Employer hires private investigator to conduct video surveillance on employee

PIPEDA Case Summary #2004-269

[Principle 4.3, paragraphs 7(1)(b) and 7(2)(d)]

Complaint

A former employee of a company complained that his employer had collected his personal information, by way of video surveillance, and used that information to terminate his employment.

Summary of Investigation

During the course of the complainant's employment with the company, he reported a number of work-related injuries. In 2000, he requested accommodation due to physical limitations. Also in the same year, he requested and was approved for a compassionate transfer to another, smaller city, due to a family member's health. Such approval meant that he would receive first consideration of positions in that city that met his accommodation requirements. In the same year, his health problems escalated, and he became increasingly dissatisfied with the company's attempts to accommodate his needs, as well as with the company's requests for updated medical information.

For the company's part, it became increasingly suspicious of the complainant's claims given his behaviour and difficulties experienced by the organization in obtaining updated medical information. According to the company, the complainant was uncooperative and resistant to performing his work duties. The company had attempted to collect accurate information about his ability to perform certain duties related to his employment directly from the complainant, but he was uncooperative. At issue was an independent assessment to determine the employee's ability to perform work duties associated with his job, and an assessment form, filled out by the employee's physician, regarding disability or medical conditions relevant to his work.

While the complainant awaited a compassionate transfer, he was offered temporary positions in the city in which he was already living. These positions were in line with his physical limitations. He refused them, and went on extended medical leave until 2001, when his physician indicated that he was fit to return to work, with limitations. He returned to work, but complained about his work station. He was frequently absent, and reported having other physical difficulties. A few months later, in October of that year, the company's health officer requested an updated assessment from his physician. She never received one, despite having either verbally or in writing requested one. The complainant continued to be dissatisfied with the position and work station that the company provided. In 2002, the company provided him with a rehabilitation program, but it was terminated due to lack of progress and the complainant's increasing physical discomfort. In May 2002, the company asked him to undergo the independent assessment, which he initially resisted. The conclusion of the independent medical assessors was that while he had physical barriers, he also appeared to have non-physical barriers to returning to work. The assessors noted that it was unlikely that further functional testing would provide an accurate assessment of his true functional abilities.

In July of that year, the company hired a private investigation firm to conduct surveillance on the complainant in order to determine whether he had been truthful about his physical limitations. Following two weeks of surveillance, the private investigator provided the employer with a report and videotape. The company used this information as evidence that the complainant had misrepresented the state of his health, and terminated his employment in September. At the time of the investigation, the case was before an arbitrator.

The company relied on paragraphs 7(1)(b) and 7(2)(d) to collect and use the complainant's personal information without his knowledge and consent. According to the company, the decision to conduct video surveillance was the result of a consultation among a small team of legal, medical and industrial relations professionals, who determined that video surveillance was necessary as a "last resort" in this case in order to determine the veracity of his claims. The company acknowledged that it had no formal policy or procedures in place to guide managers in these types of situations.

As for directions given to the investigation firm, the industrial relations manager provided information about the complainant's limitations, and instructed the investigator to monitor his activities for several days as required. The investigator followed him for a total of 139 hours over the course of two weeks. Eight hours of videotape was provided to the company. The tape shows the complainant performing activities that, in the company's medical practitioner's opinion, contradicted his claims of physical limitations. The company contended that for arbitration cases involving employees who misrepresent the facts, enough information must be collected over a significant period of time to provide a complete picture of the individual's capability, and to establish sound, factual, and irrefutable evidence that the individual is being fraudulent. The company added that arbitration jurisprudence has established the need for the appropriate context of information collection in similar cases, ensuring that the appropriate context of events is provided to protect the integrity of information, and to ensure that there is reasonable proof of the behaviour. A short video clip or pictures of an individual in one situation does not provide the context. Rather, information must be collected over a series of days, establishing beyond doubt what the capabilities of the individual are. Moreover, the company maintained that short clips of videotape taken out of context could unfairly characterize the individual.

