Media Centre

Finding the right workplace privacy balance

The Ryerson University Workshop on Workplace Privacy

November 30, 2006
Toronto, Ontario

Address by Jennifer Stoddart
Privacy Commissioner of Canada

(CHECK AGAINST DELIVERY)

Introduction

Thank you very much for inviting me to speak with you.

First, I would like to commend the authors of Under the Radar? – Avner Levin, Mary Foster, Mary Jo Nicholson and Tony Hernandez – for their important paper.

This research makes a considerable contribution to the ongoing debate about balancing the business concerns of employers and the privacy rights of employees. One of its central messages is that employers have to start thinking more about workplace privacy and the potential implications of emerging surveillance technologies.

I agree wholeheartedly. As a society, we are still struggling with the privacy implications of now-common technologies such as video surveillance – never mind the next generation of high-tech ways to monitor workers.

My Office is pleased to have supported this research under its Contributions Program. The results are a perfect example of why this funding program is so important. The report generated a great deal of media interest – putting workplace privacy on Canadians’ radar screen. Newspapers, radio show and television interviewers were all talking about the report – engaging Canadians in the issue of privacy while on the job. I see great value in encouraging other voices, such as the researchers responsible for this paper, to raise the profile of privacy issues.

I’d like to talk with you today about finding the right balance in workplace privacy – and the key role the Office of the Privacy Commissioner is playing in the ongoing evolution of a made-in-Canada approach. We believe workplace privacy principles must respect both the need of employers to know what workers are up to on company time, as well as the basic human right to privacy.

I would also like to take a look at emerging issues and the future of workplace privacy. The working world of the future could be a very scary place if we don’t hold the line on increasingly pervasive monitoring.

History

Workplace surveillance, of course, is nothing new. Feudal lords watched over their serfs. Factory foremen kept a close eye on workers, often women and children, in the factories of the Industrial Revolution.

Automaker Henry Ford was one of history’s most notorious bosses when it comes to trampling on workers’ privacy rights. He hired a team of investigators to regularly visit the homes of his workers to ask questions about their budget, diet, lifestyle and morality. Ford wanted to know whether his workers were treating their families well, voting appropriately, going to church and eating Ford-approved foods – which apparently included soybeans.

What is new in workplace privacy are the ever-more intrusive technologies that allow bosses to track even the smallest movements of their workers.

There’s no longer a need to look over someone’s shoulder to see how quickly their fingers are moving – software can track every keystroke they make or widget they produce. Suspicious bosses no longer have to tail delivery workers – Global Positioning Systems can relay back to the office a truck’s every turn and stop. Cell phones and high-tech ID cards can also be used to monitor workers’ movements. One American company has actually implanted the bodies of its workers with Radio Frequency Identification tags (RFIDs).

Just imagine the totalitarian workplace Henry Ford could create with today’s technologies

Searching for Balance

But – contrary to what Ford seemed to believe – workers do not check their privacy rights at the factory or office door. Workplace privacy is an important part of the basic autonomy rights of individuals in our society. People spend a big part of their lives in the workplace.

What happens in the workplace – including whether privacy is respected – can have a profound effect on employees’ sense of dignity, their sense of freedom, and their sense of autonomy. Continual surveillance is dehumanizing. It does not help create an enthusiastic workforce. And I wouldn’t even be surprised if it affects productivity in a negative way.

Of course, some surveillance in the workplace is required – and is acceptable. Employers have the right to know whether workers are doing the job they are paid to do.

Still, employers must find ways of weeding out the bad employees without shattering the dignity and privacy rights of the good employees – who make up the vast majority of the workforce.

Privacy remains a factor – even on company-owned property, on company-owned computers and in company-owned vehicles. There is a line to be drawn when it comes to surveillance – and where this line is drawn cannot simply be dictated by whatever the latest technology can offer. Just because we can put workers under extreme surveillance does not mean we should.

