Case Report – Arbitrator orders call centre to stop recording calls

Earlier this year, on April 17th, Arbitrator Veniot ordered the Halifax Regional Municipality to cease and desist from recording calls to its municipal call centre for quality monitoring, coaching and dispute resolution purposes.

The union grieved the implementation of a system whereby the Municipality recorded all calls to its call centre. It claimed a breach of the privacy protection provisions of the Nova Scotia Municipal Government Act and the collective agreement. The system was implemented after the Municipality had engaged in a successful program of customer service improvement. The evidence showed its call centre was “functioning well” at the time of the implementation, so the Municipality argued that the call centre attendants had little expectation of privacy, that it was simply supervising work product and that it was being diligent in its attempt to improve service.

Mr. Veniot rejected this argument and ordered the Municipality to cease and desist. It’s a lengthy decision with lots more in it than I will cover here. In my view these are the most significant features and findings:

Mr. Veniot finds the characteristics of a person’s voice is personal information, but does not consider the sensitivity of this information in the balance. He does not engage in an explicit analysis of whether the content of call centre employees’ communications are their “work product” or their personal information, though he appears to view it at personal information given his comments about the intrusiveness of monitoring “every single word” uttered on calls.
Mr. Veniot interprets the “necessity” standard for collection in the legislation strictly, distinguishing the text of the Nova Scotia statute from text of PIPEDA (which speaks of “reasonableness”) and implying that a necessity standard does not entail a balancing of legitimate interests. His approach is technical and focussed on language, and very different from the purposive and contextual approach taken by the British Columbia based on identical statutory language in the British Columbia Freedom of Information and Protection of Privacy Act.
Although finding there is no “free-standing” right of privacy, Mr. Veniot states that employees come into the collective bargaining relationship with a right to “some” privacy, and therefore, “the question is never whether that right is in the agreement – something [he has] never seen – but how and on what basis the employer can argue that employee [sic] have surrendered any portion of that right.”

This is the first case I’m aware of on the issue of recording call centre communications.

Halifax (Regional Municipality) and Nova Scotia Union of Public and Private Employees, Local 2 (Policy Grievance) (Re), [2008] N.S.L.A.A. No. 13 (Veniot).

Case Report – Doctors’ Association a “trade union” for the purposes of FIPPA

On September 9th, the Divisional Court dismissed an application for judicial review of an Information and Privacy Commissioner/Ontario order in which parts of a memorandum of agreement between the Ontario Medical Association, the Canadian Medical Protective Association and the Ministry of Health and Long Term Care were ordered to be disclosed.

On a point relating to the IPC’s jurisdiction over the MOU, the Court held that the MOU was “an agreement between an institution and a trade union” and therefore not excluded from FIPPA as a record of communications about labour relations. It relied heavily on the Ontario Court of Appeal’s 2003 finding that negotiations between the OMA and the Ministry were a matter of “labour relations” for the purposes of applying the exclusion itself, therefore making a similarly-broad interpretation of the exception to the exclusion proper in the name of coherence.

The Court also considered the applicants’ attempt to distinguish the terms of the MOU from the terms of a standard supply contract, which are routinely denied protection from public access on the principle that information produced by a negotiation cannot be “supplied” by a third-party. The IPC’s key factual finding, deferred to by the Court, was that certain actuarial assumptions provided by the CMPA and written into the MOU were a matter of negotiation when viewed in light of the parties’ custom. (Presumably these assumptions determined the cost of insurance, the subject matter of the MOU.)

Finally, the Court affirmed the IPC’s finding that certain information had not been supplied with a reasonable expectation of confidentiality.

Canadian Medical Protective Association v. Loukidelis, 2008 CanLII 45005 (Ont. Div. Ct.).

Cloud Computing, Second Life and the University

This is the title of our just-published university sector client bulletin. It was one of those writing projects I thought I could tackle quickly but led to some significant inquiry and learning, all of which was rewarding. It is written for universities but is relevant to anyone with responsibility for computer use policy in an organization. Click here for more. Hope it is helpful.

Case Report – FC orders party to generate and produce an accounting report

In this August 13th decision, the Federal Court rejected a party’s argument that it should not be compelled to create a record that does not exist and ordered it to generate and produce monthly financial statements from its accounting software program. Though the party did not retain copies of the specific reports requested, the Court held it was possible to generate them with minimal burden. For a look at the Ireland Supreme Court case on the issue of creating records, click here.

