Voiceprints not a violation of privacy

The Federal Court of Appeal has upheld a decision by the privacy commissioner that collecting and storing voiceprints for voice recognition technology used to remotely access a company’s internal computer network does not violate the privacy of employees.

Burnaby, B.C.-based Telus Communications Inc. introduced a new technology in 2003 called “eSpeak,” which provides a secure way for employees to access the company’s network remotely from any telephone and perform various operations when working in the field. To access the network through eSpeak, employees must verify their identity using a voiceprint identification system.

Telus identified certain employees who work in the field and need to remotely access the company’s network and requested their consent to enrol in the eSpeak system. Enrolment involves creating a voiceprint consisting of a “matrix of numbers that represent characteristics of the employee’s voice and vocal tract.” Each employee’s voiceprint is based on a sample of his voice but is not an actual audio sample. The voiceprint data is stored by Telus for as long as the individual works for Telus. The actual voice sample is destroyed within two months of it being taken.

Three employees — Randy Turner, Paul Wansink and Paul Bernat — refused to enrol, claiming the collection of voiceprints was an invasion of privacy and the company could not obtain the information without their consent under the Personal Information Protection and Electronic Documents Act (PIPEDA). They also claimed the company had threatened to carry out “progressive discipline” to those who refused the enrolment, which is also not permitted under PIPEDA. The three men filed a complaint with the Privacy Commissioner of Canada. A fourth employee, Henry Fenske, who submitted his voiceprint but claims he was coerced, joined in the complaint.

On Sept. 3, 2004, the privacy commissioner released a report finding that the reasons for Telus collecting personal information, in this case the voiceprints, were appropriate. The employees were properly informed of those reasons and “appropriate safeguards were in place to protect the voiceprint information,” which were permitted under PIPEDA.

The commissioner ruled that although collecting a voiceprint is a personal encroachment, it does not provide substantial information about an individual and Telus showed it can only use the voiceprints for the stated authentication purposes and no other uses. When the four employees appealed to the Federal Court on Nov. 29, 2005, it agreed with the privacy commissioner and added that Telus did not need to obtain the employees’ consent because the collection of the voiceprints, which would enable them to do their jobs more efficiently and securely, was in the employees’ interest and could not be otherwise obtained in a timely fashion.

The four employees appealed to the Federal Court of Appeal. The Court of Appeal agreed with the lower court’s findings that the purposes for collecting the information were reasonable and, under the current technology, Telus had taken appropriate security measures for the protection of that information. It added an important point: “While it is true that what is collected is the voice, the fact is that what is used by Telus is not the voice itself, but the voiceprint, which is a matrix of numbers.”

However, the Court of Appeal disagreed with the application of the PIPEDA exception that consent could not be obtained in a timely fashion. It obviously was possible since Turner, Wansink and Bernat had refused and Fenske had given his consent.The court found Telus was obliged to obtain consent from its employees but, since the eSpeak system requires co-operation for enrolment, “it is not possible to create a voiceprint without an individual’s knowledge and participation, and therefore consent.” It was impossible for Telus to obtain the voiceprints without the employees’ consent and therefore it did not have the information from the three who refused to proceed.

The Court of Appeal also felt the issue of the threat of discipline was irrelevant. Telus did not actually discipline Turner, Wansink, Bernat, Fenske or any other employees. The only mention of “progressive discipline” was by a Telus supervisor at a party and there was nothing official implemented. The Court of Appeal pointed out that, for informed consent to be given under the legislation, the employer has a duty to inform the employee of possible consequences of refusal. Fulfilling this duty is not equal to making threats of discipline, and the court felt any reference to discipline in this case was a case of Telus fulfilling that duty.

The company’s implementation of eSpeak and the accompanying requirements for voiceprints was not contrary to the PIPEDA, according to the Court of Appeal, “in view of the fact that consent to the collection of voice characteristics was actually sought by Telus and that no disciplinary measure has yet been taken by Telus.”

The Court of Appeal upheld the earlier rulings that Telus had legitimate reasons for collecting employee information through voiceprints and that this information, and the privacy of Telus employees, was adequately protected.

For more information see:

• Turner v. Telus Communications Inc., 2007 CarswellNat 172 (Fed. C.A.).