Electronic monitoring does not yield any information, but practice is strongly discouraged

PIPEDA Case Summary #2004-268

[Principle 4.3, paragraph 7(1)(b)]

Complaint

Three former employees of a company engaged in air travel complained that their employer tried to collect and use their personal information without their knowledge and consent. Specifically, they alleged that one of their managers had taped a digital recorder to the underside of a table in a smoking room accessible to employees, as well as members of the public, to collect their personal information.

Summary of Investigation

At the time of the incident, the complainants were employed as customer service representatives for the organization. One evening, while they were on a break in the smoking room, they noticed a digital voice recorder that had fallen from the underside of a nearby table. They played the tape to see what had been recorded. The only information was the voice of their manager, repeating the word "testing" three times. The duct tape that had been used to keep the recorder in place had the words "do not touch" written in what appeared to be the same manager's handwriting. One of the complainants immediately erased the tape and contacted management to report the incident.

Management called a meeting shortly afterward to discuss this and other problems. The manager acknowledged to the employees at this meeting, and later to our Office, that she had placed the recorder in the public smoke room to collect information about the complainants. According to the company, it had been having difficulty with these individuals, and friction had been increasing between them and management. In the manager's opinion, there were several factors that led her to believe that the problems the company had been experiencing with these three employees were escalating. Prior to using the recorder, the manager stated that she had consulted with the owner of the company, as well as a member of the RCMP. The RCMP member, although sympathetic to the manager's problems, indicated to our Office that he did not condone the use of a digital voice recorder in the public smoking room, while the owner of the company denied being consulted about the digital voice recorder.

According to the manager, on the evening when she placed the recorder in the public smoking room, she knew that there were no scheduled flights arriving at the facility that evening. The facility operates 24 hours a day, seven days a week. There is always a minimum of one customer service representative, and two technicians on duty, in case an unscheduled flight arrives. The complainants, however, maintained that, on the evening in question, there were four employees in the public smoking room when the digital recorder was found.

The company acknowledged that its manager had attempted to collect the employees' personal information without their knowledge and consent, but that it did so in a context that would be permissible under paragraph 7(1)(b) of the Act. This provision allows an organization to collect personal information without knowledge and consent for the purpose of investigating a breach of an agreement or a contravention of a law of Canada or a province. The company stated that it placed the complainants under investigation for the following reasons:

• malicious gossiping on their part about the manager to other employees;
• suspicions of theft of parking revenues from the cash register;
• placement of liquid Ex-lax in red wine stored in the kitchen refrigerator; and
• mismanagement of the parking gate during evening shifts.

The manager obtained a written statement from an employee who indicated that on one occasion she witnessed one of the complainants pocketing $20 after receiving it from a customer. The employee-witness verbally informed the manager of this incident after the manager had placed the digital voice recorder in the public smoking room, but prior to the employees' termination. The employee-witness then followed up with a written statement after the employees had left the company. The company took the position that this could have been a criminal activity, and suspected that the problem was not confined to one employee only, given that there was frequent close communication among the complainants. On this basis, the company felt it had good reason to believe that this activity was not an isolated incident.

While the manager provided the Office with a variety of reasons to suspect that this complainant was responsible for ongoing theft of parking revenues, the representations she gave indicated that she had no direct evidence to support her suspicions.

As for the allegation regarding the liquid Ex-lax, the company provided a written statement from one eyewitness who came forward with information several months after the complainants had left the company. Another employee witnessed one of the complainants pouring a liquid into red wine bottles in the kitchen. The manager also obtained a written statement from this individual, when he came forward with the information — also several months after the complainants had left the company (and filed a complaint with the Office).

Regarding the mismanagement of the parking gate, the company could not provide the Office with evidence to support this allegation, as it did not have a parking attendant on-site to monitor parking activity at the time the complaint was filed.

Shortly after the tape recorder was discovered, and the company and employees held a meeting, all three complainants were fired.

Findings

Issued April 12, 2004

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Paragraph 7(1)(b) is an exception to this. It states that an organization may collect personal information without the knowledge or consent of the individual only if it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.

The investigation determined that the tape had been erased. Consequently, there was no evidence that the complainants' personal information had been collected or used and the Assistant Privacy Commissioner concluded that the company was not in contravention of any relevant provision of the Act.

Accordingly, she concluded that the complaints were not well-founded.

Further Considerations

Notwithstanding the finding, the Assistant Commissioner warned that the company should not interpret these findings as an approval of what the company attempted to do. Had the manager been successful in obtaining information via the digital recorder, the Assistant Commissioner would not, in the circumstances, have been inclined to accept the company's reliance on paragraph 7(1)(b) to justify collecting personal information in such a manner.

She stated that:

Paragraph 7(1)(b) cannot be read in isolation, and therefore cannot be relied upon to justify any collection of personal information without knowledge and consent under just any circumstances. In our view, an organization must have substantial evidence to support the suspicion that the employee is engaged in wrongdoing or that the relationship of trust had been broken, must be able to show that it has exhausted all other means of obtaining the information that it required in less privacy-invasive ways, and must limit the collection to the purposes to the greatest extent possible.

In this instance, there were rumours of theft, fraud, and possible assault. But these were anecdotes, and anecdotes do not qualify as substantial evidence. Moreover, some of this information was given to the manager after she had placed the recorder in the public smoking room. Did the manager try to obtain information in a less privacy-invasive manner about these incidents before taping a digital recorder to the underside of a table? Did she alert all employees to the problems? Did she speak with these individuals about her suspicions? It would appear that she did not.

Then there is the measure itself. A tape recorder, placed in a room accessible to many individuals, some customers, some employees, is a highly indiscriminate means of collecting information. The company contends that the timeframe of the taping limited the chance of others being recorded. Nevertheless, this was a public room, and regardless of whether a flight was scheduled to arrive that night or not, the company could not guarantee that only the complainants would be using the facility. The recorder appears to have been placed there on the off chance that some information might be captured. Such an approach to investigating possible employee wrongdoing is not privacy conscious to say the least.

The electronic surveillance of employees when there is a suspected breach of the employment contract is a measure that should never be taken lightly or easily. It should be the very last step — if taken at all — in a series of steps, approved of by a very senior level of management, to obtain information regarding employee wrongdoing and must be based on substantial evidence. The circumstances in this case, simply put, would not measure up.