Thanks to Peg Duncan, keeper of the Canadian E-discovery Case Law Digest, for passing this on.

Shields Fuels Inc. v. More Marine Ltd., 2008 FC 947.

Information Roundup – 14 September 2008

Here are some new readings that may be of interest. This week they come with a theme – legal issues relating to new computing models.

Randal C. Picker, “Competition and Privacy in Web 2.0 and the Cloud.” This is a nice survey of the legal issues raised by the consumer-based model of cloud computing typically associated with Web 2.0 applications. (Social Science Research Network)
Larry Wescott, “Stored Communications Act does not prohibit discovery of electronic communications stored by non-party service provider.” A good case summary about a production dispute that centred around the City of Detroit’s control over records in the custody of its communications service provider and how its control, in turn, relates to City employees’ privacy interest in the records. (Electronic Discovery Law Blog)
Bettina M. Chin, “Regulating Your Second Life: Defamation in Virtual Worlds.” Ms. Chin argues that the real-world economic interests that are now engaged by Second Life’s “metaverse” justify the validity of real world defamation claims. She then covers some of the very complex legal issues associated with such claims. (Social Science Research Network)
Zach Lowe, “Does outsourcing put private data at risk?” To round out our theme, a short news story on the latest developments on the legal outsourcing debate in the U.S. (Law.com)

This blog post comes to you from Halifax. I’m on a surf/construction management trip and have a lot of time to blog and work because I couldn’t imagine smaller waves than what we’ve had this weekend. So I’ve been camping out at our half-built house, reading and blogging off of an air card powered by a portable generator. This sets a new wireless standard for me. Ocean views with a horse in the paddock out front. Not bad.

See ya!

Dan

Case Report – Arbitration board upholds challenge to post-incident testing provision

On September 3rd, an arbitration board chaired by David Elliot held that a post-incident drug and alcohol testing provision was unreasonable because it required for an automatic test of any employee “involved” unless there were reasonable grounds to find that alcohol or drugs did not cause the incident.

The board felt that this reverse onus was improper. It did not, however, find that an employer must have reasonable grounds in order to test, and endorsed an approach whereby a test could also be ordered where there is, “no credible explanation for the accident, near miss or other potentially dangerous incident.” This finding, which seems sensible, may have been influenced by evidence that supervisors were applying the reverse onus improperly by asking, “Can the use of drugs or alcohol be ruled out?”

Re Communications, Energy and Paperworkers Union, Local 707 and Suncor Energy Inc. (3 September 2008, Elliot).

Case Report – BCCA dismisses leave to appeal forensic inspection order

On September 9th, the British Columbia Court of Appeal dismissed an application for leave to appeal of an order for forensic inspection of a home computer. The applicants argued that the propriety of such orders is of broad significance to the practice, but Bauman J. responded, “In my respectful view, the plaintiff overstates the significance of the case and the scope of the order at bar.”

For a summary of the reasoning given in support of the order, click here.

Honour v. Canada, 2008 BCCA 346.

Case Report – Alberta OIPC releases two biometrics decisions

The Alberta OIPC has recently released two reports on the use of biometrics for timekeeping purposes. In both, the OIPC upheld the use of biometrics after conducting a contextual analysis that de-emphasized the invasiveness of standard biometric timekeeping systems.

Encrypted form in which information stored weighs in favour of use

The first report, dated August 7th, was made in response to a complaint brought under Alberta’s public sector privacy legislation. The complainant objected to a biometric timekeeping system which relied on a numeric template produced from hand measurements. The rationale for the system – time fraud protection and administrative efficiency – was not particularly unique, though the institution did provide evidence that it had dismissed one employee for buddy punching in the past. The adjudicator nonetheless held that the institution met the FIPPA necessity requirement, in part because the information was stored in a form in which it was not likely to be misused.

The complainant was under the impression that the hand scanner would “take [her] hand print.” If the hand recognition system gathered biometric information that was useful in another context, this would represent a potential privacy risk. For example, if the hand scanner captured an image of the employees’ palms or fingerprints, this information could be used in a law enforcement context. Having employees participate in a mandatory system that increases risk to their privacy would certainly be intrusive. However, the system does not gather a palm print or finger print; it collects hand measurements, which it translates into a unique number (the template). The template is useful only when combined with the employee’s identification number and the payroll system at Intercare. It seems unlikely that the template could be put to any other use, mitigating the privacy risk and making it less intrusive.

While this is a helpful finding for employers, the adjudicator did state, “This finding does not represent ‘privacy carte blanche’ for public bodies to implement biometric systems.”

