Canadian Employment Law Today

with Tim Mitchell ask an expert Have a question for our experts? Email Jeffrey.r.smith@thomsonreuters.com Canadian HR Reporter, a Thomson Reuters business 2015 2 | february 18, 2015 Tim Mitchell ask an expert Have a question for our experts? Email Jeffrey.r.smith@thomsonreuters.com Answer: An employer's right to track em- ployees' arrival and departure from the workplace is generally regarded as reason- able. Even in unionized workplaces, it has been recognized that employers are entitled to confi rm employees are attending work as scheduled for timekeeping, payroll and at- tendance management purposes and may implement tracking systems as a function of their management rights. However, the enactment in recent years of legislation that governs the collection, use and disclosure of personal informa- tion has made implementation of employee tracking procedures somewhat trickier. Personal information is typically defi ned in the legislation very broadly, such as "'in- formation about an identifi able individual." Information about the attendance of a par- ticular employee falls within that defi nition. e question whether consent is required to collect this information is determined in large part by the character of the employ- er. Diff erent legislation applies to private versus public sector employers; federally- regulated versus provincially-regulated employers; and provincially-regulated em- ployers operating in provinces with provin- cial information privacy legislation versus provincially-regulated employers operating in provinces without such legislation. Some statutes require consent; others impose dif- ferent requirements. Both Alberta and British Columbia have legislation governing the collection of per- sonal information from employees in the provincially-regulated private sector. Both statutes allow employers to collect certain information from employees without con- sent in defi ned circumstances. On the other hand, the federal private sector legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA) does not permit the collection of personal information without consent. It does acknowledge that consent may be given in diff erent ways, including implicitly. It also recognizes that the nature of the per- sonal information at issue plays a role in de- termining how explicit consent must be in a given situation. PIPEDA applies to private sector employers in most provinces and em- ployees of federally-regulated employers. e fi rst step in identifying a need for em- ployee consent involves determining which statute governs the employment relation- ship. Applying that legislation to a given set of facts raises more complex issues. Turner v. Telus Communications Inc. ad- dressed the requirements for consent from employees under PIPEDA. An employer sought employees' voice samples as part of its implementation of a voice authentication system for reasons of security, effi ciency and cost reduction. Several employees refused to provide the necessary samples, arguing the employer's demand breached their pri- vacy rights under PIPEDA. When the employees' complaint was fi rst heard, the privacy commissioner's repre- sentative found that the information was clearly personal information but its collec- tion by the employer was reasonable. More controversially, she found the employer had met PIPEDA's requirements for consent de- spite the fact that the complaining employ- ees had consistently refused consent. e employees were required to provide work- related information to their employer and the employer was not required to provide a substitute system for those who objected to the voice authentication system. On appeal, the Federal Court held that there had been no consent but the circum- stances fell with PIPEDA's exceptions to the consent requirement. On further appeal, the Federal Court of Appeal determined there was neither con- sent nor circumstances falling within the statutory exceptions. However, the court concluded the employer should not to be prevented from adopting a system to which a vast majority of employees had consented by the dissent of a small minority. It refused to decide whether the employer's manage- ment rights allowed it to discipline employ- ees who refused to submit voice samples or whether, under the terms of a collec- tive agreement, consent could be given by a trade union on an individual employee's behalf. In the court's view, these were not information privacy issues. e history of this case suggests the prac- tical implications of PIPEDA are not clear even to those who administer the act. Legislation relieving employers of the need to seek consent is no more assertable in its application. In particular, the diffi cul- ties in relying on this legislation to imple- ment an attendance monitoring system without consent are shown in Empire Ball- room (1208558 Alberta Ltd.). Empire Ballroom was decided under Al- berta's Personal Information Protection Act (PIPA), which defi nes "personal employee information," collectable without consent, as meaning: "in respect of an individual who is a potential, current or former employee of an organization, personal information reasonably required by the organization for the purposes of (i) establishing, managing or terminating an employment or volunteer work relationship, or (ii) managing a post- employment or post-volunteer work rela- tionship between the organization and the individual, but (not including) personal in- formation about the individual that is unre- lated to that relationship". B.C.'s defi nition of "employee personal information" is similar. Empire Ballroom addressed the non-con- sensual implementation of a biometric sign- in system, which translated a thumb scan into a number that represented the unique features of the scan. An employee refused to submit to the scan, claiming it breached PIPA; the employer countered that the data collected was "personal employee informa- tion" that could be collected without the employee's consent. is required the em- ployer to establish that the information was collected solely for the purposes of manag- ing the employment relationship, it was rea- sonable to collect the information for that purpose and reasonable notifi cation of the intended collection and its purposes had been given beforehand. e employer suc- ceeded in establishing most of these. e Offi ce of the Privacy Commissioner accepted that attendance and payroll were typical aspects of managing employees; the personal information associated with the numeric identifi er — the employee's name, address, telephone number, social insur- ance number, pay rate, shift times, and secu- rity level — was all related to managing the employment relationship; the information was reasonably required to counter abuses of the previous time card system; the scan- ning system improved accuracy, effi ciency and security and eliminated cumbersome paper tracking; the information was not collected for any purpose other than atten- dance management and payroll; notice had been provided prior to implementation of the system; the numeric identifi er was per- sonal information that was considerably less intrusive than retention of the biometric itself and could not be used for other pur- poses; and the employee's thumbprint could not have been reconstructed or reproduced from the numeric identifi er. However, despite these fi ndings, collec- tion without consent was not permissible — the employer had not provided appropriate notifi cation because its explanation left the Implementing a tracking system for employees Question: Does an employer need to get consent from employees if it wants to implement a system (such as time cards or finger scanning) that tracks entrances and exits to and from the workplace? tRaCKing eMPLoYees on page 6 » noRton Rose FULBRight CALGARY

• Cover