Workplace Privacy
Ontario and Québec Issues
1
Workplace Privacy - Ontario and Québec Issues
•
•
•
•
•
•
The impact of privacy rights on the hiring process
Privacy in the workplace: a fine balance
Implementing key policies
Adopting best practices
Privacy law and employee terminations
Key decisions in Ontario and Québec
2
“Employee privacy is like the laboratory of privacy law.”
- Elizabeth Denham, British Columbia Information and
Privacy Commissioner
3
Privacy in the Workplace: A Fine Balance
management rights
business needs
privacy rights of
employees
rapid social changes
new technology
torts and privacy legislation
4
Privacy Law and Jian Ghomeshi
“We have requested and received assurances from the CBC
that [union] members who take part in this process will be
protected and won’t have to fear for their personal privacy…”
- Marc-Philippe Laurin, President of the Canadian Media Guild
5
Privacy Law and Jian Ghomeshi
“Citing privacy concerns, CBC spokesperson Chuck
Thompson said in an interview that the details of specific
complaints would not be made public.”
-Simon Houpt, The Globe and Mail
6
Legislation
7
Legislation (Québec)
•
•
•
•
An Act respecting the Protection of Personal
Information in the Private Sector
An Act to Establish a Legal Framework for Information
Technology
Civil Code of Québec
Québec Charter of Human Rights and Freedoms
8
Legislation (Québec)
•
•
Art. 3 CCQ. Every person is the holder of personality
rights, such as the right to life, the right to the
inviolability and integrity of his person, and the right to
the respect of his name, reputation and privacy.
Art. 35 CCQ. Every person has a right to the respect of
his reputation and privacy.
No one may invade the privacy of a person without the
consent of the person unless authorized by law.
9
Legislation (Québec)
•
•
Art. 4 Quebec Charter. Every person has a right to the
safeguard of his dignity, honour and reputation.
Art. 5 Quebec Charter. Every person has a right to
respect for his private life.
10
Legislation (Québec)
•
Art. 36 CCQ. The following acts, in particular, may be considered
as invasions of the privacy of a person:
• intentionally intercepting or using his private communications;
• appropriating or using his image or voice while he is in private
premises;
• keeping his private life under observation by any means;
• using his name, image, likeness or voice for a purpose other
than the legitimate information of the public;
• using his correspondence, manuscripts or other personal
documents.
11
Legislation (Québec)
•
Art. 2088 CCQ. The employee is bound not only to
perform his work with prudence and diligence, but also
to act faithfully and honestly and not to use any
confidential information he obtains in the performance
or in the course of his work.
These obligations continue for a reasonable time after
the contract terminates and permanently where the
information concerns the reputation and private life of
others.
12
An Act respecting the Protection of Personal
Information in the Private Sector
• Art.10. A person carrying on an enterprise must take the
security measures necessary to ensure the protection of
the personal information collected, used, communicated,
kept or destroyed and that are reasonable given the
sensitivity of the information, the purposes for which it is
to be used, the quantity and distribution of the
information and the medium on which it is stored.
13
An Act respecting the Protection of Personal
Information in the Private Sector
• Art. 11. Every person carrying on an enterprise must
ensure that any file held on another person is up to date
and accurate when used to make a decision in relation
to the person concerned.
• Art.12. Once the object of a file has been achieved, no
information contained in it may be used otherwise than
with the consent of the person concerned, subject to the
time limit prescribed by law or by a retention schedule
established by government regulation.
14
Legislation (Ontario)
•
No overarching legislation
applicable to private sector
employers
•
Personal Health Information
Protection Act (PHIPA)
15
Legislation (Ontario)
•
Occupational Health and Safety Act (OHSA)
• s. 63(2) OHSA. No employer shall seek to gain
access, except by an order of the court or other
tribunal or in order to comply with another statute, to
a health record concerning a worker without the
worker’s written consent.
• s. 63 (6) OHSA. The provisions of s. 63 OHSA
prevail over any contradictory provisions in PHIPA
16
Ontario: The Tort of Intrusion Upon Seclusion
17
Jones v. Tsige, 2012 ONCA 32
•
The tort of “intrusion upon seclusion”
•
Tsige accessed the bank records of her spouse’s exwife, Jones, “at least 174 times” over a period of 4 years
•
The information was not published, distributed, or
recorded by Tsige.
18
Jones v. Tsige, 2012 ONCA 32
•
•
•
•
Violated the bank’s Code of Business Conduct and
Ethics
No valid reason for accessing the records
Accessed transactions and other information including
Jones’ address and date of birth
Jones, also an employee of the bank, brought an action
for damages for invasion of privacy and breach of
fiduciary duty.
