Condition of washrooms prompts management to monitor facilities

PIPEDA Case Summary #2007-379

[Principle 4.3; paragraphs 7(1)(b) and 7(2)(d); subsection 5(3)]

An employee of a transportation company complained that management had monitored his washroom visits without his knowledge or consent, and used the information it collected for disciplinary purposes.  The company justified its actions by relying on the exceptions to consent set out in paragraphs 7(1)(b) and 7(2)(d).  The Assistant Privacy Commissioner considered the circumstances in which the company found itself and determined that it could not appropriately rely on those provisions to collect and use the complainant’s personal information without his knowledge or consent as it lacked substantial evidence to support its belief that a breach of an agreement had taken place and it had not exhausted all less privacy-invasive measures.  She recommended that the company develop a policy on surveillance and the company agreed to do so.  She therefore concluded that the complaint was well-founded and resolved.

The following is an overview of the investigation and the Assistant Commissioner’s deliberations.

Summary of Investigation

The complainant first learned of the monitoring when he attended a disciplinary hearing at which he was informed that a complaint had been brought forward at a Health and Safety Committee meeting about the state of the men’s washroom.  The manager stated that the washroom was monitored and that it was concluded that the complainant was responsible for the mess.  During this meeting, the complainant was shown a log of the washroom inspections.

A few days later, the complainant received a disciplinary letter and a copy of the washroom inspection log.  He stated that the log he was given was different from the one he was shown on November 4, in that it did not include the names of the individuals who inspected the washroom.  

The disciplinary letter reiterated what the complainant had been told at the disciplinary meeting.  During the meeting, the complainant had requested to see the log, which was shared with him.  The complainant claimed that he was unaware of the effects of his actions on the facilities.  He was advised that his behaviour had to stop immediately.

He was also informed that, in keeping with company practice of progressive discipline, any further issues, however minor, relating to his conduct or performance would be viewed as a culminating event resulting in immediate termination, for cause.  A few months later, his employment was terminated.

The company stated that a complaint from an employee with respect to the state of the men’s washroom was brought forward in the company’s monthly health and safety meeting.  As with all complaints brought forward, a follow-up investigation was warranted, as it was a shared facility used by employees, their children, and many job applicants. Due to the sensitivity of the complaint and the fact that the minutes were posted for all employees, the company felt that the complaint should be omitted from the minutes, but investigated nonetheless.

Shortly afterward, a log was initiated to monitor who was using this facility and the condition it was left in.  In conducting the investigation, the log was maintained by branch management staff in confidence.  Three days later, it was determined that the washroom was only in need of attention after the complainant had vacated it.  He was called into the office in confidence with union representation to discuss the complaint and the results of the investigation.

The company stated that approximately 95 staff members use the washroom on a regular basis.  We reviewed a copy of the log, which indicated that the washroom was monitored by management for three days.  The information recorded consists of date, time, name of personnel using the facility, name of person inspecting, and the condition of the facility.  There are 23 entries in the log.  As soon as the responsible party was identified, monitoring ceased.

Under the Canada Labour Code, the company has a responsibility to maintain a healthy and safe working environment.  Paragraph 125(1)(y) of the Code states that every employer shall ensure that the activities of every person granted access to the work place do not endanger the health and safety of employees.  Under paragraph 124(1)(z.2), the employer shall respond as soon as possible to reports made by employees regarding any thing or circumstance in a work place that is likely to be hazardous to the health or safety of the employee, or that of the other employees or other persons granted access to the work place by the employer.

Employees also have a duty, under paragraph 126(1)(c) to take all reasonable and necessary precautions to ensure the health and safety of other employees and any person likely to be affected by their acts or omissions.

Findings

Issued April 4, 2007

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.  An exception to consent in the collection of personal information is provided under paragraph 7(1)(b).  Paragraph 7(1)(b) states that organizations may collect personal information without the knowledge or consent of the individual only if it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.  Paragraph 7(2)(d) states that information collected under paragraph 7(1)(b) may be used by the organization without the knowledge or consent of the individual.  Subsection 5(3) states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

In making her determinations, the Assistant Privacy Commissioner deliberated as follows:

