Company's collection and disclosure of employee sick leave information

PIPEDA Case Summary #2003-191

[Principles 4.3 and 4.4, Schedule 1; section 7(3)(i)]

Complaint

An employee complained that a telecommunications company

1. was collecting more personal medical information from its employees than was necessary to fulfil identified purposes, and
2. had improperly disclosed personal information about her to a third party, namely the provincial Workers' Compensation Board, without her consent.

Summary of Investigation

At the beginning of an extended sick leave, the complainant submitted to the company a completed medical form containing a specific diagnosis from her doctor, who had indicated that her disablement was work-related. The company then submitted to the provincial Workers' Compensation Board (WCB) a standard report that served both to notify the WCB of an alleged work-related disablement and to initiate a claim for compensation on the subject's behalf. A WCB adjudicator then called a human resources coordinator for the company to investigate the claim.

After obtaining a copy of the complainant's original medical form, the adjudicator made particular inquiries about whether or not the disablement in question was work-related. The coordinator confirmed that the complainant had previously missed work for a similar reason, expressed her belief that the previous absence had been due to personal, not work-related, circumstances, but could not say whether the current absence was work-related or not. The complainant subsequently received a letter from the adjudicator, outlining the WCB's decision to the effect that the claim was refused for lack of evidence that the disablement was work-related. In that letter, the adjudicator made reference to the conversation with the company's human resources coordinator.

The complainant objected that the company had disclosed her personal information to the WCB without her consent. She considered the disclosures inappropriate and unjustified, in that she had not herself made any claim for compensation from the WCB and did not consider the company coordinator's comments to have been relevant.

The company pointed out that the disclosures were not only appropriate, but required by the provincial workers' compensation legislation to which it was subject. That legislation requires that subscribers immediately notify the WCB of any work-related disablement or allegation of such. It also authorizes the WCB to make inquiries about claims and obligates subscribers to respond to such inquiries.

The complainant also objected to the company's requirement for certification by a medical practitioner. In general, she considered it unnecessary and unreasonable for the company to demand a medical report in every case of sick leave, even for absences of only one day, as she believed to be the company's policy. In fact, the policy states that a medical report normally is to be requested only in a case of absence for more than three days. The company does reserve the right, however, to request a report even for a one-day absence in certain cases - notably chronic cases.

More particularly, the complainant objected to the requirement for a medical practitioner to provide a specific diagnosis. She contended that the company should be satisfied with a more general description of the nature of a disablement - such as "illness" or "injury", "work-related" or otherwise.

The company argued that its request for specific diagnoses was necessary for purposes of managing both a short-term and a long-term disability plan for employees. Notably, eligibility for benefits under the long-term plan is determined on the basis of short-term benefits drawn over a certain number of days for the same specific disablement.

In terms of the Act, the company justified its collection of personal medical information on the grounds that (1) the purposes are identified both in its short-term disability policy and on its medical report form; (2) the collection is limited to what is necessary for the identified purposes; (3) the information is not used or disclosed for purposes other than those for which it has been collected; and (4) the collection is done with the knowledge and consent of the employee, since the medical form contains a consent statement and is signed by the employee.

Commissioner's Findings

Issued July 11, 2003

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because the telecommunications company is a federal work, undertaking, or business as defined in the Act.

Application: Principle 4.4 states that the collection of personal information must be limited to that which is necessary for the purposes identified by the organization. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Section 7(3)(i) is an exemption provision stating that an organization may disclose personal information without the knowledge and consent of the individual if the disclosure is required by law.

In the matter of the collection complaint, the Commissioner determined that it was for reasonable and legitimate purposes that the company collected personal medical information, including specific diagnoses of disablement, from employees in relation to their sick leave. He also determined that the company did appropriately identify those purposes to the individual, that the personal information collected was no more than was necessary for the fulfilment of the purposes, and that the individual's consent to the collection was duly obtained. He found therefore that the company was in compliance with Principle 4.4.

In the matter of the disclosure complaint, the Commissioner determined that the company had disclosed information about the complainant to the provincial WCB without her knowledge and consent. However, he also determined that the disclosures in question had been required by legislation, in that they were pursuant to the company's obligation to respond to inquiries authorized under the province's Workers' Compensation Act. He was satisfied therefore that the company had been exempt in the circumstances, by virtue of section 7(3)(i), from the requirement under Principle 4.3 to have the complainant's consent to the disclosures.

The Commissioner concluded that the complaints were not well-founded.

Further Considerations

In the course of the investigation, it came to light that, even though the company's human resources staff were bound by a confidentiality agreement, the company did not otherwise have in place any policy, procedures, guidelines, or staff training materials specifically relating to the handling of employee information. The Commissioner found this omission to be significant, in that under Principle 4.1 (Accountability) of Schedule 1, an organization is responsible for all personal information under its control - that is, not only the information of clients, but also that of employees.

He therefore recommended that the company take steps, in accordance with Principle 4.1.4, to implement appropriate policies and practices specific to the handling of the personal information of company employees.