Decision defines specific uses for which employers can use tracking devices
The use of global positioning systems (GPS) on company vehicles may be of concern to employees who might feel the boss is looking over their shoulder. However, the Office of the Privacy Commissioner of Canada recently ruled it is acceptable when used for certain purposes in the second case in which the privacy commissioner considered the use of GPS in an employer’s fleet of vehicles under the Personal Information Protection and Electronic Documents Act (PIPEDA).
The employee was a driver for a transportation service contracted by a municipality to provide transportation for mobility-impaired people. The employer installed mobile data terminals (MDTs) and GPS in its vehicles.
The MDTs relayed information between the drivers and dispatchers, such as times for pick-up and drop-off and fares collected. The devices also indicated the name and address of each client to be transported. The GPS devices tracked the vehicle’s exact location and was used for route scheduling, service adjustments, emergency services and determining accurate vehicle-arrival information. The GPS data was retained for three months and only accessed if there was a client complaint.
However, the employee filed a privacy complaint, saying the MDT and GPS systems were installed to keep track of his time throughout the day, ensure he did not take breaks or lunch, time every pick-up and drop-off and track his routes and travel times.
The Office of the Privacy Commissioner of Canada found the complaint was not well-founded, since there was no evidence to corroborate the allegation that the personal information collected through the devices was used for employee management. The Office noted the employer has remained committed to using the personal information from the devices only to improve service and client safety.
Guidelines for using GPS systems
The use of MDT and GPS systems will likely increase as organizations discover the efficiencies associated with computer assisted dispatching and tracking. Organizations that fall under PIPEDA’s jurisdiction who are contemplating the use of GPS and MDT on vehicles should establish appropriate policies and practices in order to comply with the provisions of PIPEDA, as well as those established by the Office of the Privacy Commissioner of Canada in its two cases dealing with this issue (the first case was in 2006).
The Office of the Privacy Commissioner of Canada has endorsed the following justifications for using GPS and MDT technology in the workplace:
•workplace productivity, including route scheduling, service adjustments and service improvement
•more accurate vehicle-arrival information for clients
•asset management and protection (retrieving stolen, abandoned vehicles)
•increasing business competitiveness
•safety and emergency service.
Since GPS systems are capable of collecting “personal information” as defined in PIPEDA, organizations must obtain employee consent before implementation. However, if using GPS for the purposes listed above, consent need not be express, but may be implied. In practical terms, this means informing employees GPS devices are being installed and for what purposes in advance of implementation.
Although using GPS to track a vehicle is not overly invasive, routinely evaluating worker performance based on the GPS information impinges on individual privacy. As a result, GPS data should not be used as a normal part of employee management. The use of GPS for employee management may only be acceptable in certain situations, but the organization must define and communicate this to employees beforehand. It must be clear about such purposes and establish a policy outlining the intended use of GPS data for this purpose. The policy should limit the intended uses of the data to investigating complaints and addressing “productivity issues.”
Organizations should be clear that productivity is measured in various ways (other than by GPS) and reported and reviewed on a regular basis, and if an individual is found to have below-standard metrics, the manager is expected to address the issue. The company’s policies should also note in exceptional cases, further investigation may be required before arriving at any conclusions and GPS data may provide information to assist in addressing a productivity issue. The policy should also state GPS data may be used to provide high-level vehicle use reports to allow analysis of productivity generally.
Organizations should also train managers to ensure they use GPS appropriately and not for monitoring of individual employee locations.
Employers who use GPS must also comply with the provisions of PIPEDA which are not directly addressed in the two cases, such as the safeguarding and disclosure of data once it is collected.
For more information see:
•Office of the Information and Privacy Commissioner Case #2009-11 (May 27, 2009).
•Office of the Information and Privacy Commissioner Case #2006-351 (Nov. 9, 2006).