19
Jones v. Tsige, 2012 ONCA 32
•
•
The Superior Court of Ontario dismissed the claim on
the basis that a tort for breach of privacy was not
recognized in Ontario.
The Ontario Court of Appeal “confirm[ed] the existence
of a right of action for intrusion upon seclusion” as this
amounted to “an incremental step that is consistent with
the role of this court to develop the common law in a
manner consistent with the changing needs of society.”
20
Jones v. Tsige, 2012 ONCA 32
“A right of action for intrusion upon seclusion should be recognized in
Ontario. Privacy has long been recognized as an important underlying
and animating value of various traditional causes of action to protect
personal and territorial privacy. Charter jurisprudence recognizes privacy
as a fundamental value in our law and specifically identifies, as worthy
of protection, a right to informational privacy…Technological change
poses a novel threat to a right of privacy that…has been recognized as a
right that is integral to our social and political order. Finally, the facts
of this case cried out for a remedy.”
- Justice Robert J. Sharpe, Ontario Court of Appeal
21
Jones v. Tsige, 2012 ONCA 32
The key features of the tort :
•
•
•
(1) the conduct must be intentional (includes recklessness)
(2) must have invaded, without lawful justification, the
plaintiff's private affairs or concerns;
(3) a reasonable person would regard the invasion as highly
offensive, causing distress, humiliation or anguish
22
Jones v. Tsige, 2012 ONCA 32
•
Guidelines for determining the quantum of damages:
• (1) The nature, incidence and occasion of the defendant’s
wrongful act;
• (2) The effect of the wrong on the plaintiff’s health, welfare,
social, business or financial position;
• (3) Any relationship, whether domestic or otherwise, between
the parties;
• (4) Any distress, annoyance or embarrassment suffered by the
plaintiff arising from the wrong; and,
• (5) the conduct of the parties, both before and after the wrong,
including any apology or offer of amends made by the
defendant.
23
Jones v. Tsige, 2012 ONCA 32
Further guidelines for determining the quantum of damages:
• Absent pecuniary loss, the award should be “modest but
sufficient to mark the wrong that has been done”;
• Suggested range: up to $20,000;
• Awards of aggravated or punitive damages are neither
excluded nor encouraged;
• Exceptional cases may call for exceptional remedies;
• However, “absent truly exceptional circumstances,” awards
should fall within the suggested range.
24
Jones v. Tsige, 2012 ONCA 32
The Damage Award in this case:
• actions were “deliberate and repeated” but
• no public embarrassment or harm to Jones and
• Tsige apologized
• $10,000.
• Not an exceptional cases that would justify an award of
aggravated or punitive damages
25
McIntosh v. Legal Aid Ontario, 2014 ONSC 6136
•
•
•
Reddick, an employee of Legal Aid Ontario gets the full
name and date of birth of her boyfriend’s ex-girlfriend,
Patrice McIntosh.
Reddick accessed McIntosh’s Children’s Aid file with Legal
Aid Ontario.
Used the information to threaten to report McIntosh to CAS
“in an effort to have [McIntosh’s]…children taken away from
her”.
26
McIntosh v. Legal Aid Ontario, 2014 ONSC 6136
•
•
•
McIntosh filed a complaint with Legal Aid Ontario and with
the Privacy Commissioner of Ontario
Legal Aid Ontario conducted an internal investigation and
then sent a formal apology letter to McIntosh
McIntosh sues Legal Aid Ontario and their employee,
Cassandra Reddick
27
McIntosh v. Legal Aid Ontario, 2014 ONSC 6136
•
•
•
•
No further disclosure of McIntosh’s personal information
Legal Aid Ontario acknowledged the breach of McIntosh’s
privacy in the letter of apology
Reddick had accessed the file “for an improper purpose”
The breach was sufficient to give rise to liability based on the
tort of intrusion upon seclusion
28
McIntosh v. Legal Aid Ontario, 2014 ONSC 6136
Damages
• McIntosh’s anxiety predated the breach of her privacy.
• Dismissed the claim for loss of wages.
• Based on the guidelines set out in Jones v. Tsige, the judge
granted general damages in the amount of $10,000.
• This case did not involve “exceptional circumstances” that
would have justified an award of punitive damages.
29
Evans v. The Bank of Nova Scotia, 2014 ONSC 2135
•
•
•
Class action brought by 643 clients of the Bank of Nova
Scotia for damages that include breach of privacy rights
based on the tort of intrusion upon seclusion.