Findings

Issued April 23, 2004

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Paragraph 7(1)(b) is an exception to this. It states that an organization may collect personal information without the knowledge or consent of the individual only if it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province. An exception to the requirement for consent to use is provided in paragraph 7(2)(d), which allows an organization to use personal information without the individual's knowledge or consent only if it was collected under paragraph 7(1)(b).

Also considered in determining the recommendations in this case were Principle 4.1.4(c), which states that organizations shall implement policies and practices to give effect to the principles, including training staff and communicating to staff information about the organization's policies and practices, and Principle 4.4, which stipulates that the collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means.

The Assistant Privacy Commissioner noted at the outset that the Office of the Privacy Commissioner considers video surveillance to be an extremely privacy-invasive form of technology. The very nature of the medium entails the collection of a great deal of personal information — information that may concern innocent third parties, that may be extraneous, or may lead to judgements about the subject that have nothing to do with the purpose for collecting the information in the first place. In the Office's view, resorting to video surveillance, especially on employees away from the worksite, must be considered only in the most limited cases.

With this in mind, she deliberated as follows:

• There was no question that the company had collected the complainant's personal information without his knowledge and consent. The issue was whether paragraph 7(1)(b) of the Act could be applied in this instance.
• To accept the company's reliance on paragraph 7(1)(b) to justify collecting personal information without knowledge and consent, by means of video surveillance, a number of factors must be considered. This exception cannot be read in isolation. The Assistant Commissioner noted that an organization must have substantial evidence to support the suspicion that the relationship of trust has been broken, must be able to show that it has exhausted all other means of obtaining the information that it requires in less privacy-invasive ways, and must limit the collection to the purposes to the greatest extent possible.
• The Assistant Commissioner noted that the company had, for nearly two years, attempted to accommodate the complainant with his workplace requirements. In June 2001, he was cleared to return to work with limitations. Yet he continued to be frequently absent from work for reasons related to his medical conditions. From October 2001 until the decision to engage a private investigation firm in July 2002, the company tried, unsuccessfully, to obtain up-to-date medical information. When the complainant agreed to the independent assessment, the results did not refute a growing suspicion on the part of the employer that the complainant was not accurately representing the state of his health.
• In light of these circumstances, the Assistant Commissioner was satisfied that the company's purpose, namely, to determine whether the complainant was violating his employment contract by misrepresenting the state of his health, was based on substantial evidence.
• The Assistant Commissioner was also satisfied that the company had tried less privacy-invasive ways to gather the information it required. There were numerous attempts, verbally and in writing, to obtain accurate medical information, but these met with resistance from the complainant. He was offered the opportunity to submit to the independent capacity assessment, which he reluctantly did. All of these steps are considerably less privacy invasive, but, in this instance, they did not dispel the organization's concerns. When the company took the step of hiring the private investigator, it outlined what information it was looking for, thereby focussing inasmuch as possible the collection of personal information on the complainant.
• In sum, the Assistant Commissioner accepted the company's reliance on paragraphs 7(1)(b) and 7(2)(d) to collect and use the complainant's personal information without his knowledge and consent. The company had reasonable and probable cause to believe that he was violating his employment contract, and was clearly having difficulty in obtaining accurate information from him with his knowledge and consent.

Accordingly, she concluded that the complaints were not well-founded.

Further Considerations

Notwithstanding the findings, the Assistant Commissioner stressed that while she was satisfied that the company only resorted to video surveillance after having taken numerous measures to obtain the required information with the complainant's knowledge and consent, she recommended that the company formalize the steps it took by developing policy and practices that are privacy conscious.

Such a policy, she suggested, should take into account the following:

• video surveillance is a last resort and should only be contemplated if all other avenues of collecting personal information have been exhausted;
• the decision to undertake video surveillance should be made at a very senior level of the organization; and
• the private investigator should be instructed to collect personal information in accordance with the Act, and should be especially mindful of Principle 4.4.

The Assistant Commissioner asked the company to report back to her within 120 days regarding this policy.