The Use of Employee Surveillance – An OIPC Investigation Report
We have become very accustomed to the presence of all kinds of video recording devices in our daily lives – we are recorded when we hire a taxi, withdraw money from an ATM, fill our cars with gas, cross the border, or take the Skytrain. However, as ubiquitous as video surveillance has become, a recent investigation report of the Office of the Information and Privacy Commissioner of BC (the “OIPC”) reminds us of the continued importance of thoughtful and careful consideration of BC’s privacy legislation before making a decision to install video surveillance in a place of business, particularly if the purpose is to monitor employees. The OIPC’s recommendations to the employer as outlined in this report is particularly instructive if you are an organization considering the implementation of video surveillance in your workplace.
The Background to the Investigation
In June 2017, an animal advocacy group released covert video that appeared to show workers of a Lower Mainland “chicken-catching” company engaging in the hitting, kicking and throwing of chickens. Not surprisingly, the public release of this video had an immediate, negative effect on the chicken-catching company’s reputation in the community and with its existing clients. Acting on the advice of a crisis management consultant, the company promptly implemented new working conditions whereby its employees were required to wear surveillance cameras on their persons. In addition to believing that the video cameras would restore customer confidence, the company also believed that if the employees knew they were being monitored, they would be less likely to engage in abuse of the animals, and it would deter the mistreatment of the chickens.
Importantly, the employees subjected to the video surveillance were not the same employees responsible for the prior misconduct; those employees were no longer employed by the company. Further, none of the non-employees, such as client farmers or contractors, received notice that they would be captured by video whenever they entered a chicken barn where the employees were working. For example, no signs were posted to alert individuals that they were entering an area where surveillance was being conducted.
Upon learning of this new body-worn surveillance practice, the OIPC initiated an investigation to determine whether this video surveillance complied with BC’s Personal Information Protection Act (PIPA) and whether the company had appropriate privacy policies in place. The OIPC’s investigation findings that the implementation of this video surveillance was not in compliance with PIPA were released in its report dated November 8, 2017 (the “Report”).
PIPA
PIPA governs the collection, use, and disclosure of personal information by organizations in a manner that recognizes both the right of individuals to protect their personal information and the need of organizations, including employers, to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances. Personal information is defined as “information about an identifiable individual and includes employee personal information but does not include (a) contact information, or (b) work product information.”
Employee personal information is defined as “information about an individual that is collected, used or disclosed solely for the purposes reasonably required to establish, manage or terminate an employment relationship between an organization and that individual, but does not include personal information that is not about an individual’s employment.”
One of the significant issues with the body-worn surveillance used by the chicken-catching company was the fact that the surveillance cameras recorded not only its employees, but contractors and customers as well, who often did not even know they were being recorded.
The OIPC Report Findings
The OIPC determined that the video capture of the employees while they were working on private chicken farms, as well as the video capture of contractors and customers, did constitute collection of personal information without fully informed consent, and that it was not reasonable in the circumstances. Therefore, the company was in breach of PIPA. As a result, the OIPC recommended that the employer cease collecting employee video surveillance, and destroy all existing records collected via the surveillance.
Guidance for Employers
The various recommendations outlined in the OIPC Report are very instructive and helpful to all private organizations governed by PIPA.
1. Consent
With respect to the collection, use and disclosure of personal information, the concept of fully informed consent is key. The individual whose personal information is being collected must be aware of the purposes for collecting it. In this case, the company had only advised the employees that the purpose of the surveillance was a preventative measure to protect the employees’ reputations; the employer did not explicitly inform the employees that the surveillance could be used for managing the employment relationship, and that the company could discipline the employees if the recordings showed that they were not following standard operating procedures. In other words, since the company did not inform its employees of the true purpose for the collection of the video surveillance, the employer did not obtain fully informed consent of its employees to be video-recorded. The company also failed to obtain the consent of the non-employees to the capture of their images and voices by the surveillance cameras.
Further, the purposes for the surveillance were not clearly communicated to the employees or non-employees subject to the surveillance, nor sufficiently obvious. Therefore, there was also no implied consent to the video-recordings. As such, the company did not obtain the consent of each individual whose image was captured, and was not authorized to collect these individuals’ personal information via the body-worn cameras.
2. Last Resort
Surveillance may only be used as a last resort after less privacy invasive measures to achieve a business purpose have been exhausted. For example, it may appropriate when there is a real and serious threat to personal safety or the security of property, the organization has tried all reasonable alternatives without success, and there is a reasonable prospect that the video surveillance will address those threats. Here, there were no prior instances of employee violence, workplace injuries, thefts or other safety concerns that would have justified the necessity of a surveillance system. In this case, the company did not consider any other less invasive methods to inform or manage its employees, such as training, education, spot checking employees, or proper supervision, to ensure that proper chicken handling practices were followed.
3. Privacy Management Program
The best way for an organization to demonstrate compliance with PIPA is to implement a privacy management program tailored to the structure, scale, volume, and sensitivity of the personal information processing activities of the organization. Specifically, organizations must create and maintain privacy policies and practices to ensure the adequate protection of personal information in the organization’s custody or under their control, and to meet their obligations under PIPA. With respect to the privacy policies themselves, the OPIC states that such policies should address the following, at a minimum:
- Requirements for the consent and notification of the collection, use and disclosure of personal information;
- Access to and correction of personal information;
- Retention and disposal of personal information;
- Responsible use of information and information technology, including administrative, physical and technological controls and appropriate access controls; and
- A process for responding to privacy complaints.
The privacy policy of any organization should be provided to its employees, and be available to the public upon request. If your organization has not already done so, we certainly do recommend that you designate a privacy officer responsible for ensuring PIPA compliance.
Conclusions
As noted by the OIPC in its Report, surveillance equipment has become less costly and much more accessible generally. However, organizations and employers alike need to carefully consider the risks to privacy that the installation of video surveillance poses. The lesson of the chicken-catching company investigation is that employers should not be resorting to video surveillance as a quick and easy solution to workplace problems.
