In two recent cases out of British Columbia, employers were found to be entitled to collect GPS information from service vehicles and from mobile phones issued to employees. Employees had complained that the collection of the GPS information was contrary to the BC Personal Information Protection Act (PIPA). The complaints were considered by BC’s Information and Privacy Commissioner (IPC).
ThyssenKrupp Elevator (Canada) Limited
Facts: The employer had a practice of assigning company service vehicles to employees. It installed GPS monitoring devices. The devices would allow the company to locate the vehicle and to collect information about engine status and vehicle operation information such as speed, braking, and idling. The employees in question were service employees who kept their vehicles at home and went directly to client locations to begin their workday. They were responsible for going to customer sites and responding to calls.
Decision: The IPC accepted that the use of the GPS information was for reasonable management purposes – ensuring that vehicles were being used in accordance with policy; identifying and making employees aware of driving infractions; having better evidence of locations at a given time; identifying inefficient service routes, as well as ensuring efficient dispatch of vehicles.
The information in question was found to meet the definition of personal information. Under PIPA, employers can collect employee personal information for purposes reasonably required to establish, manage, or terminate the employment relationship as long as the information is collected, used, and disclosed solely for those purposes. Notice must be given to the employees of the purposes for the collection, use, and disclosure of their information.
The IPC found that the purposes were reasonable, taking into account the sensitivity and amount of information as well as the manner of collection and use. In other words, it wasn’t being covertly collected. There was no intent to continuously monitor the drivers driving the vehicle. Nor was the collection of information found to be an affront to the employees’ dignity.
However, since the privacy policy that was intended to provide notice of the collection of information to employees was general in nature, it was found to not be adequate for the purposes of notifying the employees about the collection of the GPS information.
Kone Inc.
Facts: In this case, the complaint was in relation to collection and use of GPS information from cellular phones issued to service mechanic employees. The information was said to be used to ascertain the mechanics’ arrival and departure at the client site, to plan routes for mechanics, to note the location of the mechanic in order to re-prioritize their work for emergency calls, and as a safety measure where a phone had been stationary for more than 30 minutes.
Decision: Similar to the ThyssenKrupp case, the IPC found that the collection of the personal information was reasonable for the purposes of managing the employment relationship. The purposes were legitimate, reasonable business purposes – knowing where employees were during working hours, maximizing efficiency for vehicle routing and dispatch, and providing better customer service.
In determining that the collection was reasonable, the IPC noted that the employer didn’t continuously monitor the GPS information. There were legitimate business purposes for using the technology. The information related to the employees’ location during working hours. The information wasn’t considered to be sensitive, and there was no impact to the employees’ dignity.
Notice was found to have been properly given in the form of a privacy policy and a notification letter to employees. However, the IPC still recommended that the employer create a specific policy for the collection of GPS data from the phones.
Also of interest was the argument by the employer that the IPC was without jurisdiction. The IPC found that, regardless of the existence of a collective agreement, the IPC had jurisdiction to determine whether or not the organization was complying with PIPA.
Takeaway for employers
Businesses in Canada can have greater comfort that it’s reasonable for them to collect personal information about their employees’ working hours, how their employees are driving company equipment, and to ensure the most efficient customer service and productivity. There are limits to the collection, which include not being overly invasive, not collecting information that is unnecessary to meet the purposes, considering the sensitivity of the information in question, and ensuring that the collection doesn’t result in an affront to the employees’ dignity. There is also the requirement for notice, a requirement often missed by employers.
While the decisions are in relation to the BC PIPA, the Alberta PIPA is very similar to the BC legislation in relation to these provisions, and it’s not uncommon for arbitrators and other privacy commissioners to follow the principles adopted by the IPC. Other provinces also have similar privacy legislation to greater or lesser degrees.
These decisions show a reasonable pragmatism in interpreting privacy legislation, so as not to interfere with businesses being able to operate in the most efficient manner. As noted by the IPC in another case, PIPA isn’t technologically prescriptive. It’s based instead on a balancing of interests test, which can evolve over time as technology develops.
The reasonableness test will be subject to changes in technology, changes in business practices, and expectations in society. This normative approach to the interpretation of the legislation going forward also will continue to be of assistance to employers as technology inevitably will change the landscape of the workplace.
