B. The supervisor’s asking the worker for a medical diagnosis would be a privacy violation unless the government had declared H1N1 to be a public health emergency.
This hypothetical was inspired by guidelines recently published by the federal, Alberta and BC privacy commissioners on how the privacy laws apply to workplaces during the H1N1 pandemic. The guidelines’ message: Unless and until swine flu is declared a public emergency, the privacy laws apply in the “usual way.” That is, employers are permitted to collect only the minimum amount of personal information necessary to meet a business need. Asking a worker if he has swine flu is a request for his diagnosis. And under the “usual” privacy rules, an individual’s medical diagnosis is protected personal information and employers may not request it from their workers. So when a worker calls to say he’s not coming in, all the employer is generally entitled to ask is his prognosis—that is, 1) if the worker is sick and 2) when he’s likely to return to work. The employer isn’t entitled to know the worker’s diagnosis. (Of course, workers can volunteer this information and, in fact, are encouraged to do so when they have an illness that’s easily spread and to which they could have exposed their co-workers.)
However, the rules could change if H1N1 was declared to be a public emergency. In that situation, the government could issue broad orders under the public health laws not only permitting but also requiring the collection, use and disclosure of workers’ personal information. Thus, if the government had declared H1N1 to be an emergency pandemic, the supervisor’s asking the worker if he had swine flu would not only be appropriate but also likely required.
WHY WRONG ANSWERS ARE WRONG
A is wrong because the fact that the supervisor’s question asks for personal information doesn’t end the analysis. Information collection practices that infringe on a worker’s privacy rights could become acceptable in the event of a public emergency. The idea is that, in a crisis, privacy rights must give way to some extent to protect the public in general and allow the government to coordinate an appropriate response to the medical emergency.
C is wrong because although attempting to protect the company’s business is a legitimate purpose, the guidelines make it clear that collecting private medical information from a worker isn’t necessary to fulfill that purpose. For example, to avoid having operations disrupted by a flu outbreak, the manufacturer could have developed a business continuity plan for possible staffing shortages that, say, permitted workers to telecommute. (For more information on business continuity plans, see Insider, Vol. 4, Issue 9, page 14.)
D is the wrong answer but a true statement. Under the OHS laws, employers do have a duty to protect workers from not only injuries but also illnesses, such as swine flu, in the workplace. But the guidelines suggest that the government believes employers can fulfill that duty without trampling on workers’ privacy rights by relying on less intrusive measures, such as education, training and infection control.
INSIDER SOURCE
Privacy in the Time of Pandemic: Guidance for Organizations, Federal Privacy Commissioner of Canada, Information and Privacy Commission of Alberta and Information and Privacy Commission for BC, Oct. 28, 2009
Loading ...
