On September 11, 2012 the Alberta Office of the Information and Privacy Commissioner upheld a complaint that dealt with an employer’s retrieval and use of e-mails from its work e-mail system. The decision suggests that information in e-mails from a work e-mail system that are accessed and used as reasonably required for an employment-related purpose are regulated as “employee personal information” under Alberta PIPA regardless of their content.
The employer is a union who temporarily employed the complainant as a business agent. Towards the end of his employment, the complainant applied for selection into a permanent position by way of a job competition. On his last day of employment, while the competition was underway, some members of the internal evaluation committee for the competition reviewed the complainant’s e-mails; at times the OIPC decision frames this review as being for the (routine) purpose of performance assessment and at other times it frames the review as investigatory (and in response to some specified concerns).
Upon review of the e-mails, the committee members discovered an e-mail received by the complainant that invited him and a member of the selection committee to a meeting about “defeating” the employer’s president and another candidate for the position. This e-mail and 13 others of a similar kind were of concern to the employer because they suggested its job competition process would not produce a fair result. Later, the employer’s president read parts of the 14 e-mails aloud at a meeting of the general membership to support an executive committee recommendation to disband the internal evaluation committee.
The complainant argued that the employer’s use and disclosure of his e-mails contravened Alberta PIPA. Apparently he did not take issue with the employer’s search itself given the e-mails in question were all sent and received on the employer’s system.
Most importantly, the OIPC held that the employer’s initial use of the 14 e-mails was a use of “employee personal information.” It said:
While the E-mails were not always in relation to the Complainant’s own employment duties, they were in relation to the affairs of the Organization, which is sufficient for them to “relate” to the parties’ employment relationship.
Therefore, when the Organization initially reviewed the E-mails for the purpose of evaluating the Complainant’s performance as Relief Business Agent, the Organization was, in that particular context, reviewing the Complainant’s personal employee information. In further reference to the definition of “personal employee information”, the E-mails were “reasonably required” by the Organization in that they were part of the record of the Complainant’s performance, which he was reasonably required to create by virtue of his 89-day trial period in the position. Nothing turns on the fact that some of the E-mails were not in relation to the Complainant’s specific duties, as the fact that he sent or received them was still relevant to his overall performance.
This reasoning suggests that an employer’s purpose in dealing with e-mails on its system (even “personal use” e-mails) will govern how the information in the e-mails is characterized under the Act. The review of system e-mails for an employment-related purpose will generally mean the information in the e-mails qualifies as “personal information,” but provided the review is reasonably required, the same information will also qualify as “employee personal information.” This is of critical significance to Alberta employers because consent is not required to collect, use and disclose employee personal information under Alberta PIPA unless an exception to this general rule applies.
One such exception, which the OPIC held was engaged in this case, is an exception for a failure to provide “reasonable notification that the information is going to be used and of the purpose for which the information is going to be used.” In essence, the OIPC held the employer lost the ability to rely on the more liberal rules that apply to the use and disclosure of employee personal information under Alberta PIPA because it had no acceptable use or other policy to make the employee aware that his e-mails might be reviewed for an employment-related purpose or otherwise. Most Alberta employers will have an applicable policy, but to avoid the fate that befell this employer they should ensure their policies articulate the specific business purposes for which e-mails may be accessed. (For more on this point, see here.)
Please note that there is more to this complicated decision than the aspects that I’ve covered here, including content on the scope of the so-called “investigations exemption.” Ultimately, the employer was not able to establish that it was properly authorized to use the e-mails for either its employment-related purpose or its (secondary) administrative purpose.
Hat tip to Barbara McIssac, who is now blogging with a team of BLG lawyers at The Law of Privacy in Canada Blog. Welcome to the blawgosphere!