• There was no dispute that the company collected and used the complainant’s personal information without his knowledge or consent. 
• The company contended that the exceptions to consent provided under paragraphs 7(1)(b) and 7(2)(d) of the Act applied in this instance.
• In previous cases where the Office has considered a company’s reliance on these exceptions to consent to justify covert surveillance, we have stated that such exceptions cannot be read in isolation and have set out a number of conditions that must be met in order for this Office to accept the organization’s reliance on paragraph 7(1)(b).  Namely, the requirement prescribed in subsection 5(3) must be met and to that end, the collection has to occur only for a purpose that a reasonable person would consider appropriate in the circumstances.   
• Specifically, the organization must have substantial evidence to support the suspicion that the relationship of trust has been broken or a law has been contravened; it must be able to show that it has exhausted all other means of obtaining the information that it requires in less privacy-invasive ways; and it must limit the collection to the purposes to the greatest extent possible. 
• The investigation established that there was substantial evidence that someone, though not necessarily the complainant, within the organization was endangering the health and safety of others, contrary to the requirements of the Canada Labour Code.  Complaints had been made to the health and safety committee about the state of the washrooms, and the company had a responsibility to ensure that the company was in compliance with the law. 
• The Assistant Commissioner then considered how privacy-invasive the action taken by the company was.  A log of washroom visits was kept, with the name of the individual noted on a sheet of paper, along with the time the person entered the facility.  After he or she left, a manager would enter the room to review its state, which would be noted on the log. 
• No physical surveillance took place while individuals were in the washroom – an action that she would consider highly privacy invasive. Nevertheless, keeping a log of visits was, in her view, also privacy invasive. 
• The Assistant Commissioner acknowledged that an attempt was made to limit the collection of personal information as the surveillance did not go on over a lengthy period of time.  Once the company determined who the responsible party was, it ceased monitoring the washroom.
• It was the question of exhausting all other means that was problematic in the circumstances of this complaint. 
• The company had taken the position that it had to act immediately.  The Canada Labour Code requires the employer to respond “as soon as possible” to any reports of a hazard in the workplace. 
• The problem, though, was that the company’s actions were undertaken not to simply put an end to a problem, which it was clearly required to do under the Canada Labour Code, but to catch the perpetrator.  The company could have, for example, posted notices or made an announcement in order to remedy the situation.  Such actions were less privacy invasive and could have achieved the same ends, namely, to rectify the problem. 
• The company acknowledged that it had intended to not only put an end to the vandalism, but also to catch the perpetrator.  The company was of the view that it was investigating a breach of the employment agreement.
• The Assistant Commissioner pointed out, however, that when the company began its investigation, it did not know that an employee was responsible.  In fact, a company representative had informed the Office that she expected the responsible party to be a child (children did frequent the work environment), not an employee.
• The Assistant Commissioner noted that in past cases where the Office has considered the use of covert surveillance on employees, the surveillance was targeted towards specific individuals.  In one well-founded case, there was insufficient evidence to support the belief that a breach of trust had taken place.  In another complaint, this time not well-founded, the company had enough evidence to support its position before it hired a private investigator to conduct video surveillance on its employee.
• The Assistant Commissioner was of the view that the company was trying to use the results of its investigation to justify the methods it used.  She therefore determined that the company lacked substantial evidence to support its view that an employee was responsible for the state of the washrooms and that the relationship of trust had been broken.
• She also determined that the company had not exhausted all less privacy-invasive means before resorting to monitoring the facilities.  The company acknowledged to the Office that it had not even considered any other way of addressing the problem.
• Consequently, the Assistant Commissioner determined that the company had not fully meet the requirements of subsection 5(3) to rely on paragraphs 7(1)(b) and 7(2)(d) to collect and use the complainant’s personal information without his knowledge or consent.  While the company had reason to believe that someone who used its facilities was contravening the Canada Labour Code and that it had to take immediate steps to rectify the situation, it did not exhaust all less privacy-invasive measures to meet its legitimate obligations.
• The Assistant Commissioner noticed, in reviewing the company’s privacy policy, that it was silent on the matter of surveillance.  Therefore, she recommended that the company develop strict guidelines regarding the use of surreptitious surveillance.  Such a policy, she noted, should take into account the following:
• • surveillance is a last resort and should only be contemplated if all other avenues of collecting personal information have been exhausted;
  • the decision to undertake surveillance should be made at a very senior level of the organization; and
  • the collection of personal information should be limited to the greatest extent possible.
• The company agreed to amend its privacy policy to cover surveillance.

Accordingly, she concluded that the complaint was well-founded and resolved.

See also

#268 Electronic monitoring does not yield any information, but practice is strongly discouraged (not well-founded, but organization’s practice would have been in contravention of act; insufficient evidence to support belief that breach of trust had taken place)
#269 Employer hires private investigator to conduct video surveillance on employee (company had enough evidence to support its position before it hired a private investigator to conduct video surveillance on its employee)

Postscript

The complainant filed a Notice of Application under section 14 of PIPEDA in the Federal Court.  By serving as an informal mediator, the OPC assisted the parties in reaching a final and binding settlement prior to the hearing.  The Federal Court application was discontinued.