privacy in theworkplaceredengine.lawsociety.sk.ca › inmagicgenie › document... · private...

36
PRIVACY IN THE WORKPLACE These material s were prepared by Susan Barber, of McDougall Gauley law firm .. for the Saskatchewan Legal Education Society inc. seminar, Privacy Laws Nutshell; October 2004.

Upload: others

Post on 23-Jun-2020

0 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

PRIVACY IN THE WORKPLACE

These materials were prepared bySusan Barber, of McDougall Gauley law firm Regin~, Sas~~tchewan.. for the Saskatchewan Legal Education Society inc. seminar, Privacy Laws .in~ Nutshell; October2004.

Page 2: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

\' )i

(",

Page 3: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

2

Privacy in the Workplace

In 2000 the federal government enacted The Personal Information Protection and

Electronic Documents Act, commonly know as "PIPEDA". The legislation largely came

about in response to a 1998 Data Protection Directive issued by the European Union. It

was initially compiled as a voluntary private sector privacy code in the form of the

Canadian Standard's Associations Model Code for the Protection of Personal Information

(the "CSA Code"). Then, in 2000, parliament introduced PIPEDA which is modeled

after the CSA Code. PIPEDA came into force on January 1,2001 in respect of federally

regulated businesses. Effective January 1,2004 its provisions became applicable to all

personal information collected, used or disclosed in the course of commercial activities

by all private sector organizations except in provinces which have enacted legislation that

is deemed to be substantially similar to the federal law. To date, Quebec is the only

province with legislation that has been deemed substantially similar although British

Columbia and Alberta will likely have their legislation approved on the same basis in the

near future.

Many private sector businesses in Saskatchewan and elsewhere have been

scrambling to ensure compliance with PIPEDA. Many employers within the province

have raised the question of what PIPEDA means to them in the context of the employer­

employee relationship and what steps must be taken to meet any requirements that it

imposes.

Page 4: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

3

Although it may make good business sense for employers within Saskatchewan

to ensure compliance with PIPEDA in the employment relationship there is no legal or

legislative requirement to do so. PIPEDA does not apply to provincially regulated

employees.

Part I of PIPEDA addresses "Protection of Personal Information in the Private

Sector". Section 4(1) of the Act, dealing with the application of Part 1, provides as

follows:

4(1) This part applies to every organization in respect of personal informationthat:(a) the organization collects, uses or discloses in the course of commercial

activity; or(b) is about an employee of the organization and that the'organization

collects, uses or discloses in connection with the operation of a federalwork, undertaking or business. (emphasis added)

In the context of the regulation of private sector workplace privacy issues the

situation appears to be that employers in the federal jurisdiction must comply with

PIPEDA, employers in Alberta, British Columbia and Quebec must comply with the

provincial legislation in force (assuming that the legislation in Alberta and British

Columbia is declared to be substantially similar to PIPEDA) and employers in other

provinces who have not passed legislation substantially similar to PIPEDA do not have to

comply with either that legislation or with provincial legislation.

Page 5: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

)

4

The Privacy Commissioner for Saskatchewan, Gary Dixon, has suggested in the

annual report for the Office of the Privacy Commissioner that there is a "gap" in the

legislation in Saskatchewan that requires attention and, accordingly, we may expect to

see legislation introduced in Saskatchewan that will address the employment relationship

in the private sector. At page 14 ofthe 2003-2004 Annual Report for the Office ofthe

Privacy Commissioner, Mr. Dixon states the following:

PIPEDA applies only to customer type information and does not apply toemployee information of businesses other than those that are federally regulatedsuch as airlines and banks. Our office is of the view that the most sensitivepersonal information that most businesses would have relate to employees and notto customers. The provinces of British Columbia and Alberta have enactedprivate sector privacy laws that provide full coverage of employees and employeeinformation. This legislative "gap" in Saskatchewan warrants the early attentionof the Legislative Assembly.

It is interesting to note that, notwithstanding the non-application PIPEDA in

Saskatchewan to the private sector and non-federally regulated public sector employment

relationship, many organizations that employers deal with on a regular basis such as

insurance companies, pension administrators and payroll services do regard themselves

as bound to comply with the privacy principles enshrined in PIPEDA with the result that

many employers are impacted by the operation of the legislation even if not directly.

Protection of privacy interests involves a delicate balance between employee

privacy and the employer's ability to protect legitimate business interests. In light of that

balancing act arbitral jurisprudence in Saskatchewan and elsewhere reflects a constant

tension between the right to personal and physical privacy of an employee and the

employer's right to supervise all acts that affect the workplace.

Page 6: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

5

Apart from the provincial privacy legislation found in Sa~katchewan,1 which is

limited to control of personal information in the hands of government and local

authorities and apart from PIPEDA which will not apply to employee personal

information of provincially regulated employers, the regulation of privacy issues in the

workplace in Saskatchewan at present is a matter of agreement and common law and the

law can generally be reduced to a "what is reasonable in the circumstances" test.

The distinction between privacy issues in a union versus a non-union environment

is not significant. While the four corners of a collective agreement may serve to

specifically define both employee and employer rights in this area, should the agreement

be silent then the principles which apply to a workplace generally will likely apply. At

the end of the day the factors which affect the outcome of a workplace privacy dispute

include the nature of the job itself and the extent to which the impugned act of privacy

infringement is reasonable given the specific circumstances of each case.

In the absence of applicable legislative regulation of privacy issues in the

workplace it is helpful to consider a variety of such privacy related matters in the context

of the arbitral jurisprUdence and common law that currently applies. This will be

considered in the areas of: computer access and e-mail, surveillance, employee

information, and alcohol and drug testing in the workplace.