How OPC Strikes a Balance

The Office of the Privacy Commissioner is increasingly concerned about human dignity in the context of surveillance. We have told employers covered by the laws we enforce that they cannot indiscriminately point video cameras at their workforce simply to keep tabs on what everyone is up to – what I call management by video camera. In this area, we are in line with the approach in continental Europe.

In other areas, however, I see Canada adopting a more U.S.-style approach. Companies can look at what we’re doing on the Internet – if they tell us – because we are surfing on company time and with company equipment and energy.

I think there is a qualitative difference between video surveillance and GPS in a vehicle. The information collected by a video camera is far more intimate. When a video camera is pointed at you, you can’t even pause to scratch your nose without that information being collected. GPS can’t do that.

As well, I don’t think it is necessary to have a knee-jerk negative reaction to any new technology that involves personal information. We have found that a phone authentication system involving a biometric – a voiceprint – was acceptable in that context. In findings released today, we approved, with certain provisos, a company’s use of GPS in its fleet vehicles.

That said, employers cannot take away rights simply by posting a sign at their entrances warning everyone who enters: “There’s no privacy here.”

PIPEDA and Workplace Privacy

Canada’s private-sector privacy law, the Personal Information Protection and Electronic Documents Act, or PIPEDA, protects the information of employees working for companies operating in federally regulated sectors. These include telecommunications, broadcasting, inter-provincial transportation, aviation, banking, nuclear energy, maritime navigation and shipping.

Employers in the covered sectors must respect a set of widely accepted privacy principles. Basically, these require the following:

Organizations must – except in a few limited circumstances – have an employee’s consent before collecting, using or disclosing personal information.

They can only use or disclose employees’ personal information for the purposes for which consent was given at the time the information was collected.

Even with consent, organizations must limit collection, use and disclosure of personal information to purposes that a reasonable person would consider appropriate in the circumstances. This is often the key issue we consider in our investigations related to workplace surveillance.

Finally, PIPEDA offers employees the right to see the personal information that their employer holds about them, and to correct any inaccuracies.

OPC Workplace Privacy Investigations

PIPEDA has been in full force for almost three years. We’ve investigated a number of workplace-related complaints. Many come from workers who have had difficulty accessing their personal information. Other complaints have dealt with surveillance of one kind or another – from audio and videotaping to more advanced technologies such as biometrics and Global Positioning Systems.

One case involved a rather clumsy attempt to record air travel workers in a smoking room. A manager had tried to tape a digital recorder under the table, but apparently the duct tape she used was not very strong and the machine tumbled onto the floor, where the workers soon found it.

Most of our workplace surveillance cases have involved video cameras.

Video Surveillance

One of those investigations involved an Internet service provider that had pointed web cameras at its workers. Among the company’s chief concerns was that staff working on the weekend – when it didn’t want to pay supervisors to come in – were leaving phones unattended and taking too many breaks. We found there were less privacy intrusive ways to address the company’s concerns.

Companies thinking about installing video cameras or other surveillance measures in the workplace should consider the four-part test my Office generally uses:

• Is the monitoring demonstrably necessary to meet a specific need?
• Is it likely to be effective in meeting that need?
• Is the loss of privacy proportional to the benefit gained?
• Is there a less privacy-intrusive way of achieving the same end?

Newer Types of Surveillance

That test also applies as companies consider whether to adopt newer types of surveillance technologies – such as biometrics.

In another case, several employees complained to us that their employer was forcing them to consent to the collection of their biometric information – specifically their voice print – in order to access a phone system for logging work-related information and to report work absences. Basically, the person’s voice acts as a password to the system. When employees call in, they are prompted to say a series of digits several times. The system software converts the spoken digits into a matrix of numbers that represent the behavioural and physical characteristics of the way the person speaks.

The company determined this system offered the highest level of security for customer data logged through its business applications.  It is also very cost-efficient. Employees worried about the possibility it could be used to impersonate them, something we concluded was impossible. We found that – under the circumstances in this case – a voice print was not unduly invasive. The company correctly viewed protecting customer data as important. There was an appropriate balance between the employees’ right to privacy and the employer’s needs.

