Employee claimed breach of privacy but employer said disclosing information on medical condition was in the interest of public safety
The office of the Alberta Information and Privacy Commissioner has found a driver’s former employer did not breach privacy legislation when it provided personal information about him to Alberta Driver Fitness and Monitoring Branch (DFMB) relating to his ability to drive.
The employee was involved in a serious motor vehicle accident in 2004 which left him with post-traumatic stress symptoms. He received psychological treatment on an ongoing basis and was still receiving it when he was hired by Hearing Conservation Consultants Ltd. (HCC) in 2005. HCC provides mobile hearing test facilities for on-site testing of employees of organizations subject to occupational health and safety requirements. The position required a large amount of long distance driving.
About a year into his employment with HCC, the employee started getting high-blood pressure and blurred vision. He thought these symptoms may be a recurrence of the post-traumatic stress from his 2004 accident and he agreed not to drive until the symptoms subsided.
The employee provided a letter from his psychologist which explained he was suffering from a recurrence of stress symptoms and he went on leave in October 2006. However, a short time later, while still on leave, he was terminated. HCC contacted the employee’s psychologist, but couldn’t find out if he had passed on the medical information to the DFMB. Consequently, it reported the employee’s condition to the DFMB on Jan. 5, 2007, saying the company was concerned for public safety and its former employee’s ability to drive.
On Feb. 9, 2007, he received a letter from the DFMB that asked for a medical report from his doctor so it could determine if he was fit to drive. After he did so, the DFMB said he could continue to drive as long as he took an annual medical and psychological report. The employee later learned his symptoms were not a recurrence of post-traumatic stress after all. He felt the conditions placed on him to operate a motor vehicle were unfair and the result of an unauthorized disclosure of his personal information to the DFMB. He filed a complaint with Alberta’s privacy commissioner, saying the medical information he had given to HCC was for the purposes of his leave and HCC wasn’t authorized to disclose it for another purpose. He also claimed the DFMB wasn’t authorized to collect his personal information from any source other than a physician to restrict his driving privileges. These would all be violations of Alberta’s Personal Information Protection Act (PIPA).
The portfolio officer hearing the complaint found the DFMB was authorized to collect the information by the Freedom of Information and Protection of Privacy Act (FOIP), which allows a public body to collect information for sources other than the individual if it is for the purpose of law enforcement.
The officer found HCC passed on the employee’s information out of concern for public safety and “license issuers” should be aware of the information to take what action was needed. The DFMB used the information to investigate and gather more information directly from the employee. It didn’t impose any conditions on his ability to drive until it had investigated further. DFMB policy dictates it must investigate only valid complaints. HCC’s complaint was investigated and determined to be legitimate. As a result, the information was used to apply licensing conditions, which was the purpose for which it was collected and allowed under FOIP.
The officer noted PIPA made exceptions for consent where the personal information is disclosed to a public body which is authorized to collect it from an organization and found the DFMB met that criteria.
The officer found HCC disclosed information which was provided directly by the employee and it had made attempts to see if his psychologist had informed the DFMB, a reasonable concern given the potential effects on his ability to drive. When HCC couldn’t determine this, it disclosed the information to the DFMB itself, which was a reasonable disclosure for a legitimate purpose, according to the officer.
The officer found neither HCC nor the DFMB violated privacy legislation but in order to avoid a similar incident, he recommended HCC make a standardized insurance form available to employees for illness and disability, a standardized form for doctors to complete omitting specific details and develop a written privacy policy, which it was lacking.
“Employers and members of the public are able to report legitimate concerns about a person’s fitness to drive,” the officer said. “If (the DFMB) has reasonable and probable grounds to believe that a person poses a risk to him or herself or to the public, it is entitled to require a person to submit a medical or physical examination and place conditions on driving privileges.”
For more information see:
• Alberta Office of the Information and Privacy Commissioner Investigation Reports P2007-IR-005 (Hearing Conservation Consultants Ltd.) and F2007-IR-004 (Alberta Infrastructure and Transportation).
The employee was involved in a serious motor vehicle accident in 2004 which left him with post-traumatic stress symptoms. He received psychological treatment on an ongoing basis and was still receiving it when he was hired by Hearing Conservation Consultants Ltd. (HCC) in 2005. HCC provides mobile hearing test facilities for on-site testing of employees of organizations subject to occupational health and safety requirements. The position required a large amount of long distance driving.
About a year into his employment with HCC, the employee started getting high-blood pressure and blurred vision. He thought these symptoms may be a recurrence of the post-traumatic stress from his 2004 accident and he agreed not to drive until the symptoms subsided.
The employee provided a letter from his psychologist which explained he was suffering from a recurrence of stress symptoms and he went on leave in October 2006. However, a short time later, while still on leave, he was terminated. HCC contacted the employee’s psychologist, but couldn’t find out if he had passed on the medical information to the DFMB. Consequently, it reported the employee’s condition to the DFMB on Jan. 5, 2007, saying the company was concerned for public safety and its former employee’s ability to drive.
On Feb. 9, 2007, he received a letter from the DFMB that asked for a medical report from his doctor so it could determine if he was fit to drive. After he did so, the DFMB said he could continue to drive as long as he took an annual medical and psychological report. The employee later learned his symptoms were not a recurrence of post-traumatic stress after all. He felt the conditions placed on him to operate a motor vehicle were unfair and the result of an unauthorized disclosure of his personal information to the DFMB. He filed a complaint with Alberta’s privacy commissioner, saying the medical information he had given to HCC was for the purposes of his leave and HCC wasn’t authorized to disclose it for another purpose. He also claimed the DFMB wasn’t authorized to collect his personal information from any source other than a physician to restrict his driving privileges. These would all be violations of Alberta’s Personal Information Protection Act (PIPA).
The portfolio officer hearing the complaint found the DFMB was authorized to collect the information by the Freedom of Information and Protection of Privacy Act (FOIP), which allows a public body to collect information for sources other than the individual if it is for the purpose of law enforcement.
The officer found HCC passed on the employee’s information out of concern for public safety and “license issuers” should be aware of the information to take what action was needed. The DFMB used the information to investigate and gather more information directly from the employee. It didn’t impose any conditions on his ability to drive until it had investigated further. DFMB policy dictates it must investigate only valid complaints. HCC’s complaint was investigated and determined to be legitimate. As a result, the information was used to apply licensing conditions, which was the purpose for which it was collected and allowed under FOIP.
The officer noted PIPA made exceptions for consent where the personal information is disclosed to a public body which is authorized to collect it from an organization and found the DFMB met that criteria.
The officer found HCC disclosed information which was provided directly by the employee and it had made attempts to see if his psychologist had informed the DFMB, a reasonable concern given the potential effects on his ability to drive. When HCC couldn’t determine this, it disclosed the information to the DFMB itself, which was a reasonable disclosure for a legitimate purpose, according to the officer.
The officer found neither HCC nor the DFMB violated privacy legislation but in order to avoid a similar incident, he recommended HCC make a standardized insurance form available to employees for illness and disability, a standardized form for doctors to complete omitting specific details and develop a written privacy policy, which it was lacking.
“Employers and members of the public are able to report legitimate concerns about a person’s fitness to drive,” the officer said. “If (the DFMB) has reasonable and probable grounds to believe that a person poses a risk to him or herself or to the public, it is entitled to require a person to submit a medical or physical examination and place conditions on driving privileges.”
For more information see:
• Alberta Office of the Information and Privacy Commissioner Investigation Reports P2007-IR-005 (Hearing Conservation Consultants Ltd.) and F2007-IR-004 (Alberta Infrastructure and Transportation).
