the general reputation of the employer and its employees; or • The employee’s conduct places difficulty in the way the employer properly carries out its functions efficiently managing its workplace and efficiently directs its workforce. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

29. Use of Global Positioning Devices • There are bona fide reasons why employers implement monitoring by utilizing GPS technologies including: • Increasing productivity; • Saving time and expenses; • Minimizing downtime; • Optimizing resource utilization; • Reducing mileage and hours worked; • Securing mobile assets; • Reducing mileage costs. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

30. Use of Global Positioning Devices • Otis Canada Inc. v. International Union of Elevator Constructors, Local 1 (Telematics Device Grievance)[2010] B.C.A.A.A. n. O121 • The employer used a vehicle data recording device on its vehicles to monitor use and performance following a policy grievance filed by the union. • The employer had installed devices on its vehicles and then met with its employees and union to advise that telematic devices would be utilized and that employees may be disciplined for time theft and improper use of company vehicles with information collected from the devices. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

31. Use of Global Positioning Devices • The employer was entitled both to use the devices and to discipline based on information collected from the devices. The following principles were used: • An employer can, pursuant to its general management rights, implement methods for recording the working time of employees; • The ability of an employer to collect information about company vehicles is also a natural function of management; • Privacy concerns by employees and the rights of management must always be considered in the context of the applicable collective agreement as well as any applicable legislation; • Within the context of a collective agreement, provisions such as management rights, duty to act fairly and technological change must be considered; • The purpose of the technology will be considered to determine if it is reasonable to introduce the technology into the workplace. • Introduction of the devices in this case were aimed at improving the efficiency of the employer’s fleet and to determine if employees were using the vehicles for personal use. The monitoring did not offend the applicable privacy provisions, was not unreasonable, nor did it offend any provision of the collective agreement. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

32. Use of Global Positioning Devices • If employers intend to utilize information collected through the use of GPS technologies, they are recommended to adopt the following process: • Disclose (and document) the disclosure to employees and their union(s) that GPS devices have been installed/will be installed on employer owned vehicles; • Identify (and document) how GPS devices will be utilized; • Implement a clearly worded policy regarding the use of GPS devices in the workplace; • Remind employees charged with receiving and reviewing the information from the GPS devices only to disclose such information on a need to know basis and not to inquire into employees’ activities for any non-work related purposes. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

33. Video Surveillance • Video surveillance is common place nowadays. • Generally divided into two main types: Overt surveillance and covert surveillance. • The greater the degree of intrusiveness of the surveillance undertaken, the higher the threshold will be to justify the monitoring. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

34. Visible Cameras • Overt stationary cameras recording activities in the workplace. • National Automobile, Aerospace, Transportation and General Workers Union of Canada Local 3003 v. NewFlyer Industries Limited [2011] MGAD No. 27 QL (the New Flyer case), Arbitrator Peltz. • Argument was advanced by the union that it was unreasonable exercise of management rights to use overt fixed video cameras to monitor employees in its paint shop and corrosion shop. • Arbitrator held that the use of the fixed stationary cameras was a reasonable exercise of the employer’s management rights. • Use was permissible in accordance with the employer’s rights to protect its property and ensure security in the workplace. • Use was rationally directed at safety objectives. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

35. Visible Cameras • Eastmond v. Canadian Pacific Railway 2004 FC 852 • Cameras were fixed, did not zoom and only recorded 48 hour periods. • The employees were informed of the existence of the system, its purpose and the camera locations. • Reasonableness of the surveillance must be determined contextually looking at the why, how, when and where collection takes place. • In the context of a clear history of vandalism, theft and other minor crimes in the rail yard, preventing it in the future was a reasonable purpose. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

36. Video Surveillance • The surveillance was effective at preventing vandalism, theft and security risks. • The loss of privacy was low, proportional to the benefit gained by the employer. • Images were reviewed only upon a reported incident, the information kept secure were only utilized in places where there was a low expectation of privacy. • Alternatives including fencing and security guards were not cost effective and would be disruptive. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