However, this case is now before the Federal Court of Appeal to determine a number of issues, including how to assess "voluntariness" of employee consent in an employment context; whether employees can be disciplined for exercising their lawful rights under PIPEDA; and whether PIPEDA requires the company to seek union consent before collecting personal information from employees.

New GPS Findings

As I mentioned earlier, my Office has just today released the findings on our web site of an investigation launched after several employees of a telecommunications company complained their employer was installing GPS in work vehicles.

The workers argued the company was improperly collecting their personal information – specifically their daily movements while on the job. They said no consent had been obtained.

The company pointed out that GPS is already being used by other companies. It argued that, in order to remain competitive, it needed to put GPS in all its installation and repair and construction vehicles. The system allows the company to view and track the location of its vehicles in real-time and produce reports using historical data. The company said it wanted to use GPS to manage workforce productivity, ensure safety and development, and protect and manage assets.

Some workers were concerned GPS information would be used to monitor work performance and punish employees. The company rejected the notion that managers would be spending time monitoring employees via GPS. It noted that GPS does not automatically notify managers if an employee is speeding. A manager would have to generate a report in order to glean such information. The company did acknowledge, however, that GPS could be used to investigate or monitor a worker when there are concerns about shoddy work, or someone not showing up to job sites on time, or complaints about someone’s driving.

We accepted most of the company’s stated purposes for collecting and using personal information gathered by GPS. We found there was implied consent for those purposes.

Our biggest concern was about using GPS as an employee surveillance tool.

During the course of our investigation, the company agreed to develop a policy on the use of GPS to monitor workers and their performance on the job. It also promised to train its managers on the appropriate use of GPS.

The policy subsequently prepared by the company spelled out situations in which the company will use GPS data to monitor employees. These include an investigation into a complaint from a member of the public – about speeding, for example; or an investigation into concerns raised within the company; or to address productivity problems.

It is one thing to track the location of a company vehicle. However, using GPS to routinely track the every move of employees, and then using that information to make assumptions about employee performance is overly privacy invasive. 

GPS, in and of itself, is not highly privacy intrusive because it only tells part of the story. For example, if a truck is parked at lunchtime, GPS does not tell an employer where the employee is. It may indicate how long someone is at lunch, but, then again, it may not.

That kind of imprecision could cause bosses to draw the wrong conclusion about how an employee is doing her job.

The truck may be stopped for an hour and a half because the employee is taking an overly long lunch break. On the other hand, the employee might be sitting in the parked truck, catching up on paperwork.

Systematically using GPS to check up on workers and draw conclusions about how well they are doing their jobs could be terribly unfair, and, from a privacy standpoint, is clearly going too far. Employers do not have carte blanche to use GPS to constantly monitor their workforce.

We could accept such a use in some circumstances – when they are defined for employees beforehand. But GPS should not routinely be used to monitor how well – or not – workers are doing their jobs.

We were satisfied with the company’s response to our concern and ultimately considered the complaints resolved.

However, GPS and other emerging technologies raise broader concerns about “function creep” – that a technology introduced for one purpose will later be used for some other purpose for which it was not originally intended. In other words, I don’t want to see GPS installed for tracking vehicles to wind up becoming a systematic employee surveillance tool.

RFID Technologies

We have yet to receive a complaint involving Radio Frequency Identification Devices (RFIDs), however, we are currently working on a document to provide employers with guidance on this technology.

We are just beginning to see RFIDs being for employee monitoring. IBM, for example, is marketing the use of an RFID tag embedded in ID badges. Receivers throughout the work site can track the exact location of the tag – and therefore the worker – at any moment. Tags can also be attached to tools, machinery and other items.

As the cost of implementing RFID systems drops over the next few years, organizations may be increasingly tempted to use them to track productivity, improve security and reduce theft. These possibilities all add a new dimension to employee surveillance.

RFIDs are small enough to be implanted into individuals and some people argue such implants could be useful for some types of jobs. Earlier this year, a security company in Ohio implanted two workers with RFID chips to allow them to access company property. This may well be the beginning of a worrying new trend.

