Privacy implications of doing business in Canada
May 2013 | EXPERT BRIEFING | EMPLOYMENT LAW
Privacy law has quickly become one of the fastest developing areas of Canadian law and this, in turn, has had a noticeable impact on the practice of labour and employment law in Canada. It is important that organisations establishing a business presence in Canada take heed of the law in this area.
Much of the recent development of workplace privacy rights has resulted from the rapid expansion of technology. Today, personal and work time for many employees is blurred and this has caused a sudden, heightened and growing awareness of individual privacy rights in the workplace. Issues in this vein are rising in frequency and significance as employees realise their legal rights and seek to enforce them.
In October 2012, the Supreme Court of Canada noted in the case R. v. Cole, 2012 SCC 53, that employees have a reasonable expectation of privacy in personal information stored on workplace computers provided by their employers where personal use is allowed or reasonably expected. This is important as it confirms that employer ownership of workplace technology given to an employee for business use does not in and of itself give the employer the right to monitor and review all of the information stored on the device. In fact, it emphasises that employers in Canada must be mindful of where employees may reasonably be expected to be storing personal information and cautions that this remains personal to the employee despite its saved location on workplace technology. For instance, the court noted that an employee’s internet browsing history alone can reveal deeply personal information, even when it’s on a workplace device.
The ownership of the workplace technology is not the only factor in determining how much privacy an employee can expect in the workplace, however. The court in Colenoted that workplace policies and practices can diminish employees’ reasonable expectation of privacy in a work computer, so it is important that employers in Canada spend time carefully crafting and enforcing internal privacy policies that integrate well with other policies such as those for acceptable and unacceptable technology use, social media use, and internet and email use.
Simple reliance on employer owned technology and well-written policies are not determinative either, however. These ‘operational realities’ do not remove employees’ expectation of privacy entirely, according to the court. To ensure, then, that the policies that you have carefully crafted to defend your business interests are fully effective, it is important for employers to ensure that all relevant policies are brought to the attention of employees, that employees are regularly reminded of them, and that employees clearly understand the consequences for breaching the policies. Finally, employers must enforce the policies.
This last step – enforcement – is something that is often overlooked in the drafting stage, or not contemplated reasonably. If policies exist but are largely ignored in practice, they are not worth the paper they are written on. It is important therefore that employers take steps to ensure that workplace practices and customs adhere to the policy for it to be enforceable later. Of course, employers must weigh the type of workplace environment they want against how tightly they grip the reins. This is a balancing act that should be carefully considered for each workplace depending on the nature of the workplace, its technology needs and those of its employees, and the industry or type of work.
Much more remains to be said on various aspects of privacy law. For instance, companies doing business in Canada must take time to inform themselves of Canadian privacy laws in their jurisdiction that affect the way they monitor, collect, use and disclose information about clients and employees. Often it is necessary for a company to have a designated privacy officer on staff, who is familiar with applicable privacy legislation, and who employees and clients can contact with privacy questions. This can seem like an onerous change for companies moving into Canada from jurisdictions where such obligations do not exist.
Overall, employers who do not spend the time ensuring that their organisation adheres to Canadian privacy law and their own internal policies derived from those laws could stumble into embarrassing situations or face legal liability from employees. This may arise, for instance, where an employer terminates an employee using information that the employer obtained through a breach of privacy laws.
While the Court’s decision in Cole has been instructive, the full impact of the Cole decision is yet to be determined. The case is sure to be used frequently by employees who suspect that their privacy rights may have been breached in different contexts, such as in the case of random drug and alcohol testing for employees. A number of cases upon which Cole will have an impact are before the courts in Canada and further development in this area is a virtual certainty.
Carman J. Overholt, Q.C. is the founder of, and Preston Parsons is an associate lawyer at, Overholt Law. Mr Overholt can be contacted on +1 (604) 568 5464 or by email: firstname.lastname@example.org.
© Financier Worldwide
Carman J. Overholt, Q.C. and Preston Parsons