1 Freedom ofInformation and Protection ofPrivacy Act, S.S. 1990-91, c. F-22.01; Local Authority andFreedom ofInformation and Protection ofPrivacy Act, S.S. 1990-91, c. L-27.1; and The Privacy Act,R.S.S. 1978, c. P-24]

Page 7: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

)

6

1. Computer Access and E-mail

In most cases courts and arbitrators will approach the issue of access to an

employee's computer drives and e-mail messages by recognizing the need to balance the

employee's right to privacy with the employer's right to manage the workplace. In these

circumstances the factors that will be considered when reviewing an employer's ability to

monitor e-mail or computer use include whether the monitoring is done openly or

surreptitiously, the reason or purpose for the monitoring, the location of the files or·

documents within the person's computer and the information that is gathered (Le., is the

employer simply monitoring the time spent on the internet or is it monitoring the nature

of the websites looked at or the content of e-mails).

In ISM Information Systems Management Corp. (Re) [1998] S.L.R.B.D. No. 30

the union filed an unfair labour practice application with the Saskatchewan Labour

Relations Board alleging that ISM entered the office of the union located in th~ ISM

office building on two occasions. ISM admitted that its security personnel had entered

the union office but argued that since the union utilized the employer's computer system

it should be subject to the same security requirements imposed on all other users.

The Board concluded that the employer's decision to enter the union office to

implement a security policy was unreasonable. The Board found that ISM, in unilaterally

applying the security policy to the union, had made certain assumptions about its right to

control its property when those rights might be curtailed by corresponding legal

obligations arising under The Trade Union Act and within a collective bargaining regime.

Page 8: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

7

The Board concluded that the decision by ISM to apply the security policy to the union

president in his status as employee and, in particular, that aspect of the policy which

permitted ISM to enter the union's office without permission was improper. The Board

concluded that ISM would have to seek the union's agreement to the security

arrangement and, if no agreement could be reached, ISM might not be able to permit the

union to have access to the computer network and that this might be the price that the

union would have to pay for ensuring the integrity of its own internal operations. The

Board found that both parties had some responsibility to try to accommodate their

competing interests.

The Board stated as follows at paragraph 33 to 35 of the decision:

In our view, the present case presents a textbook example of the need for anaccommodation between union's legitimate activity in the workplace and ISM'slegitimate concerns with the security of its property. Neither right is unlimited, asstated above. The union has been provided with an office and equipment onISM's premises to facilitate the union's activities in the workplace. Likely thearrangement benefits ISM as well as it provides ISM with access to a unionrepresentative without any interruption in the work processes.

However, the union had a reasonable expectation that its office would beconsidered off limits from ISM unless an access agreement was entered intobetween the union and ISM. In this instance, the union had agreed that thecleaning staff be permitted to enter its office and access was granted for thatpurpose. It would not be unusual for ISM to retain a master key to permit itaccess to the office in the event of an emergency or maintenance problem thatrequired immediate attention. Otherwise, the union viewed its office as its ownspace, subject to its own controls, as it would apply if its office were located offISM's premises. In our view, this is a fair and reasonable expectation, absent anyagreements to the contrary with ISM. The office is the centre of the union'sinternal operations; it is the depository of the union's records and files, some ofwhich may contain information that the union does not wish to share with ISM.The right and ability of a union to operate an office free from employer scrutinyseems to this Board to be essential in order to ensure that an arm's lengthrelationship is maintained between the trade union and the employer.

Page 9: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

)

8

At the same time, ISM has provided the union with access to its computernetwork which contains valuable and confidential corporate information. It is notunrealistic for ISM to require the union to agree to the application of a securitypolicy with respect to the union's use of the computer network. The union, in thissense, is like any other third party who is allowed access to the ISM computernetwork. Access agreements need to be negotiated. This discussion should haveoccurred before ISM provided the union with access to the system; it also is adiscussion that must occur between ISM and the union in those representativecapacities, not between ISM and an employee.

In CUPE v. Camosun College [1999] B.C.C.A.A.A. No. 490 (November 15,

1999), an arbitrator in British Columbia dealt with the grievance of a lab technician who

had been terminated for having made a series of unwarranted allegations against other

employees and the administration in a lengthy e-mail that was distributed to a number of

employees over the computer network. The administration of the college found out about

the e-mail and the grievor was suspend~d pending an investigation and subsequently

dismissed. The employer took the position that the employee had breached his duty of

fidelity and his conduct waS' tantamount insubordination. The union took the position

that the contents of the message were both confidential and privileged.

In ruling on the matter the arbitrator determined that there" was no confidentiality

associated with the e-mail because the "chat group" was part of the college system which

should alert users that e-mail messages were subject to monitoring. The potential for

dissemination of the message was limited only by the internet. Moreover the arbitrator

determined that the notion of confidentiality that might attach to a letter could not be

applied to e-mail and, accordingly, there was no reasonable expectation of privacy and no

privilege associated with the sending of the message. The grievor was acting in his

personal capacity.

Page 10: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

9

In Insurance Corporation ofBritish Columbia and Office and Technical

Employee's Union, Local 378 (Tom Allen grievance) (January 27, 1994, Joseph Weiler),

a labour arbitrator accepted the general principle that an employee does have rights of

privacy which may include e-mail. .Notwithstanding that general recognition, however,

the arbitrator found in that particular case that there was no reasonable expectation of

privacy with respect to workplace e-mails because the employees shared computer

terminals and each employee had an identification code and password which allowed that

employee access to his or her e-mail. When employees were finished using their e-mail,

they logged off, preventing anyone else from accessing their e-mail. However, if an

employee failed to log off the next person using the computer terminal would have access

to the previous employee's e-mail account.