Wilson, an employee of the Bank, provided the “private
and confidential information” of numerous clients of the
Bank to his girlfriend.
Wilson’s girlfriend subsequently communicated the
information to third parties for “fraudulent and improper
purposes”
30
Evans v. The Bank of Nova Scotia, 2014 ONSC 2135
“[I]t is not plain and obvious in these circumstances that the
Bank would not be held vicariously liable for the serious wrongful
conduct of its employee in these circumstances…especially
because of the connection between the risk created by the Bank
and the wrongful conduct of its employee.”
-Justice Robert Smith, Ontario Superior Court of Justice
31
Evans v. The Bank of Nova Scotia, 2014 ONSC 2135
“the bank created the opportunity for Wilson to abuse his power by
allowing him unsupervised access to customers’ private information
without installing any monitoring system”
“was given complete power in relation to the [clients’]…confidential
information.”
“it is not settled law that damages awarded for the tort of intrusion upon
seclusion are treated in the same manner as an award of punitive
damages where an employer, such as the Bank, gives an employee
unsupervised access to customers’ private information.”
32
The Impact of Privacy Rights on the Hiring
Process
•
•
•
•
•
•
Collection and retention of personal information
Unsolicited resumes
Consulting references
Criminal and other forms of background checks
Information gathered from social media and Google
• Risk of errors and inaccuracies
• Risks regarding complaints of discrimination
Interviewing Candidates
33
The Impact of Privacy Rights Throughout the
Employment Relationship
•
•
•
•
•
•
•
•
•
Collection and retention of personal information
Alcohol and drug testing
Criminal record checks
Monitoring social media
Video surveillance
Surveillance of computer systems
GPS tracking
Biometric scanning
Confidentiality
34
Ontario: Off-Duty Conduct, Employee Privacy, and
the Limits of Progressive Discipline
35
USWA, Loc. 9548 v. Tenaris Algoma Tubes Inc.,
2014 CanLII 26445
•
A crane operator’s employment was terminated after posting
threatening comments on Facebook
•
•
•
•
•
•
Vicious and humiliating comments
Threatening sexual assault of a colleague
Colleague’s name not used, but she was clearly identifiable based
on a reference to a personal characteristic and nickname
Co-workers were among the employee’s Facebook “friends”
The employee had not used any privacy settings to limit the reach
of the comments
Comments were deleted 10 hours after posting
36
USWA, Loc. 9548 v. Tenaris Algoma Tubes Inc.,
2014 CanLII 26445
•
Union argued that the Facebook and social media are not
specifically addressed in the company’s workplace policies and that
the policies do not state that discipline or discharge are possible
results of misuse of social media.
37
USWA, Loc. 9548 v. Tenaris Algoma Tubes Inc.,
2014 CanLII 26445
•
The arbitrator maintained that
•
“[T]he point of posting on Facebook is to “share” one’s views with other
people. It is an act of publicity…This is not “off duty” conduct because
it was directed at poisoning X’s work environment.”
•
“It is obvious that the policies would include threats and harassment
via Facebook and that discipline and discharge is a potential response
to threats or harassment. I do not find, therefore, that the fact the
policies do not refer to social media or the possibility of discipline to be
a mitigating factor.”
38
USWA, Loc. 9548 v. Tenaris Algoma Tubes Inc.,
2014 CanLII 26445
•
The union argued that the company’s investigation into the matter
was not adequate since a written statement was not obtained from
the grievor.
39
USWA, Loc. 9548 v. Tenaris Algoma Tubes Inc.,
2014 CanLII 26445
•
The arbitrator disagreed:
• “A statement is an opportunity for an employee to tell the
employer what happened. It can be useful to get it in writing but
there is no requirement that it be in writing unless a company’s
own policy says so. In this case, the company had the posts
and they speak for themselves. They were on the grievor’s
Facebook and he admitted they were his. The company did not
need to ask the grievor if he had been provoked because there
could be no excuse for saying such awful things.”
40
USWA, Loc. 9548 v. Tenaris Algoma Tubes Inc.,
2014 CanLII 26445
•
•
•
•
•
Progressive discipline is not appropriate in all cases
Not a long-term employee
Risk of recidivism
Absence of specific reference to social media in employer
policies was not a mitigating factor
Termination of employment was justified given these factors
and the company’s responsibility to maintain a harassment
free workplace
41
Community Living Fort Frances and District v.
TBayTel, [2011] O.J. No. 2259
•
•
•
The employer, a social service agency, was not granted a
Norwich order to obtain a copy of the text messages that
were sent between an employee, JT, and a client, NS.
