Should spousal or partner consent be obtained for security clearance checks?

PIPEDA Case Summary #2003-232

[Section 5(3); Principle 4.3]

Complaint

An employee of a nuclear facility complained that his employer was requiring employees to provide personal information of spouses or common-law partners for the purpose of a security clearance check without the spouse's or partner's consent.

Summary of Investigation

The employer, a nuclear facility, is licensed by the Canadian Nuclear Safety Commission (CNSC). Following the terrorist attacks in the United States, the CNSC ordered that its licensees not permit any person to enter or remain in a licensed facility without a facility-access security clearance.

To ensure consistency in the security screening forms being used by the different licensees, the CNSC instructed all nuclear installations to use the Treasury Board form TBS/SCT 330-60E. Eleven of the 17 sections on the form must be completed, including part 1 of section D, "Marital status/common-law partnership," which concerns the current spouse/partner only. The Office confirmed that the spousal or partner information is used in the security screening process.

Employee consent to the security screening is obtained via another Treasury Board form. Employees submit the completed consent and security clearance forms to the employer, which verifies that all of the required information has been provided.

Commissioner's Findings

Issued October 1, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a nuclear power plant is considered a federal work, undertaking, or business.

Application: Section 5(3) states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances. Principle 4.3 establishes that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.

The Commissioner deliberated as follows:

• In a previous case involving security clearance checks of employees of nuclear facilities, the complainants argued that their consent was not voluntary because they were threatened with job loss. The Office, however, stated that in many circumstances, consent is not unfettered and must be looked at in the context of the reasonable person test in section 5(3). The Office determined that a reasonable person would find it appropriate for the CNSC to order its licensees to not permit any person without proper clearance to enter their facility, and for a nuclear facility to comply with such a reasonable order by collecting employee personal information. In the Office's view, the same reasoning applies to the company's purposes in the present case.
• In this complaint, the issue is whether the company should be obtaining the spouse's or partner's consent to the collection of his or her personal information. The first matter to examine then was whether a reasonable person would consider it appropriate to collect such information.
• Given that a security check involves a review of as many aspects of the employee's life as possible (place and date of birth, employment history, education, place of residence, and domestic arrangement), and that it is assumed that spouses or common-law partners have intimate knowledge of each other, and share common goals, as well as income and expenses, it would be inappropriate to not conduct an investigation into the background of the current spouse or partner. Since the purpose of the check is to identify potential threats to nuclear installations, and spousal or partner information is key to achieving that goal, a reasonable person would likely view the collection of spousal information to be appropriate, as per section 5(3).
• As for spousal consent, the Commissioner determined that it would not be appropriate for the company to obtain separate consent. In his view, the onus is on the employee to discuss the matter with the spouse or partner and seek consent. Should the spouse or partner not agree, the employee would need to review their options, such as seeking alternative employment. To suggest that the company should obtain separate consent could lead to a situation in which the employee is investigated while the partner is not. Such a scenario would clearly result in the failure to achieve the purposes of conducting the check — purposes already deemed to be entirely appropriate.

Given this, the Commissioner was satisfied that the company was not contravening the consent provisions of the Act by not requesting separate spousal consent.

The Commissioner concluded that the complaint was not well-founded.