Power and privacy

Should privacy commissioners have the power to punish?

By Jeffrey R. Smith ([email protected])

In wrongful dismissal cases, without extenuating circumstances such as bad faith, the trend is for decision-makers is to award damages in relation to real losses suffered by the employee, such as pay and the time it takes to find new employment.

In other types of employment-related cases where employers are ordered to pay employees, such as human rights complaints, the idea is for the damages to compensate for other types of losses like mental distress and loss of dignity.

However, in privacy cases, usually adjudicators have less power to make these types of awards. Often, at least at the provincial level, a decision ends with the employer ordered to stop violating privacy legislation and educate its workforce on privacy protection.

The federal privacy commissioner doesn’t even have order-making power. But if the current federal commissioner, Jennifer Stoddart, has her way, she might soon.

Stoddart recently indicated in a public lecture she was thinking about seeking some new powers for her office, such as the power to make orders, issue penalties and name organizations found in violation of the Personal Information Protection and Electronic Documents Act (PIPEDA). This could raise significant concerns for employers covered by the federal privacy legislation.

Employers collect and store personal information on employees, so they must be aware of the importance of protecting that information. Indeed, a careless or malicious violation of that right to privacy maybe should warrant some sort of sanction. But should privacy adjudicators have the same kind of authority courts and arbitrators have in levying punishment to the employer or compensation to the employee?

In a lot of cases where personal employee information is disclosed, the disclosure was inadvertent or the employer simply wasn’t aware which information it could or couldn’t disclose. While that doesn’t excuse it, sometimes there isn’t much harm done, so ordering the employer to stop what it’s doing — something the employer usually does as soon as the complaint is filed — and ensure its staff are up to speed on their privacy responsibilities seems like an appropriate solution.

If a privacy violation is serious enough to cause real losses to an employee, shouldn’t the matter go before a court or arbitrator instead?

Jeffrey R. Smith is the editor of Canadian Employment Law Today, a publication that looks at workplace law from a business perspective. For more information, visit www.employmentlawtoday.com.

Latest stories