Norwich order: “a form of equitable relief whereby a thirdparty to an action or potential action can be required to
disclose information that is otherwise confidential.”
Employer sought to confirm allegations that JT had engaged
in a sexual relationship with NS, thereby contravening the
employer’s policies.
42
Community Living Fort Frances and District v.
TBayTel, [2011] O.J. No. 2259
•
•
•
NS consented in writing to the communication of the
text messages by TBayTel; however, JT refused to
grant consent.
Community Living Fort Frances and District (CLFFD)
sought a court order and argued that the text messages
were the “best evidence” available to demonstrate that
a sexual relationship had occurred.
The judge dismissed CLFFD’s application.
43
Community Living Fort Frances and District v.
TBayTel, [2011] O.J. No. 2259
•
•
The judge acknowledged that CLFFD had evidence that
indicated that the employee had violated their policies.
The judge maintained that the text messages were not
necessary for the employer to be in a position to discipline
the employee in this case.
• “The court must balance the benefit to CLFFD of
compelling disclosure of the information sought against
the prejudice to JT in releasing the information. The
information sought is highly personal and JT has
refused to disclose it to CLFFD.”
44
Community Living Fort Frances and District v.
TBayTel, [2011] O.J. No. 2259
•
•
The judge stated that CLFFD “potentially has access to
the specific information sought by way of an arbitrator's
order for production, should arbitration occur."
The judge reiterated that a Norwich order is "an
intrusive and extraordinary remedy that must be
exercised with caution.“
45
Québec: Off-Duty Conduct, Employee Privacy, and
the Limits of Progressive Discipline
46
Syndicat des travailleurs et travailleuses v. Centre
de santé et des services sociaux de Sept-Îles,
2014 T.A. 699
•
•
A member of the hospital’s support staff was dismissed
for comments published on Facebook
She posted disrespectful comments about her employer
and her colleagues:
« Travail demain je suis en %$^& …Il fallais
ben qu’elle me trouve qu’elle que chose la
%$^& non non sa restera pas lo », « gang de
%$^& »,« %$^& hôpital de merde »
47
Syndicat des travailleurs et travailleuses v. Centre
de santé et des services sociaux de Sept-Îles,
2014 T.A. 699
•
•
•
•
Should the statements posted to Facebook be considered
public remarks?
Can the damage caused to the reputation of the hospital by
the employee’s Facebook comments be
anticipated/estimated?
Did the employee’s Facebook comments cause irreparable
damage to the employment relationship?
Was the employer justified in proceeding directly to
termination?
48
Syndicat des travailleurs et travailleuses v. Centre
de santé et des services sociaux de Sept-Îles,
2014 T.A. 699
•
“ [The comments] are disrespectful, cause harm, and damage the
reputation of the establishment and of a particular person
[employee], and may even lead to a claim of defamation.”
[Translation]
- Text of the termination letter
•
“ By posting the remarks on Facebook to the attention of all those
who had access [to her profile]…it is clear that the employee
committed misconduct that warrants a serious disciplinary
sanction.” [Translation]
- Arbitrator Denis Tremblay
49
Syndicat des travailleurs et travailleuses v. Centre
de santé et des services sociaux de Sept-Îles,
2014 T.A. 699
•
•
•
•
•
•
•
Impact on the work environment
Potential impact on recruitment (difficult to measure)
Not apologetic
Risk of recidivism
Bond of trust has been irreparably broken
No mitigating circumstances to justify a less severe sanction
Her conduct has made her reintegration at the hospital impossible
50
Syndicat des travailleurs et travailleuses v. Centre
de santé et des services sociaux de Sept-Îles,
2014 T.A. 699
“This leads me to conclude that, in this case, termination was a severe
but a fair and reasonable measure, given the consequences of the fault
of the employee on her relationship with her employer. The employer
was justified in not opting for progressive discipline in this case.”
[Translation]
- Arbitrator Denis Tremblay
51
The scope of the expectation of privacy at work
52
The scope of the expectation of privacy at work:
R v. Cole, 2012 SCC 53
•
•
•
•
•
Cole was a teacher in a secondary school
Portable laptop computer was provided by his employer.
Authorized to use the computer for personal use
Computer had a hidden folder that contained nude
photographs of an underage student
Did Cole have a reasonable expectation of privacy with
regard to the laptop provided by his employer?
53
R v. Cole, 2012 SCC 53
According to the Supreme Court, the factors to consider are as
follows:
•
•
•
•
•
Ownership of property (relevant, not determinative);
The context in which personal information is placed on the
device/conserved;
The policies, practices, and customs of the workkplace
Written workplace policies (relevant, not determinative); and
The “operational realities” of the workplace.
