WINNERS & LOSERS: Can You Collect GPS Information on Workers in Employer-Owned Vehicles?

0
5

In many workplaces, workers drive employer-owned vehicles as part of their jobs, say, to see clients or go to other worksites. Employers have an interest in ensuring that workers operate these vehicles safely, such as by not speeding, and are where they’re supposed to be during work hours. So some employers are using technology such as GPS to monitor workers’ use of these vehicles. But does collecting GPS information violate workers’ privacy rights? The answer often depends on whether the employer properly notified workers of the purposes for the collection, use and disclosure of the vehicle information gathered. Here are two cases decided by the Information and Privacy Commissioner of BC—within two months of each other—that considered the permissibility of collecting and using GPS and similar data on the movements of workers in employer-owned vehicles.

COLLECTION WAS PERMISSIBLE

FACTS

An elevator company collected GPS and engine use data from employer-owned vehicles its mechanics used to drive to clients to service and repair their elevators. The information collected included the vehicles’ locations and movements, engine start and stop times and excessive speeding, braking and acceleration. The company said this information helped it take a pro-active approach to safe driving and ensure the mechanics’ safety. For example, the system helped it locate a missing mechanic and investigate a fatality. It also helped the company ensure mechanics were complying with company policies, such as hours-of-work. But the mechanics claimed the information collection violated their rights under privacy laws.

DECISION

The Information and Privacy Commissioner of BC upheld the information collection.

EXPLANATION

Under privacy law, an employer can collect so-called “employee personal information” if it gives workers notice about the purpose for collecting and using such information. In addition, its collection and use of the information must be reasonable for “establishing, managing or terminating an employment relationship.” The Commissioner determined that the data collected from the vehicles driven by the mechanics was protected employee personal information. But the company had provided proper notice of the information’s collection and use. And its collection and use of the information were tailored to the intended purpose, were likely to be effective, didn’t involve sensitive information and didn’t harm the mechanics’ dignity. The Commissioner concluded that the collection was used for the reasonable purpose of monitoring and improving safety, maintaining vehicles and managing the employment relationship with drivers and thus was permissible.

Schindler Elevator Corp (Re), [2012] BCIPC 25 (CanLII), Dec. 19, 2012

COLLECTION WASN’T PERMISSIBLE

FACTS

A university gathered GPS information from its on-campus security patrol vehicles to monitor the whereabouts and behaviour of security guards on duty. The information collected included the vehicles’ location and speed and when it was turned on and off. The university installed the equipment so it could use the data to dispatch patrol vehicles effectively, locate security guards for their safety and track distances vehicles traveled for maintenance purposes. The union argued that collecting the GPS information violated the guards’ rights under privacy laws.

DECISION

The Information and Privacy Commissioner of BC ruled that the information collection wasn’t permissible.

EXPLANATION

The Commissioner found that the information collected from the patrol vehicles was personal information under privacy law. The university’s monitoring activities and information collection were permitted, however, because they directly related to campus security, including employee safety, guards weren’t continuously monitored and the information collected from the GPS system wasn’t sensitive. But the Commissioner also found that the university’s privacy policy was inadequate. For example, it was unclear as to how the university would use the information collected. And the university didn’t give guards adequate notice of its intended purposes for implementing the GPS system and collecting and using information from it until 18 months after it began collecting personal information. So the Commissioner ordered it to stop collecting, using or disclosing personal information from the GPS system until it complied with the notice requirements.

University of British Columbia (Re), [2013] BCIPC 4 (CanLII), Feb. 1, 2013