2. Employee Information

In Board ofEducation of the Saskatchewan Rivers School Division No. 119 (re)

[2000] SL.R.B.D. No.8, the LabourRelations Board considered a union complaint

against a employer who refused to provide the union with a list of employees. The

employer argued tha! privacy laws precluded the release of such information by it. The

union, however, argued that the information was necessary in order for it to ensure 'that

the employer complied with dues deduction and the union security provision contained in

the collective agreement.

Page 11: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

)

10

The Saskatchewan Labour Relations Board concluded that the information

requested of the employer was reasonably necessary for the union to conduct itself and

that the employer's position in withholding the information was unreasonable.

The Board cited with approval an earlier decision in United Fooa and

Commercial Worker's Local 1400 v. F. W. Woolworth Co. Limited, et al [1994] 1st Quarter

Sask. Labour Rep. 169. In addressing considerations of privacy the Board stated atpage

183 as follows:

The employer argued that disclosure of this information infringes upon theprivacy of the employees, but this does not bear scrutiny. As the employee'sexclusive bargaining agent, the union has access to their wage rates and often totheir performance evaluations, disciplinary records and other highly personalinformation. The employees are informed when they apply for employment, orare supposed to be, that they must join the union as a condition of employment.This knowledge tends to undercut any need to keep this information private fromthe very organization which the employees have a statutory obligation to join andwhich has a statutory duty to represent them. Considering this scheme, access bythe union to the names, addresses and telephone numbers of new employeeswould appear to be compatible with the attainment of these statutory obligations.Furthermore, given that membership in the union is a condition of employment, itseems more reasonable to facilitate the union's ability to solicit and securecompliance from the employees, than to force the union to get the employee'sattention by serving the employer with a demand that they be dismissed.

In the final analysis, considering the intent of Section 36(1), and the generalobjectives of the Act to legitimize and to require employers to accept a regime ofcollective bargaining, we cannot see any reason to sanction a practice which failsto serve any legitimate interest of the employer and is designed merely to frustrateand obstruct the union's access to rights clearly accorded to it by Section 36(1).There was absolutely no attempt by the employer to explain or defend its conducton the basis of its legitimate interests. Its sole purpose was to frustrate andinterfere with the administration of the union and the rights of employees. This·part of the application is accordingly granted under Sections 11(1)(a) and 11(1 )(b)of the Act.

Page 12: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

11

In 594431 Saskatchewan Ltd. (c.o.b. Clark's Crossing Pub and Brewery) (re)

[2001] S.L.R.B.D. No. 75 the employer brought an application to the Saskatchewan

Labour Relations Board against the union for refusing to disclose to the employer the

quantum of tips and gratuities earned by unionized employees. The employer argued that

having such information would assist in the determination of wage rates .. The union

countered that the employer was not entitled to this information as it was a "privacy

issue". The Board ultimately determined that the employer was entitled to know such

information so that it could bargain with the union from an informed position. In its

reasoning the Board reviewed several of its previous decisions in which it had determined

that there exists an obligation to disclose information during collective bargaining.

In regard to the privacy issue the Board determined that the privacy issue raised

by the union on behalf of its members was a "non-issue" given that the union would only

be obligated to disclose actual information which it possessed.

3. Surveillance

In a world of advancing technology the use by businesses and by employers of

video surveillance is becoming more common. The propriety of such surveillance and

the admissibility of it in any proceedings that might be initiated against an employee also

involves a balancing test between the right of the employee to a reasonable expectation of

privacy and the right of an employer to regulate the workplace. There are a number of

cases across Canada both in the unionized context and in the common law employment

relationship that have examined the question.

Page 13: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

)

12

In Loraas Disposal Services Ltd. (re) [2001] S.L.R.B.D. No. 83, the union

complained about surveillance in the workplace. The employer introduced surveillance

cameras in key areas in the workplace and the union complained that the cameras had the

ability to record the coming and going oftrucks and drivers and to. record conversations

among employees. The employer also installed satellite tracking devices on certain of the

trucks used by the employees. The employer suggested that it did so in order to keep

better track of the vehicles to give calls out to trucks during the day. Neither the

installation of the satellite tracking devices nor of the video surveillance equipment had

been negotiated with the union, although the employer did discuss the installation of

tracking devices on vehicles directly with the employees.

The employer's position was that the cameras, that had been installed in two

offices and on the exterior of the building, were to provide the office staff with a means

of determining whether the owner and the operations manager were on the premises. The

employer denied that the cameras were used to watch or to conduct surveillance on the

employees.

The Board determined that the employer had shown a "flagrant disregard" for the

collective bargaining process and for the union's status as the exclusive bargaining

representative of the employees in the bargaining unit. It found that the employer had

breached the Act by negotiating directly with the employees respecting the installation of

a surveillance system and the satellite driving tracking devices on the trucks. The Board

Page 14: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

13

also determined that the installation of the surveillance system ought to be a matter that

was discussed with the union prior to being implemented. The Board stated as follows at

paragraph 60 of the decision:

The union has made various claims under s.ll (1 )(m) of the Act. In our view, theinstallation of the surveillance system is an issue that ought to have beendiscussed with the union to avoid the type of misunderstanding that has nowoccurred. In our view, such a change in the workplace is significant especially ifits intended purpose related to employee discipline. In this case, the employerassured the Board the system will not be used for disciplinary purposes. Thisundertaking may impact on the type of remedial order that the Board willultimately make. However, we find that the introduction of the surveillancesystem did violate S.l1(1)(m) of the Act.

In this case the Board, in accordance with the request of the union, left the

remedial order for a further hearing. It issued a cease and desist order with respect to a

variety of complaints against the employer and asked it to file a plan for rectifying the

violations within 10 days of receipt of the order.