54
R v. Cole, 2012 SCC 53
“[O]ne must consider the totality of the circumstances in order to
determine whether privacy is a reasonable expectation in the particular
situation”
- Justice Fish, Supreme Court of Canada
55
R v. Cole, 2012 SCC 53
“[The principal had] reasonable power to seize and search a schoolboard-issued laptop if the principal believed on reasonable grounds that
the hard drive contained compromising photographs of a
student…other school board officials had the same implied powers of
search and seizure”
- Justice Fish, Supreme Court of Canada
56
Association du personnel administrative professionel de
l'Université Laval v. Université Laval, Quebec Grievance
Arbitration, 2011
•
•
•
Laval University violated the privacy rights of an employee by
accessing her personal e-mail correspondence
The university had a policy that permitted employees to use office
computers for occasional personal use
The employer was required to pay a sum equivalent to the union’s
costs for the arbitration of the grievance
57
Brûlé Murray & Associés inc. et Cloutier, 2014 QCCLP
5982
•
•
•
•
Employer suspected that the employee was not actually suffering
from head and neck trauma
Employer engaged in surveillance of the employee
No reasonable motives for the surveillance
The video evidence was rejected by the Commission des lésions
professionnelles
58
The right to anonymity
59
Right to anonymity: R v. Spencer, 2014 SCC 43
•
•
•
•
A police investigation revealed that a particular Internet Protocol
(IP) address had been used to access child pornography
The police requested that the Internet Service Provider (ISP)
communicate the name and address of the individual linked to the
IP address
This information was gathered without prior judicial authorization
The Supreme Court maintains that a warrant or prior judicial
authorization will be required before personal information can be
provided without an individual’s consent
60
Workplace
Policies
61
Communication of Policies
•
•
•
•
•
•
Define the scope and limitations of the expectation of privacy in the
workplace;
Use clear and concise language;
Use precise terminology;
Ensure that your policies have been clearly communicated to
employees;
Ensure that your policies are readily accessible to employees; and
Ensure that your policies are up-to-date.
62
Workplace Policies (a non-exhaustive list)
•
•
•
•
Acceptable Use Policy
Privacy Policy
Bring Your Own Device (BYOD) Policy
Social Media Policy
63
Essential Elements of a BYOD Policy
•
•
•
•
•
•
•
•
Information security;
Data protection;
Confidentiality issues;
Ownership issues – both of the device and of the information contained on
the device;
Information regarding any tracking/monitoring and the limits therof;
Procedures upon termination of employment;
Guidance regarding how to assess security of Wi-Fi networks; and
Acceptable and unacceptable behaviour.
-BYOD White Paper,Ontario Information and Privacy Commission
64
Unacceptable Use of Network and Devices
The Canada Treasury Board’s Policy on Acceptable
Network and Device Use
Types of unacceptable use include:
• possession, downloading, or distribution of child
pornography, defamation, hacking, disclosing or
collecting confidential data without authorization,
copyright infringement, posting inaccurate information
that could lead to suits for negligent misrepresentation
65
Implementing Policies: Employee Conduct Subject
to Discipline
For instance:
• The employee’s behaviour is damaging to the
employer’s reputation/image (Syndicat des travailleurs
et travailleuses v. Centre de santé et des services
sociaux de Sept-Îles)
• The behaviour of the employee is offensive to other
employees and contravenes the law (USWA, Loc. 9548
v. Tenaris Algoma Tubes Inc.)
• The employee’s conduct is illegal (R v. Cole)
66
Implementing Policies: Choice of Sanction
• Analyze each situation on a case by case basis taking
the context of the matter into account
• Engage in progressive discipline based on the principle
of proportionality
• When in doubt, consult legal counsel
67
Insights for Employers
•
•
•
•
•
•
Privacy law impacts each stage of the employment
relationship.
Quebec has its own distinct legislative framework that
governs privacy in the workplace.
The case law involving the tort of intrusion upon seclusion in
Ontario continues to evolve.
Workplace policies should also evolve as legislation,
jurisprudence, and technology change.
Consider the limits of employee surveillance.
Remember the concept of progressive discipline and the
principle of proportionality when choosing disciplinary
sanctions.
68
Questions? Comments?
Thank you.
Pablo Guzman
Partner, Davis LLP
[email protected]
514.392.8406
Michael S. Richards
Partner, Davis LLP
[email protected]
416.941.5395
69
Descargar

PRESENTATION TITLE