Investigation Report F2008-IR-001 (Alberta OIPC).

Use of biometrics okay, but notice especially important for employers

The OIPC reached the same conclusion on the question of use in the second decision, dated August 27th and made in response to a complaint filed under the Alberta PIPA. This case involved the use of a numeric template produced from employee thumbprints. The employer’s rationale for use was fairly general, but in finding the employer met the reasonable collection standard in PIPA the OIPC drew an express link between the employer’s rationale for use and the form in which the biometric information was stored. It said:

While Empire Ballroom previously used another method (the time card/punch clock) it was ineffective due to abuse. Having the manager sign each employee in and sign out was inefficient, and the biometric sign-in system is a paperless system that yields more accurate arrival and departure information that is far more difficult to dispute. The system is also more secure in that employees are unable to access each other’s personal information. In terms of this finding, it is significant that Empire Ballroom does not collect actual thumbprints. Were that the case, my findings might be different.

… an important distinction must be made between collection of actual biometric information used for “one-to-one identification” of a person, and collection of numeric representations of biometric attributes for “one-to-one authentication” of an individual. In the latter case, a finger, hand, voice, or facial imprint is not actually captured; instead numbers representing unique features of a biometric, from which the biometric cannot be reconstructed or reproduced, are collected.

Although endorsing the employer’s use biometrics for timekeeping purposes, the OIPC held that the employer did not meet the reasonable notification requirement embedded in the Alberta PIPA employee personal information provisions because it did not explain to employees that it would only collect a numerical representation of thumbprints and not thumbprints themselves. It stressed that identifying personal information to be collected with specificity is important, particularly when information is to be collected through new and misunderstood technologies and particularly for employers, who are relieved from the ordinary consent requirement under PIPA.

Investigation Report P2008-IR005 (Alberta OIPC).

Information Roundup – 5 September 2008

Here are some links which may be of interest.

C. Evan Stewart, “In-House Counsel as Whistleblower: A Rat Without a Remedy?” A great synopsis on the American case law on the retaliatory discharge tort claim. (Law.com)
The Sedona Conference WG1, “The Sedona Conference Commentary on Preservation, Management and Identification of Sources of Information that are Not Reasonably Accessible.“ WG1 proposes six guidelines that touch on data preservation and records management. The group endorses collaboration, but its most detailed and useful guideline is on unilateral preservation decisions made in advance of dialogue. The group provides a decision tree and, notably, recommends that preservation decisions ultimately be made after a consideration of proportionality – that is, by asking whether the cost or burden of preserving not reasonably accessible data is excessive as compared to the relevance or value of the information. Brutally-awkward title and very good content as usual for the TSC. (The Sedona Conference)
Lisa Austin, “Reviewing PIPEDA: Control, Privacy and the Limits of Fair Information Practices.” This is older – from a 2006 volume of the Canadian Business Law Journal – but I hadn’t read it and it appears to have just been posted on the SSRN. (Social Sciences Research Network)

Just heading up north for the weekend for my sister-in-law’s wedding. Should be a good time. Hope you have a good one too!

Dan

Information-sharing a part of recent Dawson College discussion

The media has reported on the release of the Coroner’s report on the 2006 Dawson College shooting and Quebec’s new gun control law, which came into force on Tuesday. I believe the report is only available in French (though if someone knows otherwise, please let me know).

The focus of the recent discussion is on gun control, but there are a number of information-related points of significance. First, the media again has suggested that privacy laws prohibited information-sharing and contributed to the incident. Second, the Quebec coroner’s report apparently recommends that health and education officials should have access to the federal gun registry so they would know if a student or patient has a gun, which begs the tough question, “And then what?” And finally, the new Quebec law includes a requirement on teachers and educational administrators to report suspicious behaviours to the police and a statutory authorization for these individuals and certain health care professionals to make such reports. The standard for reporting is a “reasonable grounds” standard and there must be a link between the behaviour and harm “by the use of a firearm.”

Notably, under the new Quebec legislation, health care professionals who are not educational administrators – “professionals occupying a management position” in the language of the Bill – do not appear to be subject to a mandatory reporting duty. Rather, they are given a discretion to report based on observation of behaviour that does not necessarily meet the traditional risk of “serious and imminent harm” standard but is linked to the use of a firearm.

As readers of this blog know, I’m very interested in the topic of information sharing and managing the threat of on-campus violence. For more on this topic, see this post.