Many cases that deal with the issue of video surveillance involve the admissibility

of such evidence in proceedings involving the employee.

In Re IntercontinentalPackers Ltd. and V.F.e. W, Local 248-P (1996), 42

c.L.A.S. 158, the Canadian Labour Relations Board, in a decision out of Saskatchewan,

considered a complaint against an employer who, in investigating potential WCB fraud,

undertook video surveillance of an employee. At issue before the Board was the

admissibility of such evidence.

Page 15: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

)

14

The Board determined that the admissibility of the surveillance evidence ought to

be considered based on a balancing of the employee's reasonable expectation of privacy

with the empioyer's right to investigate suspicion of abuse of compensation benefits. The

Board determined that the decision maker must consider whether, in all of the

circumstances, it was reasonable for the employer to initiate surveillance and whether the

surveillance was undertaken in a reasonable manner. Part of the consideration would

include whether or not there were other means available to the employer to obtain the

desired evidence. Under the circumstances the Board determined that the surveillance

was reasonable and that any other alternatives would not likely have resulted in the

evidence being obtained.

In Newflyer Industries Ltd. v. National Automobile Aerospace, Transportation

and General Worker's Union ofCanada, Local 3003 (Beauchemin grievance)[2003]

M.G.A.D. No.9, the grievor challenged the admissibility of surveillance evidence

received by the employer relating to whether the alleged disability of the grievor was

bonafide.

In determining that the evidence was not admissible the Manitoba arbitrator ruled

that the appropriateness of surveillance of an employee must satisfy the test set out in Re

Newflyer Industries v. C.A.lVo-Canada Local 3003 (Mogg grievance)(2000) 85 LA.C.

(4th) 304, namely:

1. Was it reasonable, in all of the circumstances, to request surveillance?

Page 16: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

15

2. Was the surveillance conducted in a reasonable manner?

3. Were other alternatives open to the company to obtain the eVIdence that it

sought?

In Beauchemin the arbitrator determined that the surveillance of the grievor was

not justified in the circumstances of the case since there was no reasonable basis for the

company to do so. The surveillance was initiated, not reasonable grounds, but on

information of some "alleged comments by unidentified employees made to a supervisor

not directly involved with the grievor." In this case, because there were no reasonable

grounds for the employer to believe that the employee was guilty of a breach of trust, the

arbitrator refused to consider the evidence.

In Newflyer Industries Ltd. v. c.A. W. Canada, Local 303 (Schugmann grievance),

the arbitrator determined that the company did not have reasonable grounds to initiate

surveillance because other grounds of investigation were available. The video

surveillance that had been collected was not admissible.

It would appear that the types of questions asked by the arbitrator in Manitoba are

consistent in their application by arbitrators across Canada. The difficulty in every case

is in trying to determine what result might be expected from a particular set of facts. It

would appear that arbitrators will consider the following factors, which are certainly not

intended to constitute an exhaustive list:

)

Page 17: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

16

• Whether or not the employer considered other alternatives before·initiating the

surveillance such as confronting the grievor concerning the alleged lnisconduct

or, in the event of abuse of sick leave being suspected, offering the employee

modified work;

• The grievor's seniority;

• Whether there were reasonable grounds for suspecting fraudulent conduct by the

grievor;

• The grievor's disciplinary record, if any, with particular consideration of any

disciplinary record involving dishonesty;

• Whether the grievor was co-operative in supplying medical or other information

respecting the alleged misconduct, such as excessive absenteeism.

Arbitrator Picher in Canadian Pacific Ltd. v. B.M. W:E. (1996),59 L.A.C. (4th)

111 (Can) articulated the balance of interests between the employer and the employee as

follows:

That interest [in preventing abuse of a system of benefits] must be fairly balancedwith what is becoming recognized as the employee's interest in a respect for hisor her personal privacy. The employer's interest does not extend to justifyingspeculative spying on an employee whom the employer has no reason to suspectwill be dishonest. As a general rule, it does not justify resort to random videotape surveillance in the form of an electronic web, cast like a net, to see what itmight catch. Surveillance is an extraordinary step which can only be resorted towhere there is, before hand, reasonable and probable cause to justify it. Whatconstitutes such cause is a matter to be determined on the facts of each case. Aswell, the method and extent of such surveillance must be appropriate to theemployer's purpose, and not excessive or unduly intrusive. A legitimate interestin an employee's physical condition might not, for example,justify the covertexamination of his or her bank records or other personal information.

Page 18: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

17

A judicial approach to the admissibility of surveillance evidence in a non­

unionized context is reflected in the 1997 decision of the British Columbia Supreme

Court in Richardson v. Davies Wire Industries Ltd., [1997] B.c.J. No. 937. In that case

the plaintiff, a production foreman, had a clean, 16 year record with the employer. The

employer had received unsolicited reports from other employees that the plaintiff was

sleeping on his shift and, rather than confronting him directly, the employer chose to

investigate by installing a hidden surveillance in the lunch room. The employer

suggested that it did so in order to avoid insulting the plaintiff by speaking to him about

the allegations..

After running the surveillance over a course of days and reviewing the tapes it

became apparent that the plaintiff was sleeping regularly on the job. The employer

confronted the plaintiff who said that he had not been feeling well and denied sleeping on

the job on a regular basis.

Mr. Richardson was dismissed and sued for wrongful dismissal. At trial his

counsel argued that the videotapes should be found to be inadmissible on the basis that

the decision to conduct the surveillance and the manner of the surveillance were

unreasonable and there were other alternatives open to the employer to obtain the

evidence. The lawyer for the plaintiff also argued that the employer had committed the

independent tort of breach of privacy under The British Columbia Privacy Act. It was

further argued that a high degree of privacy could beexpected in a place like a foreman's

lunchroom.

