The PIPEDA puzzle

Written by Laura Garetson

It’s 2:25 P.M. Two employees, certain no one is watching, slip into their cars and drive away from work 35 minutes early. But the shift supervisor sees the entire incident with the aid of a security camera and doles out reprimands the next day. The employees take the boss to court, arguing the camera invaded their privacy. True or false: the employees win?

True. In a recent court judgment, the use of a security camera at a rail yard to identify employees leaving their posts early was deemed inappropriate. The employees claimed their manager’s actions violated their right to privacy because the camera was intended for monitoring train movement only, and the courts agreed.

Was this an invasion of privacy? Maybe. But you’ll be surprised to know that it is also a violation of PIPEDA — the Personal Information Protection and Electronic Documents Act. Expanded in January 2004 to cover all businesses in provinces that do not have their own analagous law, PIPEDA regulates the collection, use and disclosure of personal information by all Canadian businesses.

Recent PIPEDA cases include the reprimand of a bank for issuing an unrequested promotional credit card; the spanking of an airline for using flight information to inform a survey; and the investigation of a courier after it wanted to photocopy a shipper’s photo ID before shipping a package to the U.S.

Clearly, PIPEDA is not solely the concern of telemarketers and mailing-list brokers. So how can your firm avoid falling afoul of the act? The trick is realizing that PIPEDA applies not only to personal information collected on paper or electronically, but from all sources, including various correspondence, pictures, sound recordings and videotape. “Businesses need to focus not just on info they collect from individuals, but on everything they learn about those about individuals,” says Robert Parker, Toronto-based national privacy partner with Deloitte and Touche. The key, according to Parker, is to ask yourself the following when collecting personal information: “Is this reasonable to do? Was it reasonably done? Are there less intrusive methods I could use?” That, he says, is a good start to covering the bases.

© 2004 Laura Garetson

Originally appeared on PROFITguide.com