PIPEDA Case Summary #287Request for medical information deemed reasonable, but consent procedures not properly followed(Principles 4.3 and 4.4.1, and subsection 5(3)) ComplaintAn employee of a transportation company made two allegations against his employer: (1) that his employer was requiring him to provide more medical information than necessary and would not allow him to return to his position until he supplied the information; and (2) that the company obtained medical information about him from his doctor without his consent. Summary of InvestigationAfter recuperating from a serious illness, the complainant returned to his previous position with his employer. This position was deemed safety sensitive by the company because of its possible impact on the safety of the person in the position or other employees in the company. Before being assigned to a safety sensitive position, an employee must undergo a medical examination to ensure that he/she is fit for duty. When the complainant returned to work, he was considered fit for light work only. He was informed at the time that an annual review would be required to verify his continuing ability to perform the duties of the position. The company stated to the Office that if it becomes aware of a new medical condition for an employee already in a safety sensitive position, the company will evaluate the case and determine what type of follow-up is appropriate to ensure that the employee is fit for duty. The company's medical fitness for duty guidelines outlined the company's commitment to the health and safety of its employees. Its medical guidelines for the employment of individuals in safety sensitive positions govern all medical assessments of fitness for duty for such employees. One year after the complainant had returned to work, the company informed him that because of the position he occupied, he was required to provide medical information that guaranteed that he was not a risk of sudden incapacity. The Office reviewed the documentation sent to the complainant and his physician and established the following:
The complainant had signed a consent form, giving his specialist permission to release information to his employer. This consent was valid for 90 days, but had expired long before the events noted above occurred. The complainant was told that if he did not provide the requested information, he would be restricted from performing the duties of his position. As he did not give his employer the information, he was placed on leave without pay for five months. He eventually provided a note from his new specialist, indicating that he was fit to work. The company was not satisfied with this response, and restricted the employee to working in non-safety sensitive positions only until he could demonstrate that he was fit to carry out his duties in his regular position. FindingsIssued January 5, 2005 Application: Principle 4.3, which states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate; Principle 4.4.1, which stipulates that organizations shall not collect personal information indiscriminately. Both the amount and the type of information collected shall be limited to that which is necessary to fulfil the purposes identified; and subsection 5(3), which establishes that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances. In making her determinations, the Assistant Privacy Commissioner deliberated as follows:
The Assistant Commissioner thus concluded that the allegation that the company was requiring the complainant to provide excessive medical information was not well-founded, while the allegation that the company collected personal information without consent was well-founded. |
Date published: 2005-03-07 |
Important Notices |