Page 19: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

)

18

The court determined that there should be no departure from the usual

admissibility test and determined that the tapes were both relevant and not excluded by

any evidentiary rule.

With respect to the argument that the employee had a reasonable expectation of

privacy the learned trial judge stated as follows at paragraph 48 of the decision:

In respect of the issue of whether the videotapes were made in breach of Mr.Richardson's privacy, I conclude that there was no expectation of privacy on thepart of Mr. Richardson in the circumstances. Furthermore, even if he had anexpectation of privacy, a breach of privacy does not lead to exclusion of theevidence in this case. The Privacy Act provides the foundation for a claim in tortand does not prohibit the admission of evidence, even if it were gathered contraryto the Act.

The learned trial judge went on to find, at paragraph 9, that "Mr. Richardson

could not reasonably expect to have the protection of privacy when he was sleeping on

company time, on company property and in circumstances where he could be expected to

be contacted if needed."

The trial judge also concluded that the employer had a reasonable basis to conduct

the surveillance based on a reasonable suspicion that the plaintiff was sleeping on the job

and, accordingly, admitting the videotape would not bring the administration of justice

into dispute.

Page 20: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

19

It is interesting to note that notwithstanding the finding by the trial court that the

evidence was admissible the learned trial judge went on to express regret about the

decision to use video surveillance. The trial judge stated as follows:

Notwithstanding my conclusions as to the admissibility of the videotape evidence,I do wish to express my regret that Davies Wire made the choice to install thissurveillance equipment in order to catc,h Mr. Richardson in the act of sleeping onthe job. In my opinion, the surveillance of an employee in hopes of catching himor her engaging in a type of wrongdoing that, while foolish and irresponsible,would not justify summary dismissal, is itself a practice which jeopardizes therelationship of trust and confidence that is so crucial to the employer/employeerelationship. It is unfortunate that Davies Wire did not attempt to solve thisproblem by honestly confronting Mr. Richardson once it became suspicious, andmaking it clear to him that sleeping on the job would not be tolerated.

It is somewhat difficult to reconcile these comments with the judge's finding that

the employer had a reasonable basis for introducing the video surveillance. In the context

of the tests that are normally applied to assess the appropriateness of video surveillance it

appears that the employer may have had a less intrusive method available to it - that is

confronting the employee with the alleged misconduct.

It would appear that the test that is applied by arbitrators in a unionized context is

similar to that applied by the courts in a common law master-servant relationship. In

each case the question comes down to one of balancing the competing interests.

Although employees do have a legitimate privacy interest capable of protection, an

employer will be justified in interfering with that right through the use of electronic

surveillance if there is a legitimate basis under the circumstances.

Page 21: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

)

20

4. Alcohol and Drug Testing

There are few, if any" cases in Saskatchewanthat address an employer's ability to

implement alcohol and drug testing protocols in the workplace. There is little doubt that

an employer's prohibition against employees possessing, using or being under the

influence of alcohol or illegal drugs in the workplace does not run afoul of human rights

legislation or any other employee right. The more difficult question arises when random

testing and possible discipline for positive test results is contrary to anti-discrimination

provisions in both legislation and collective agreements.

In other jurisdictions human rights legislation has been interpreted so as to limit

the use of pre-employment drug and alcohol testing, random drug testing and random

alcohol testing of employees in non-safety sensitive positions. Some testing is still

permissible, however, such as random alcohol testing of employees in safety sensitive

positions or where the employer has reasonable grounds to suspect an employee is under

the influence of a prohibited substance.

The difficulty with respect to drug and alcohol testing is the very fact that it raises

human rights discrimination issues in addition to privacy issues respecting the employees

in question. Although drug and alcohol testing is intended to address impairment in the

workplace that, in turn, raises issues of discrimination on the basis of disability for those

employees whose impairment is as a result of an addiction or dependence on alcohol or

drugs. Those dependencies have been recognized by human rights tribunals and courts as

disabilities within the meaning of most human rights legislation across Canada. The area

Page 22: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

21

can become somewhat of a minefield because the presence of such a disability creates

accommodation issues requiring the employer to accommodate the addiction to the point

of undue hardship.

In Saskatchewan the Human Rights Commission has concluded by way of policy

that, as a general proposition, drug and alcohol testing violates The Saskatchewan Human

Rights.Code. Testing does identify persons with disabilities and does target them for

discriminatory treatment and, accordingly, in most situations it will not be allowed.

However, the Commission recognizes that the presence of drugs or alcohol in the

workplace can also have negative consequences for work performance. The Human

Rights Commission, relying on the Supreme Court of Canada decision in what is known

as "The Meiorin Case" [1999] 3 S.c.R. 3 has endorsed the three part test established by

the Supreme Court of Canada which employers must meet to justify employment

practices which would otherwise be found to discriminate. In that case the highest court

held that in order to justify what would otherwise be discriminatory treatment the

employer must show:

1. That the employer adopted the practice for a purpose rationally connected to

the performance of the job;

2. That the employer acted honestly and in good faith, believing that the practice

was necessary for the fulfillment of the work related purpose; and

3. That the practice is reasonably necessary for the fulfillment of the work

related purpose.

Page 23: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

)

22

In order to meet the last requirement the employer must show:

(a) The employment practice which has the discriminatory effect does, in fact,

achieve the purpose;

(b) That the practice does not go further than necessary to achieve the

purpose; and

(c) That, to the point of undue hardship, the employer has attempted to

accommodate individuals who suffer a discriminatory effect because of

the employment practice.

