An individual challenged the requirement to provide the medical diagnosis on her doctor's certificate for sick leave

PIPEDA Case Summary #2003-233

[Principle 4.4 of Schedule 1]

Complaint

An individual complained that her employer, a transportation services company, required that the medical diagnosis be included on the doctor's certificate for sick leave.

Summary of Investigation

The individual is an office worker. Her employer required her to provide a medical certificate for sick leave that exceeded the allowable number of absences without a certificate. The certificate, addressed to the occupational health and safety advisor, was supposed to include the medical diagnosis.

The company explained that "at risk" employees have to provide medical diagnoses because they often work in isolation, put in long hours at work and perform duties that require a great deal of physical strength, agility and alertness. It argued that in many cases the doctor who provides the certificate for an employee is unfamiliar with the demands of the employee's position. The occupational health and safety officers are thus in a better position to judge whether the employee can safely return to work.

The company representatives did however inform the Office of the Privacy Commissioner that some two months after it had demanded the medical diagnosis from this individual, the leave policy was changed and that, under the new policy, office workers would no longer be required to provide the medical reason on the certificate.

Commissioner's Findings

Issued October 3, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies to any federal work, undertaking or business. The Commissioner had jurisdiction in this case because the company is a federal work, undertaking or business as defined in the Act.

Application: Principle 4.4 of Schedule 1 to the Act states that the collection of personal information shall be limited to that which is necessary for the purposes identified by the organization.

The Office of the Privacy Commissioner has long recognized that every employer has the right to ensure that its employees' absences are justified, and the obligation to determine whether its employees are fit to return to work after a period of illness or whether other measures must be taken. It also recognizes that it may be necessary to obtain personal medical information on the employee for this reason. The question is thus, "What quantity of information suffices in a given situation?"

The Commissioner determined the following:

• It is perfectly acceptable and reasonable for the company to have requested a medical certificate for sick leave that exceeds the allowable number of absences without a certificate.
• However, the statement by the employee's doctor should have sufficed to confirm that the absence was justified. The organization was entitled to ask for and obtain a medical certificate, but it was not entitled to ask for details about the nature of the illness.
• This collection of information was abusive inasmuch as the employer did not prove that it was necessary.
• As mentioned previously, the organization informed the Office of the Commissioner that the policy no longer applied to office workers.

The Commissioner concluded that the complaint was well-founded.

Further Considerations

The Commissioner made the following recommendation:

• The organization should re-examine its decision to consider the person's leave to be uncertified sick leave.