Employer accused of forcing consent to security screening

PIPEDA Case Summary #2002-65

[Principle 4.3, Schedule 1; section 5(3)]

Complaint

Thirty-five employees of a company's nuclear products division complained that the company was inappropriately requiring them to consent to the collection of their personal information. Specifically, they alleged that the company was pressuring them to consent to a security clearance check, in default of which they were threatened with job loss or transfer.

Summary of Investigation

The company's nuclear products division is licensed by the Canadian Nuclear Safety Commission (CNSC). In November 2001, the CNSC ordered that its licensees not permit any person to enter or remain in a licensed facility without a facility-access security clearance. This meant that the division's employees were required to pass either a criminal record check (for employees with 10 years or more of service) or a full background check (for employees with less than 10 years of service). Had the company not complied with the CNSC order, it would have lost its licence to produce nuclear fuels and would have had to shut down the division.

Each division employee received an information package including consent forms that specified the type of information to be collected for the security clearance, the firm that was to carry out the collection, and the purpose for the collection. Employees were also advised of a confidentiality agreement between the company and the collecting firm in respect of their personal information. The employees' union negotiated an agreement whereby any employee who did not pass the security check would be able to transfer to another part of the company's plant, though not necessarily at the same job level.

The complainants argued that their consent to the collection of their personal information was not meaningfully voluntary since they faced potentially negative consequences whether they gave consent or not. Employees who gave consent but failed the security check could lose their current positions and be reassigned to other divisions of the company, possibly at lower job levels. Employees who did not give consent could lose employment entirely.

Commissioner's Findings

Issued August 14, 2002

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because the division in question is deemed to be a federal work, undertaking, or business by virtue of the advantage to Canada it provides as a nuclear facility and producer of nuclear fuel.

Application: Section 5(3) states that an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances. Principle 4.3 of Schedule 1 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.

Regarding Principle 4.3, the Commissioner considered two questions: (1) whether the company had collected the personal information of its employees without their knowledge and consent; and (2) whether consent required as a condition of employment could be meaningfully deemed voluntary.

On the first question, he noted that the company had made it clear that it would not collect the employees' personal information without their express consent. On the second question, he determined that, as far as the Act was concerned, the consent was voluntary. He noted that the company had expressly asked the division employees for their consent, and that it had been entirely up to the employees whether to give it or not. He added that the potential for negative consequences in either case did not alter the fact that the complainants had had a choice in the matter.

On the same question, the Commissioner commented that in this case, as in most decisions in life where the prospect of negative consequences was a factor, the pressure the complainants may have felt to consent to the collection had not amounted to duress. Under the Act, the key consideration was not whether there might be consequences to an individual's refusal to give consent, but rather whether the collection itself was reasonable.

Regarding section 5(3), the Commissioner considered whether a reasonable person would consider it appropriate in the circumstances for the company to collect personal information from employees for the purpose of conducting security clearances. He deliberated as follows:

• Given the greatly enhanced concern in recent months about possible acts of terrorism at nuclear facilities, it was entirely reasonable for the CNSC to impose an enhanced security requirement upon its licensees.
• Had the company not complied with CNSC's order, it would have lost its licence to produce nuclear fuels, would no longer have been able to conduct its nuclear products business, would have suffered substantial financial losses, and would have had to lay-off the complainants. It was therefore entirely reasonable that the company had chosen to comply with the order.
• A reasonable person would consider it appropriate in the circumstances for the company, having reasonably decided to comply with a reasonable order, to collect the personal information at issue from its employees for the purpose of conducting security clearance checks.

The Commissioner found therefore that the company had been in compliance with both section 5(3) and Principle 4.3.

He concluded that the complaints were not well-founded.