The Ontario Court of Appeal in Entrop v. Imperial Oil [2000] O.J. No. 2689,

applied the test for discrimination set out by the Supreme Court of Canada in the Meiorin

decision in the context of drug and alcohol testing. In that case the employee, who was a

recovered alcoholic, had been promoted to a safety-sensitive position within Imperial Oil.

There was a policy in the workplace that required the employee to disclose the fact that

he had been an alcoholic even though he had been sober for 7 years. In accordance with

the policy Imperial Oil immediately re-assigned him to a non-safety sensitive position. It

later amended the policy so that the plaintiff was reinstated to the earlier position that he

had been promoted to but required him to agree to random alcohol tests. The employee

filed a complaint under the Ontario Human Rights Code alleging discrimination.

Page 24: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

23

The Board of inquiry ruled that random drug and alcohol testing were

discriminatory and were not otherwise justified as· bona fide occupational requirements.

The matter made its way to the Ontario Court of Appeal.

In accordance with the tests articulated in Meiorin the court accepted that the aim

of the policy to minimize the risk of impaired performance due to substance abuse in

order to ensure a safe, healthy and productive workplace was rationally connected to the

performance of the work. It also accepted that the policy was adopted honestly and in

good faith.

In considering the third arm of the Meiorin test the court found alcohol testing to

be a bona fide occupational requirement for those in safety sensitive jobs. It concluded,

however, that automatic termination was too severe and that the sanction would have to

accommodate individual differences and capabilities to the point of undue hardship.

Each case would be determined on the basis of its own peculiar facts.

In the context of random drug testing the court found that both random testing for

safety-sensitive positions and pre-employment testing violated theCode. Although the

court determined that a positive alcohol test could demonstrate impairment a positive

drug test could not. The court expressed the issue as follows at paragraph 99:

Drug testing suffers from one fundamental flaw. It cannot measure presentimpairment. A positive drug test shows only past drug use. It cannot show howmuch was used or when it was used. Thus, the Board found that a positive drugtest provides no evidence of impairment or likely impairment on the job. It doesnot demonstrate that a person is incapable of performing the essential duties of theposition. The Board also found on the evidence that no tests currently exist to

Page 25: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

)

)

24

accurately assess the effect of drug use on job performance and that drug testingprograms have not been shown to be effective in reducing drug use, work-relatedaccidents or work performance problems. On these findings, random drug testingfor employees in safety-sensitive positions cannot be justified as reasonablynecessary to accomplish Imperial Oil's legitimate goal of a safe workplace free ofimpairment.

In the context of arbitration decisions dealing with drug and alcohol testing

arbitrators have to some extent been more concerned with the potential infringement on

privacy rights than with the human rights issues raised in cases such as Entrop.

In Greymont Western Canada Inc. v. Cement, Lime, Gypsum and Allied Workers,

LocalD575 [2002] M.G.E.D. No. 55, the union complained about the employer's

mandatory drug and alcohol testing policy which was required in all instances where

employees wished to be transferred to safety-sensitive jobs. The union, argued inter alia,

that the policy was unreasonable as there had been no previous discipline for drug or

alcohol abuse at the relevant workplace. The employer, on the other hand, argued that in

the mining industry in Manitoba the intrusion on privacy with respect to drug and alcohol

testing was mandated by statute under The Workplace Safety and Health Act. The

employer also relied on the collective agreement which provided that "physical fitness"

was a relevant aspect of job promotion.

The arbitrator ultimately decided that, given the circumstances of the workplace

in question (i.e. small, local and stable), the employer would have the opportunity to

detect drug or alcohol abuse through the normal supervisory procedures and therefore the

employer could fulfill its statutory obligations through other means. An unreasonable

Page 26: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

infringement on the employee's privacy rights was found to exist in the proposed

application of the policy.

A detailed analysis on the issue of drug and alcohol testing in the workplace was

undertaken by the arbitrator in Canadian National Railway Co. v. c.A. W-Canada [2000]

C.L.A.D. No. 465. In that case the union grieved a comprehensive policy intended to be

introduced by the employer to deal with drugs and alcohol in the workplace. The

arbitrator articulated the difficult nature of the dispute as follows at paragraph 180:

Turning to the merits, seldom has the Arbitrator encountered a contest of suchthoroughly considered and argued positions from both sides. The company'spolicy is rooted in a legitimate concern for the well-being of its employees and thesafety of its own operations, in a manner most consistent with its obligations tothe public. The union and Intervener advance equally legitimate arguments ineloquent defense of the privacy and dignity of the individual, deeply cherishedvalues in Canadian society. The Arbitrator must strive to resolve their positionsin a manner that best reconciles the competing interests of the parties, in the lightof established law and jurisprudence.

The Arbitrator dismissed the union's position that an employee could be required

to submit to drug testing only if it was required by statute or permitted by the consent of

the employee. Instead the arbitrator chose a "balancing of interests" approach. In doing

so Arbitrator Picher stated as follows at paragraph 185 of the decision:

If, as a matter of law, an employer can only base a right to demand a drug oralcohol test of an employee in a safety-sensitive industry on express statutoryauthority of contractual consent, the extensive arbitral jurisprudence in the fieldcould be shortened to a very few lines. As noted above, virtually all arbitratorswho have been called upon to deal directly with the issue have declined to takethe narrow approach of statutory authority/consent. Without exception, boards ofarbitration, striving to be responsive and pragmatic in the face of workplacerealities and genuine concerns for safety, have opted for the balancing of interestsapproach. In this Arbitrator's view that is the preferable framework for a fair andrealistic consideration of the issue of drug and alcohol testing in the workplacegenerally, most especially in an enterprise which is highly safety-sensitive. While

Page 27: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

)

)

26

the time-honoured concept of the sovereignty of an individual over his or her ownbody endures as a vital first principle, there can be circumstances in which theinterests of the individual must yield to competing interests, albeit only to thedegree that is necessary. The balancing of interests has become an imperative ofmodern society: it is difficult to see upon what basis any individual charged withthe responsibilities of monitoring a nuclear plant, piloting a commercial aircraft oroperating a train carrying hazardous goods through densely populated areas canchallenge the legitimate business interests of his or her employer in verifying themental and physical fitness of the individual to perform the work assigned.Societal expectations and common sense demand nothing less.

