On December 19th, the British Columbia Office of the Information and Privacy Commissioner dismissed a complaint about the collection and use of vehicle location and operation data for the purpose of managing employee performance. In doing so, the OIPC opined broadly on the meaning of “personal information” and “work product information” and on the standard of reasonableness for collecting and using employee personal information under BC PIPA.
The case deals with an elevator company and its field mechanics. The mechanics objected to the company’s collection of data about service vehicle location and data about service vehicle operation – e.g., distance travelled, speed and incidents of harsh braking. The company argued this information is not regulated by BC PIPA at all because it is not “personal information” or, alternatively, is “work product information.”
The OIPC rejected the company’s primary argument and held that vehicle location and operation data is personal information. In doing so it rejected a narrow definition of personal information that requires personal information to be “about an identifiable individual” in that it reveals something private or intimate about the individual – a concept accepted in some case law and loosely related to the “biographical core” concept featured in Charter search and seizure jurisprudence. Instead, the OIPC said that information about an identifiable individual is personal information if it “is collected, used or disclosed for a purpose related to the individual.”
The OIPC also rejected the company’s alternative argument and held that vehicle location and operation data is not work product information. It reasoned that vehicle location and operation data is not “prepared or collected” by an individual in the course of work and that, generally, data that is automatically recorded “without directed conscious input by an individual” is not work product information.
While these principles favour privacy protection, the OIPC also demonstrated respect for employer interests in finding the company’s collection and use of employee personal information was reasonable for its purposes. The OIPC expressly rejected a four part reasonableness test (generally disliked by employers) in favour of a more flexible “reasonableness in all the circumstances” test:
The assessment of reasonableness will occur in the context of the established purposes for the employer’s collection, use or disclosure and thus should have some regard to that context. But the assessment may also address a number of other possible considerations.
As part of its reasonableness discussion, the OIPC also noted that an organization need not adopt the least privacy-intrusive alternative regardless of cost or consequences (though should be able to demonstrate that it has given “reasonable consideration” to less intrusive alternatives).
Schindler Elevator Corporation (Re), 2012 BCIPC 25 (CanLII).
All About Information 