Surveillance of employees at work

PIPEDA Case Summary #2004-279

(Section 3; subsection 5(3))

Complaint

A former employee of an internet service provider believed that the company was acting contrary to the Personal Information Protection and Electronic Documents Act (the Act) when it installed web cameras to monitor the performance of employees.

Summary of Investigation

In 2003, the company installed web cameras at two locations within one of its offices: one camera was pointed towards the sales and marketing staff and the second was pointed toward the technical support employees.

The cameras were fixed, with no pan or zoom function. They were set to low resolution and did not record. The individuals captured on camera were in sharp focus — in other words, it was easy to recognize who they were and what they were doing.

The sales and marketing staff were located in one room, working behind moveable partitions. The camera was focused on the common area in the room and not on any one individual. It was possible to catch a glimpse of a person who moved away from his or her workstation into the common area, and the camera captured anyone entering or leaving the room. The physical set-up for the technical support staff was similar; however, the room was larger and could accommodate up to 19 staff members. There was no common area, and the camera captured about half of the staff within its view (assuming a full complement of technical support employees). The audio content of both cameras could also be monitored.

Although the cameras operated continuously, they were only accessed by the managers of the sales and the technical support staff when the managers were off site. The screen images that the managers could retrieve were small and became increasingly distorted if enlarged.

The company presented two reasons for installing the cameras: to ensure security and to manage employee productivity. With respect to the security purpose, the company stated that employees had accidentally set off alarms on a number of occasions. When an alarm was activated, the security company telephoned a manager, who was able to access a web camera image to confirm that the site was being used by a company employee. There were no cameras at the main entrance, and access to the building was monitored by keyless entry.

The company stated that there were occasional allegations of theft and harassment. It had a zero tolerance harassment policy and advised employees to contact their manager if they experienced an incident of harassment. The company also told new employees that theft might be grounds for immediate dismissal. It stated that there were no allegations of theft or harassment since the introduction of the cameras.

As for managing employee performance, the company identified four measures of productivity for help desk staff: the amount of time on the telephone, the ability to process calls quickly, the number of calls answered, and the quality of advice. The sales and marketing staff were also evaluated based on the number of sales that they made.

The phone system automatically recorded three of these measures at each phone extension: the amount of time on the phone, the number of calls answered, and the average time it took each help desk employee to take a call. It also recorded the type of call (customers pressed a key pad number that identified the nature of their inquiry). The managers of the help desk staff also had the ability to monitor telephone conversations for training and/or quality assurance purposes (the fourth performance measure), by listening in on customer calls.

In addition to providing customer support over the phone, help desk employees also answered customer e-mail. Outgoing e-mail was monitored for quality assurance purposes, while incoming messages were filtered for objectionable content and unsolicited commercial e-mail.

The company used several other techniques to monitor attendance and how employees used their time while at work. Employee access to the office was monitored by use of swipe cards. Internet use was monitored and reported to senior management. The company used a web traffic tool to restrict employee access to outside web pages and applications. Employees could not use the phones at their workstations to make personal calls, but had to use phones in the break and reception areas.

The company had a policy of twice yearly performance reviews, and a policy supporting the use of progressive discipline. It informed all new employees that serious offences such as fighting, theft, or insubordination might be grounds for termination.

In the help desk area, staff were on duty 16 hours a day, Monday to Friday, and 10 hours a day on the weekends. The staff who worked the daytime hours during the week were directly supervised by their respective managers. The company noted that the productivity of the help desk staff (as measured by the productivity indices noted above) declined when a manager was not on site, and installed a web camera (in part) to compensate for the manager's absence. According to the company, it had tried other less-intrusive measures, such as having managers conduct spot visits on the weekend. Such visits confirmed that the help desk staff who worked off-hours took longer and more frequent breaks, and took breaks together, leaving the phones unattended. When the company management raised the issue of productivity with the staff in question, they received unsatisfactory answers. The company was of the view that part of the problem lay with the characteristics of the pool from which call centre staff were drawn: they were young, transient, and in entry-level positions. It considered and rejected the idea of hiring more supervisory personnel for cost reasons. The company argued that the provision of internet services was a highly competitive business with very thin margins, and it had to choose the most cost-effective way of managing staff performance. It claimed that with the introduction of the cameras, the problem of unsatisfactory productivity of staff who worked off-hours had been solved.