Although the arbitrator recognized employee privacy as a "core workplace value"

he went on to determine that the right was not absolute and that the ultimate

determination in each case is arrived by balancing the competing interests, with the onus

on the employer to establish that its business interest outweighs the employee's privacy

interest.

5. Privacy Considerations in the Light of "Substantially Similar" Legislation inSaskatchewan

In the event the Province of Saskatchewan does introduce legislation that

regulates employment relationships not otherwise covered by PIPEDA one would assume

that the legislators might follow the framework established in the provinces of British

Columbia and Alberta and that the types of considerations undertaken by the Federal

Privacy Commissioner in dealing with alleged violations of PIPEDA in the federally

regulated workplace will at least provide some insight into how our Privacy

Commissioner might deal with those same issues. A review of the cases that exist is

helpful.

On the topic of surveillance the Federal Privacy Commissioner established a four

part test in PIPEDA case summary #114 (January 23, 2003). In that case an employee of

Page 28: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

27

a railway company had complained that his employer was collecting the personal

information of employees without consent. The complainant was concerned that the

digital video recording cameras that had been recently installed at a company yard could

collect personal information of employees and, in particular, monitor their conduct and

work performance and that monitoring might then be used against the employees in

disciplinary proceedings.

The employer took the position that the system had been installed in order to

reduce vandalism and theft, to minimize threats to safety and to try to reduce liability for

property damage.

The Commissioner had jurisdiction over the case because the railway company

was a federal work, undertaking or business as defined in the Act. Under Section 5(3) of

PIPEDA an organization is allowed to collect, use or disclose personal information but

only for the purposes that a reasonable person would consider are appropriate in the

circumstances.

The Commissioner articulated the following four part test which does not appear

to be dissimilar from that articulated by the Supreme Court of Canada in Meiorin:

• Is the measure demonstrably necessary to meet a specific need?

• Is it likely to be effective in meeting that need?

• Is the loss of privacy proportional to the benefit gained?

Page 29: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

28

• Is there a less privacy-invasive way of achieving the same end?

The Commissioner upheld the complaint on the basis that the company had not

demonstrated the existence of a real, specific problem but only the potential for one.

Moreover he was not convinced that the digital system was in fact effective. He found

that the adverse psychological effects of a perceived privacy invasion could not be under

estimated and, finally, that the company did not appear to have evaluated the cost and

effectiveness of less privacy-invasive measures that would not have impacted on

employee privacy.

Ross v. Rosedale Transport Ltd. [2003] C.L.A.D. No. 237 and No. 570, concerned

the dismissal of a truck driver with 8 years of service and no prior disciplinary record for

alleged fraud. The employee had sustained a back injury at work and was away from his

duties and receiving Worker's Compensation Benefits. He was then placed on modified

duties. The employer became suspicious of the information that was being received from

the grievor's family physician. When the grievor requested time off to help move his

family out of their house the employer engaged a private investigator to conduct

surveillance. Based on that surveillance the employer was satisfied that the grievor's

injuries were fabricated and he was requested to resign or be terminated. The grievor

filed a complaint of unjust dismissal under The Canada Labour Code.

Page 30: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

29

When the matter went before the arbitrator one of the issues was the admissibility

of the videotaped evidence. The grievor took the position that it was personal

information collected without his knowledge and consent, contrary to PIPEDA.

There is an exception to the requirement for consent in the Act. Section 7(1)(b)

provides that personal information may be collected without the consent and knowledge

of the individual if "it is reasonable to expect that the collection with the knowledge or

consent of the individual would compromise the availability or- the accuracy of the

information and the collection is reasonable for purposes related to investigating a breach

of an agreement or contravention of the laws of Canada or a province".

The adjudicator concluded that there was no doubt that if the employer had

attempted to request the grievor's consent it would have compromised the investigation.

Accordingly the only question for the arbitrator to determine was whether the method of

collecting the information was reasonable.

The arbitrator considered the fact that prior to the introduction of PIPEDA the

three part test in Meiorin had been an acceptable method of balancing the interests of the

parties. The adjudicator concluded that those principles continue to be relevant when

determining whether the collection of information without consent is reasonable. In this

case the arbitrator concluded that the employer's interest did not extend to conducting

surveillance of an employee who it had no reason to suspect of dishonesty and,

accordingly, the adjudicator held that the surveillance was not justified or admissible.

Page 31: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

30

There was no evidence that the grievor had ever been other than an honest employee and

the employer could have used a number of other means to test the veracity of his claims,

including an independent medical examination.

Two cases dealing with access to information, one emanating from the Privacy

Commissioner in Saskatchewan (upheld on appeal) and the second from the Federal

Privacy Commissioner (overturned on appeal), merit review

In Fogel v. Regina School Division No.4 [2002] S.J. No. 141, the employee in

question appealed from a decision of the Information and Privacy Commissioner

pursuant to s.46 of The Local Authority Freedom and Information and Protection of

Privacy Act, S.S. 1990-91, c. L-27.1 ("the Act"). That Act deals with right of access to

documents of local authorities and rights of privacy with respect to personal information

held by local authorities which are defined as including any Board of Education within

the meaning of The Education Act.

