Protecting one’s data is a growing concern in the digital era. Privacy law is evolving just as rapidly, governed by a complex network of provincial legislation and common law.
For Canada’s credit unions and their partners, knowing what’s what on issues of privacy is imperative for maintaining high productivity and mutual goodwill.
Intrusion upon seclusion
The single most important fact to know about Canada’s privacy laws is that one size most definitely does not fit all. Federal businesses are responsible for one set of rules and provincial businesses for another. Naturally, no two provinces have identical guidelines and some, such as Ontario, have yet to hand down laws about many of the latest concerns, such as on the collection, use, disclosure, storage and security of personal information.
The Ontario Court of Appeal recognized the principle of “intrusion upon seclusion,” which states that “one who intentionally intrudes … upon the seclusion of another … is subject to liability to the other for invasion of his privacy”
Happily, most provinces do have specific rules regarding health records and public sector communication. But there are still a lot of areas where the law is much less clear. For example, unionized workplaces have some arbitral case law recognizing workplace privacy rights, but generally only those derived from the collective agreement.
Luckily, these issues are starting to be resolved. The Ontario Court of Appeal recently recognized the principle of “intrusion upon seclusion,” which states that “one who intentionally intrudes … upon the seclusion of another … is subject to liability to the other for invasion of his privacy.”
Employers have already begun to see “intrusion upon seclusion” claims from employees. Such claims involve cases where an unauthorized employer searches an employee’s desk drawers, for example, or eavesdrops on a private phone conversation. As these cases are litigated or arbitrated, privacy laws may become more clearly defined.
It will come as no surprise to most readers that employers can (and do) conduct background checks on job applicants and employees. But in federal courts, as well as in Alberta, Manitoba and B.C., the law is clear: employers must not only provide advance notice of any background checks, but those checks must be limited and reasonable in scope. So an Alberta-based employer cannot check an applicant’s driving record if it wouldn’t be relevant to the position. In addition, in Quebec law, clear consent is required prior to background checks.
Elsewhere, employee protections are a lot less explicit. For instance, a worker in Ontario who feels that her employer has performed an unreasonable background check without notice or consent could make a case that it’s a violation of the common law. But the courts haven’t yet settled whether the employer would actually be in the wrong. For now, this remains a hypothetical.
Litmus tests that were originally developed to evaluate video monitoring are now being applied to other types of monitoring as well, from email use to GPS tracking. The standards for what is and isn’t permitted can be frustratingly inconsistent for employers, though it’s worth noting that employees can allege that unreasonable monitoring is another form of the “intrusion upon seclusion” principle. Once the employee information has been collected, employers are generally permitted to share employee information with third parties – domestic or foreign – provided this information has been collected for reasonable purposes by the employer. However, in most provinces, third-party organizations need to ensure a comparable level of protection and anonymity as the employer.
Sharing the wealth
One issue of note: employees are entitled to access their personal information in the jurisdictions that have privacy legislation. They can also challenge the accuracy and completeness of that data and have it amended appropriately. Naturally, there are a host of exceptions pertaining to third parties and privileged material, but generally speaking, a motivated worker can keep on top of what is – and is not – in her file. Canadian privacy laws are complex, intricate and in a state of perpetual evolution. Faced with even a shadow of a doubt regarding privacy issues, employers are strongly encouraged to seek legal counsel for help in navigating these choppy waters. ◊