37. Surreptitious Surveillance • Arbitrators, courts and Privacy Commissioners treat surreptitious surveillance very differently then overt video surveillance. • Surveillance without consent is not allowed as a matter of right. • It may be considered reasonable for the purposes of an investigation, however pre-requisites must be established. • In considering the admissibility of covert surveillance, arbitrators and courts will often consider the reasonableness that surveillance. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

38. Surreptitious Surveillance • X v. Y (Z Grievance) [2002] B.C.C. A.A.A. No. 292 (B.C.C.A.A. Taylor) which held: • If an employee’s privacy is to be invaded, there must be a reasonable basis for so doing. • Determining whether an employee has a reasonable expectation of privacy in a given context is an inquiry which balances that interest with the employer’s interest in managing its business. • This assessment must be made in light of the circumstances. • The employer must establish that it has acted reasonably. In making that determination, one must ask: • Whether it was reasonable in all of the circumstances for the employer to conduct surveillance. • Was the surveillance conducted in a reasonable manner? • Where there are other reasonable alternative open to the employer to obtain the evidence it sought. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

39. Drug and Alcohol Testing • On duty, an employer can require an employee to abstain from alcohol and drug use. • Off duty, an employer is generally not allowed to tell an employee how they must behave. • This means that an employer cannot direct that an employee not drink when not at work (unless intoxication continues into on duty hours) nor prevent an employee from engaging in drug use (subject to the provision that it is not impacting the employer relationship, etc.) Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

40. Drug and Alcohol Testing • Alcohol testing is able to accurately determine an individual’s blood alcohol limit which evidence present levels of impairment. • Drug testing however, is only able to measure whether an individual has used drugs in the past. • It cannot accurately indicate when the drug use occurred and therefore, is not a reliable indicator of present impairment. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

41. Drug and Alcohol Testing • Employers must also be cautious of how they respond to positive tests. • If an employee is found to have a dependency, the employer may owe a duty to accommodate to allow the employee to obtain treatment. • The extent of that duty will depend on the particular circumstance of each case. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

42. Drug and Alcohol Testing • Generally, the following principles apply: • An employer is only entitled to implement drug and alcohol testing for safety sensitive positions; Safety sensitive positions are ones where an employee has a key or direct role in an operation where any actions or decisions they took, if not carried out properly, could result in serious injury, either to the employee’s health and the safety and health of other employees, customers, visitors, public or the environment. • The employer should only undertake testing in a post-incident situation or on reasonable suspicion. • An employer cannot have an automatic policy of termination but must assess each case to determine the appropriate response. • Positive Tests should be investigated to determine whether the employee has a dependency. Dependencies are considered a disability under Human Rights law and the employer has a duty to accommodate. This may mean treatment, case management and a return to work plan. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

43. Drug and Alcohol Testing • The Manitoba Human Rights Commission states that in order to avoid restricting employment opportunities in a manner that contravenes the Manitoba Human Rights Code, employers need to ensure that drug and alcohol workplace policies are: • Rationally connected to the performance of the job; • Adopted in an honest and good faith belief that they are necessary to the fulfillment of a legitimate work-related purpose; • Reasonably necessary to accomplish the legitimate work-related purpose. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

44. Top 5 Tips to Keep in Mind • Before Implementing any form of employee monitoring, consider: • Why is the employer considering monitoring – what is the specific problem that needs to be addressed? Are there other ways that are less intrusive on the individual’s privacy but still allow the employer to gather the required information? • What laws apply? Will the proposed form of monitoring have the potential of infringing any of the employee’s rights or expose the employer to any liability? Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

45. Top 5 Tips to Keep in Mind • Understand the technology you are proposing to use – if an employee is to be monitored, has the employer selected the least intrusive means of monitoring? Will the employer be capturing information about anyone else? How might their rights be imposed? Is the proposed technology reliable and effective? • Inform the workforce – Implement a policy that clearly sets out what you propose to do, how the information will be used, and what the expectation is on employees (both will be monitored – those who do the monitoring). • Anticipate and address morale issues – Employees will react to any perceived encroachment on their privacy. Be clear on what you are doing, why you are doing it and how the information will be used. Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com

46. Questions? Darcie C. Yale - dyale@darcydeacon.com Michael Merner - mmerner@darcydeacon.com www.darcydeacon.com