The Appellant, Marsha Fogel, was a teacher employed by the Board of Education

with 25 years of teaching experience. Some concerns were raised about her by a parent

and certain steps were taken by the Board of Education in response. She was placed on

an extensive performance evaluation process but did not receive the specific parental

concerns that initiated the evaluation process. As a result the Saskatchewan Teacher's

Federation made application on her behalf under the Act for copies of all correspondence

that expressed any views or opinions about her originating from a variety of sources.

Page 32: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

31

The Board of Education denied access to the records on the basis that they were

exempt from the Act because they constitute "personal information that is evaluative or

opinion material compiled solely for the purpose of determining the individual suitability,

eligibility or qualifications for employment."

The matter was put before the Information and Privacy Commissioner for review.

He concluded that the documents did fall within the exemption contained in the Act, that

it was evaluative or opinion material compiled solely for the purpose of determining

individual suitability for employment and that the information was provided in

confidence to the Board of Education. \~

'.'.

On appeal to the Court of Queen's Bench the court agreed with the findings of the

Privacy Commissioner. The judge rejected the argument that the exemption contained in

the ACt applies only to an individual's initial hiring and concluded that evaluating

suitability for employment can take place not only during the hiring process but also

during the employee's tenure. He concluded that the provisions of the Act allowed for

the refusal to provide the information and, in addition, determined that certain provisions

of the collective bargaining agreement to which the individual was subject also addressed

the issue of confidentiality and justified the refusal of access. A further appeal to the

Saskatchewan Court of Appeal was dismissed.

Page 33: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

32

In L'Ecuyer v. Aeroports De Montreal [2004] A.c.F. No. 1082, the Federal Court

of Canada considered how the law contained in PIPEDA is to be applied in unionized

workplaces. In that case the particular employee had been the subject of a number of

complaints, some which had resulted in discipline. She applied to her supervisor to have

access to documentation relating to those complaints and relied on the provisions of

PIPEDA. Her request was refused and a copy of the refusal was sent to representatives

of the union and to the airport's employee relations coordinator.

The employee complained to the Federal Privacy Commissioner on two counts.

Her first complaint was that the employer had violated PIPEDA by denying her access to

her own personal information. Her second complaint alleged that the employer had

disclosed her personal information without her consent by providing a copy of the refusal

letter to union representatives and to the employee relations co-coordinator.

The Federal Privacy Commissioner sided with the employee except in relation to

the copying of the letter to the employee relations co-coordinator. It was only in that

regard that he found that the complaint was not well-founded.

Notwi,thstanding her success before the Federal Privacy Commissioner Ms.

L'Ecuyer made an application to the Federal Court of Canada for a hearing pursuant to

Section 14(1) of PIPEDA. Only the court is able to -award damages or to issue a binding

order against a respondent. The Privacy Commissioner does not have that power.

Page 34: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

33

The court found that, notwithstanding the provisions of PIPEDA, the Privacy

Commissioner had no jurisdiction to hear the complaint brought by Ms. L'Ecuyer and the

Federal Court had no jurisdiction to hear her application under S.14(1) of PIPEDA. Both

complaints were inextricably linked to the employment relationship between the parties

and, given that the employee was a member of a union, all matters and disputes related to

that relationship had to be resolved by way of arbitration under the provisions of The

Canada Labour Code.

It will be interesting to see whether the decision of the Federal Court will remove

from the Privacy Commissioner's jurisdiction many federally regulated employees who

are subject to collective agreements. The court noted in that case that the collective

agreement did specifically address rights of access to personnel files and concluded that

that particular portion of the collective agreement, rather than PIPEDA, would govern the

situation. One wonders what might have happened if the collective agreement had been

silent on that point.

Notwithstanding that PIPEDA does not apply in Saskatchewan to non-federally

regulated employment relationships and notwithstanding that we do not at present have

substantially similar legislation in the province,employers should still give. consideration

to putting into place mechanisms that recognize the privacy principles contained in

PIPEDA. Those measures might include the following:

Page 35: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

34

1. Consider appointing someone within the organization to take responsibility

for privacy matters and to deal with complaints that might arise in that regard.

2. Review employment applications with a view to ensuring that only proper

information is requested.

3. Consider including a statement in an application and in any employment

agreements as to the purposes for which personal information will be used and

containing a consent to the collection, use and disclosure of employee

personal information for those purposes.

4. Review the practices that the employer has for retaining and safeguarding

information respecting employees such as personnel files and discipline

records. The information should only be retained for as long as is necessary

to fulfill the purpose for which it was collected.

5. Review the practices that the employer has in place for conducting

surveillance or for drug and alcohol testing and, in general, respecting

investigations about employees, particularly where there is an allegation of

employee misconduct. Consider the three-part test that was articulated by the

Supreme Court of Canada in Meiorin and ensure that those criteria are met

respecting any measures that might be initiated.

Page 36: PRIVACY IN THEWORKPLACEredengine.lawsociety.sk.ca › inmagicgenie › document... · private sector privacy laws that provide full coverage ofemployees and employee information

35

6. Develop and distribute to the employees any relevant policies concerning

surveillance, use of internet and e-mails, telephone use and the like. Make

sure the employees know that they may be subject to scrutiny and to

investigation and have them consent to that process.

7. Review the basis on which the employer provides references, including

whether the organization will provide any information about the employee

without written consent.

8. Design a process to allow employees to challenge the organization's

compliance with privacy practices.

Given the likelihood that Saskatchewan will at some point see the introduction of

information along the same lines as PIPEDA, employers should consider addressing

those compliance issues now. It makes good business sense and may be necessary in any

event if certain of the service providers that the employer deals with who regard

themselv.es as bound by PIPEDA demand the same compliance by that organization.