Monitoring Employer-Issued Communication Devices: Know the Implications of Privacy Laws

Managing personal vs. business usage of employer-issued communication devices is a common issue facing employers in today’s workplace. An extensive amount of information is exchanged every day, some of which constitutes an employee’s “personal information.” An employer attempting to oversee or monitor the employee’s personal usage of these devices, must ensure they do so in accordance with privacy legislation.

In most provinces, the collection and use of personal information by private organizations is federally regulated by the Personal Information Protection and Electronic Documents Act (“PIPEDA”). Provincial jurisdictions that have enacted substantially similar legislation are exempt from PIPEDA, including British Columbia, Alberta, Quebec and in the near future, Manitoba.

Recently, a decision of Alberta’s Privacy Commissioner emphasized the importance of having a clearly-drafted agreement or policy relating to the use and monitoring of employer-issued communication devices. In this case, an employee alleged that his employer contravened Alberta’s privacy legislation by tracing personal telephone calls he made using a company-issued Blackberry device.

The employer became suspicious of personal phone calls when one of its human resource officers uncovered long distance phone numbers on the employee’s phone invoice. The officer called the phone numbers and uncovered the identities and nature of the phone calls. As a result, the employee was confronted about his phone usage. The employee filed a complaint with the Privacy Commissioner alleging that his personal information, being the identities and nature of the phone calls, was unlawfully collected and used by his employer. The employer argued that the collection and use of the employee’s personal information, was permitted by law.

Alberta’s legislation (as well as PIPEDA) allows for the collection and use of an employee’s personal information, without the employee’s consent, in limited circumstances, including for the purpose of investigating breaches of an employment agreement. In this case, there was no employment agreement in place preventing Blackberry devices from being used for personal use; therefore, there was no basis for an investigation. In concluding that the employer acted unlawfully, the Privacy Commissioner also considered other permissible collections of personal information under Alberta’s legislation; however, they are not found within PIPEDA and thus, are not relevant for Atlantic Canadian employers.

Although not a factor in this decision, if the employer obtains written consent of the employee, it can collect and use the employee’s personal information for appropriate purposes. To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.

To ensure compliance with privacy legislation when monitoring employer-issued communication devices it is prudent for the employer to:

1. Incorporate a rule or policy into an employment agreement that clearly outlines acceptable phone usage and, in particular, states what type of phone calls are impermissible;
2. Obtain the employee’s written consent prior to collecting and using any personal information. This can be accomplished by executing an employment agreement or by obtaining written acknowledgment of a privacy policy;
3. Identify an appropriate purpose for the collection of personal information and communicate how the information will be used;
4. Frequently review current privacy policies to ensure compliance with the privacy legislation in the particular province;
5. Educate employees of the organization’s responsibilities and obligations under privacy legislation.