Both cameras had notices posted on them advising that the area in question might be monitored by the cameras. Shortly after installing the cameras (and following the complaint to the Office), the company issued a policy statement on privacy in the workplace, which outlined the purposes for the cameras. Each employee signed an acknowledgement that he or she had read and understood the privacy policy, and employees in the technical support area who were uncomfortable with the idea of being continuously viewed had the option of working behind a moveable partition.

Findings

Issued July 26, 2004

Application : Section 3 of the Act states that the purpose of the legislation is to establish the rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances; and subsection 5(3) establishes that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider were appropriate in the circumstances.

The Assistant Privacy Commissioner deliberated as follows:

• In determining whether the company had achieved a balance between the right of privacy of individuals with respect to their personal information and its need to collect, use or disclose personal information, the Assistant Commissioner considered the appropriateness of the company's stated purposes.

• The company argued that it required that cameras be trained on employees to ensure security and manage employee productivity. With respect to security, unauthorized entry to the facility did not appear to be the primary issue of concern since no camera was posted at the office's entrance or exit points. The company cited a need for a manager to provide assurances to the security service that employees on site were there, in the event that one of them accidentally tripped the security alarm. The Assistant Commissioner, however, was of the view that a much less-intrusive method of addressing the same issue existed, namely, to have the employees in question call the security service or have the service call them.

• The company included problems of theft and harassment under the rubric of security issues that the cameras could address. However, she was not satisfied that the company presented evidence that these problems were so prevalent and compelling that they justified the introduction of such a privacy-invasive measure. On this basis, she determined that a reasonable person would not likely consider security an appropriate purpose in these circumstances.

• As for employee performance, the Assistant Commissioner noted that the company used a variety of means to measure the productivity of its staff: an automated phone system, supervised telephone calls, monitored e-mail, progressive discipline, performance reviews, and policy statements. Yet despite such comprehensive measurement and enforcement tools, the company maintained that it needed to use web cameras, with their capacity to continuously monitor employee attitudes and behaviour, during those hours when management was not there. It cited financial reasons for not hiring additional management staff; however, the Assistant Commissioner noted that the company did not appear to be open to other options, such as having certain staff members function in a supervisory role or modify the work schedules of existing managers to cover off-hours. Such measures could be cost-effective and would be less privacy invasive.

• She also expressed concern that such surveillance was tarring all employees with the same brush, questioning the rationale for subjecting an employee who excelled on all productivity measures or another who was not under suspicion of theft or harassment to the same ongoing monitoring as the employee who rated poorly or who was thought to be a thief or harasser. In her view, it was not appropriate to intrude upon the privacy of all employees, regardless of their level of productivity, their attitudes or their behaviour, because a few employees posed problems for management. She therefore considered it unlikely that a reasonable person would consider employee productivity an appropriate reason to use video and audio surveillance, as per subsection 5(3).

• While acknowledging that the company had informed employees of the purposes of the cameras and offered employees in the technical support area the choice of moving their desks out of the camera's visual range, the Assistant Commissioner noted that these were not key considerations when the measure itself contravened the spirit of the Act.

• The Assistant Commissioner commented that the underlying purpose for the cameras really appeared to be one of deterrence — deterrence of theft, harassment, malingering, criticism, or other behaviour an employer may not like. She noted that privacy-intrusive measures can always fulfil such objectives at minimal financial cost. The Act, however, demands that the cost to human dignity form part of the equation. Continuous, indiscriminate surveillance of employees, she noted, was based on a lack of trust and treats all individuals with suspicion when the underlying problems may rest with a few individuals or with a management plan that may not be entirely sound. The effect, she commented, of such omnipresent observation was stifling. While it may prevent undesirable behaviour, it also forces the employee to call into question every potential action, every potential comment no matter how benign. The goal of ensuring adherence to the company's vision comes at too high a price to our individual autonomy and freedom.

• The Assistant Commissioner determined that by using web cameras in the manner described in this complaint, the company was not fundamentally recognizing the right of privacy of its employees, as enshrined in section 3 of the Act, and the balance was thus tipped too far in favour of the organization's needs. She could not, therefore, support the use of cameras to monitor employees at work since to do otherwise would be to undermine the purpose of the Act.

The Assistant Commissioner concluded that the complaint was well-founded.

Further Considerations

The Assistant Commissioner recommended that the company remove the web cameras from the sales and marketing and technical support areas and confirm this action in writing within 45 days of receiving the findings.