PIPEDA Review

Parliament is just beginning a review of PIPEDA, a process the law requires every five years.  Earlier this week I appeared before a parliamentary committee on this matter, and my statement and submission are available on our web site.

Employer Attitudes

I was disappointed by some of the employer attitudes reflected in Under the Radar? Some apparently see workplace privacy as a privilege granted to employees. No one agrees with the notion that workers are entitled to some measure of privacy that cannot be taken away. This is deeply concerning to a privacy advocate.

Perhaps those employers need to ask themselves some questions. How would you like to have cameras in the executive washroom? How would you feel if a video camera were pointed at your desk all day long?

Employers apparently think privacy is a non-issue and that their employees are not concerned about it. This is not our experience.

I would also like to address comments in the report from employers who believe privacy is a matter of “common sense” and therefore no policies are necessary. Common sense is clearly not enough.

Former Hewlett-Packard chairwoman Patricia Dunn caused quite an uproar when it became public that she had spied on her own board members, employees and journalists. No doubt Ms. Dunn felt that what she did was “common sense” and entirely necessary for her company.

Back in his time, Henry Ford probably thought his worker home visits were entirely appropriate. Investigators from my Office have encountered employers who believe they have an unfettered right to monitor everything an employee does on company time.

The current trend is more monitoring, not less. “Common sense” does not tell us where to draw the line.

Surveys also suggest there is sometimes a gap between what employers and employees think is an acceptable privacy practice. 

A survey by the U.S.-based Society for Human Resource Management found 90 per cent of human-resources managers think organizations have the right to monitor employees’ computer and phone use, versus about 70 per cent of employees. The vast majority of HR professionals – almost 90 per cent – believed organizations have the right to monitor Internet use, compared with about 60 per cent of employees.

Again, I come back to the issue: Where do we draw the line?

The Road Ahead

There is no clear-cut answer to that question.

At a minimum, however, employers need to tell employees – very, very clearly – what will and will not be monitored. Policies on privacy issues must be developed and given to employees. Tell people. You cannot assume people know anything about how they are – or are not – being watched. And, I’ll stress again, when companies develop such policies, they should always look to the least privacy intrusive way of getting the information needed to run the business.

In the workplace, good privacy practice is not just about avoiding complaints, grievances, or lawsuits. Fostering a workplace culture where privacy is talked about, valued and respected contributes to morale and mutual trust.

I would like to see the privacy rights of every worker in Canada protected under law. Unfortunately, federal-provincial jurisdictional issues make that impossible under PIPEDA. I hope the provinces which have not already passed workplace privacy legislation will turn their attention to this.

Without strong laws, I worry where we are headed.

Our proximity and close business ties to the United States – where employers are happily adopting all kinds of new monitoring technologies – make it inevitable that more of these issues will be cropping up here in the near future.

We need to be constantly vigilant. Privacy gets eroded bit by bit. I worry that one day employers will tell workers: You have a job; not privacy.

As Canada’s privacy guardian, I will continue trying to hold the line on the growing ability of employers to subject their workers to various forms of monitoring and surveillance.

Sometimes organizations – in a quest to be proactive – resort to technology in anticipation of problems or as a means to maintain competitiveness. The worker’s rights are slowly eroded by the cumulative effects of measures intended to meet the bottom line.

The effects on the dignity of employees of all the potentially privacy-intrusive measures in place must be considered in balancing the rights of the individual to privacy and the needs of organizations to collect, use or disclose personal information.

I hope I’ve given you some food for thought today about why you should also be fighting for the cause of maintaining the right of workers – the right of people – to privacy, even while on the job.

In closing, I’d like to mention that my Office is hosting a major international conference on privacy issues next fall in Montreal. The 29th International Conference of Data Protection and Privacy Commissioners will bring together some of the world's foremost data protection experts to talk about the challenges ahead, including those we’re examining today. I hope you’ll consider joining me there.