An Adjudicator with the Office of the Information and Privacy Commissioner (OIPC) has determined that a private sector organization contravened the Personal Information Protection Act (PIPA) by improperly collecting and using personal information. Project Porchlight traced the telephone numbers the employee had dialed on his work-issued Blackberry device to learn the identities of the people he called and the nature of the calls.

Project Porchlight argued that it collected and used the information for the purposes of an investigation into a breach of agreement under certain sections of PIPA. The Adjudicator found that there was, in fact, no policy in place that restricted the ability of the individual to make personal calls using the Blackberry device, and there was therefore no such policy incorporated into the employment agreement. This means there could be no possible breach of the individual’s employment agreement and no ability for the employer to collect and use the individual’s personal information without consent for purposes of an investigation under PIPA. In addition, Project Porchlight could not collect or use the information as personal employee information because it had not given the individual proper prior notice.

The Adjudicator ordered the employer to stop collecting and using personal information in contravention of PIPA.

With this order, the OIPC has affirmed a clear standard: companies and organizations need to develop and implement specific policies for appropriate employee use of company information and information systems, especially if such policies are in effect the basis for any employment management actions involving collection, use and disclosure of personal information.

Cenera’s Privacy and Information Practice brings a wealth of experience and expertise to its private and public-sector clients in assessing, designing, and implementing privacy and information management programs, policies, and services.  For more information on how we can help and support you, go to Privacy and Information Management/cenera.ca or contact Rick Klumpenhouwer, Partner, Privacy and Information Management Practice, Cenera,  403.294.3799, [email protected].