Privacy commissioners call for greater privacy in modern workplace

Canada’s privacy commissioners have passed a resolution to call on governments and employers to honour workers’ rights to privacy and transparency in the modern world of work.

“Canada’s FPT (Federal, Provincial, Territorial) Privacy Commissioners are calling on their respective governments and relevant stakeholders to ensure that employee rights to privacy and transparency are respected and protected, particularly in a modern work context that relies increasingly on electronic monitoring and surveillance of employees’ activities,” they said.

In the new normal, there seem to be a problem around regulating the monitoring of workers, especially as there are “significant gaps in statutory privacy laws covering employees in Canada,” they said.

In June, the Office of the Privacy Commissioner of Canada published new guidelines on workplace privacy in organizations – taking aim at federally regulated workplaces.

Privacy officials’ call on governments

In particular, the commissioners call on federal, provincial, and territorial governments to:

• Acknowledge the legislative gaps in their respective jurisdictions, and in those jurisdictions with no or limited legislative protections for employee personal information, take action to close those gaps
• Work collaboratively to ensure there is a harmonized or consistent statutory framework of protections for employees across Canada that leaves no worker behind
• Where statutory privacy protections do exist, consider the need to update and strengthen those protections in a context of increased risks resulting from privacy-invasive technologies in a modern workplace. This includes:
  • codifying a reasonableness, necessity and proportionality requirement to ensure reasonable and responsible deployment of these tools and technologies only for legitimate purposes
  • strengthening transparency and accountability of employers’ use of tracking tools, including electronic monitoring/tracking and AI technologies, in managing the employer-employee relationship
  • providing employees with a meaningful and accessible means of challenging unreasonable use of electronic monitoring tools and AI enabled systems and seeking redress against their employer for unfair decisions made about them
  • prohibiting inappropriate employment practices, or defining “no-go zones” beyond a certain threshold of risk

Privacy officials’ call on employers

The commissioners also called on employers to:

• Respect the principles of reasonableness, necessity, and proportionality when considering or reviewing any collection or use of employee information through electronic surveillance
• Recognize the “particularly sensitive” nature of biometric information and their “high degree of intrusion” into the privacy of employees. 
• Use electronic monitoring tools and AI technologies only for fair and appropriate purposes and only to the extent they are reasonably necessary to manage the employer-employee relationship
• Not use AI technologies to make significant decisions about an employee’s performance, candidacy, employment prospects or any other decision with potential to have consequential employment related impact without a ‘human-in-the-loop’
• Conduct privacy impact assessments (against applicable laws, recognized privacy principles and best practices) and algorithmic impact assessments (wherever relevant) to identify risks to privacy and other human rights associated with the deployment of these tools and technologies, and take actions to mitigate these risks accordingly.
  • When it comes to AI technologies, seek information about the source of the data used to train the AI system, and assess whether the technology was developed in compliance with applicable privacy law
• Adopt clear policies, controls, and procedures to prevent use beyond the identified purposes, and set out internal checks and balances to ensure proper governance and accountability mechanisms are in place
• Inform employees and potential employees of the electronic monitoring tools and AI systems being used and for which purposes, explain their implications using clear and plain language and provide them with copies of relevant policies and procedures
• Provide employees with clear information about how to object to the collection, use, or disclosure of their personal information, how to challenge decisions made about them, and how to exercise access rights

“The use of biometrics must be lawful, necessary, proportional, and only when there is no other effective and less privacy-intrusive way to achieve the objective pursued,” note the privacy officials.

Employee privacy is an “ever-evolving field,” according to an expert.

Meanwhile, the privacy commissioners vowed to: 

• engage with government and other stakeholders in the development, modernization and application of statutory employee privacy protections in our respective jurisdictions
• continue to monitor new technologies, developments and trends related to employee surveillance and privacy in the modern context of work
• collaborate to educate and provide guidance to employers about their obligations, and to employees about their rights, in our respective jurisdictions
• take joint or coordinated enforcement action on employee privacy-related matters as appropriate and where our laws permit

“Irresponsible adoption of privacy-invasive technologies in employment management can lead to significant and measurable impacts on employees’ careers — like job compensation, promotion, or termination,” said the officials.

“Pervasive forms of electronic monitoring and surveillance can also have subtler impacts on employees that are more difficult to measure but just as significant, such as stress, a chilling effect on one’s creativity and sense of autonomy, a loss of dignity, and adverse mental health effects resulting from having one’s employer digitally watching them at all times, including in their homes.”