Telus wins case against employees refusing voice password consent
A case at the Federal Court arising from four Telus workers’ refusal to take part in a voice authentication program has raised more questions than it answered regarding the application of the Personal Information Protection and Electronic Documents Act (PIPEDA).
Among those questions is whether a union has any standing at all in a privacy case that invokes PIPEDA. The privacy legislation took effect in 2004 as the default privacy protection law governing all private-sector, commercial transactions in provinces that don’t have a similar law.
In Turner v. Telus, issued late November, Federal Court judge J. Gibson said definitively that a union does not have standing. The question that his decision raises, however, is whether a union could ever fight a privacy infringement in a grievance or arbitration by invoking PIPEDA, said Tim Lawson, partner at Heenan Blaikie in Toronto.
“I think if the foundation of a grievance is the employer has violated the privacy rights of employees, it may be arguable now that the union can’t bring that forward as part of the grievance if that part isn’t based on the collective agreement. I know I plan to use this in an upcoming case.”
The ruling confirms that privacy is not an absolute right but an interest that has to be balanced against an employer’s business interests. In considering this balance, judge Gibson asked whether a reasonable person would find the privacy infringement to be appropriate.
The infringement being considered in this case was the collection and use of employees’ voice prints as part of Telus’ introduction of e.Speak, its voice password technology. According to the company, the system is more efficient and cost-effective than paper processes and password management, and given the risk associated with managing large amounts of customer data, offers the highest level of protection from unauthorized access.
The judge acknowledged that obtaining an employee’s voice print is indeed an encroachment on the person, but he added that an individual’s voice print in and of itself reveals little about the person.
Lisa Warren, lawyer for Telus, and partner at the Vancouver law firm, Farris, Vaughan, Willis and Murphy, said the most important aspect of the case “is a recognition that there is what I’ll call a reasonable person test in the legislation and the judge found that Telus had met that test.”
Warren also noted that, although the four individuals who withheld their consent were not disciplined, “the judge is saying that once you meet a reasonable person test, then the refusal by the employee to comply with a request can and must necessarily lead to some consequences for the employee.”
Other lawyers aren’t so sure about the implications of the ruling on the question of employee consent. Chris Foulon, partner at Toronto’s Israel Foulon, said he found it problematic that, while acknowledging that the employees are legally entitled to withhold their consent, the judge at the same time said the company would be legally entitled to issue progressive discipline to the individuals if they do so.
“I have to admit I can’t reconcile that with the concept that an employee is entitled to refuse to give consent. I don’t think we get much direction from the court as to how this will be dealt with in the future,” said Foulon.
“(The judge) was quite clear in saying that the employees had a legal right to withhold their consent. If you have the legal right to do something, it’s difficult to see why you can be given progressive discipline for having done that.”
Foulon also has difficulty with the judge’s interpretation of section 7(1)(a) of PIPEDA, which allows for the collection of information without consent if that consent cannot be provided in a timely way.
In the decision, the judge said that particular provision would apply in this case to allow for Telus to go ahead and implement the system, despite the four individuals’ refusal to take part. Foulon said he found that interpretation to be a stretch.
“If he’s saying that your withholding consent means that consent cannot be obtained in a timely way, then that would be a problem. That would be an overly broad interpretation.”
Both Foulon and Lawson found it useful that the judge refused to consider “what if” scenarios that the non-consenting employees raised in objecting to the system.
“It looks like the employees were raising some hypothetical issues, like what might the company do with this voice recognition technology, and the judge said, ‘No, we look at what the company could do with it now. We’re not going to engage in Orwellian futuristic kind of thinking about what may be down the road,’” said Foulon.
At press time, David Aaron, lawyer for the four Telus employees declined to comment on the ruling. He said only that his clients were “still evaluating the decision so as to determine the next step.” He added that “the reasons for judgment don’t adequately deal with the extremely critical privacy issues of our time.”
Among those questions is whether a union has any standing at all in a privacy case that invokes PIPEDA. The privacy legislation took effect in 2004 as the default privacy protection law governing all private-sector, commercial transactions in provinces that don’t have a similar law.
In Turner v. Telus, issued late November, Federal Court judge J. Gibson said definitively that a union does not have standing. The question that his decision raises, however, is whether a union could ever fight a privacy infringement in a grievance or arbitration by invoking PIPEDA, said Tim Lawson, partner at Heenan Blaikie in Toronto.
“I think if the foundation of a grievance is the employer has violated the privacy rights of employees, it may be arguable now that the union can’t bring that forward as part of the grievance if that part isn’t based on the collective agreement. I know I plan to use this in an upcoming case.”
The ruling confirms that privacy is not an absolute right but an interest that has to be balanced against an employer’s business interests. In considering this balance, judge Gibson asked whether a reasonable person would find the privacy infringement to be appropriate.
The infringement being considered in this case was the collection and use of employees’ voice prints as part of Telus’ introduction of e.Speak, its voice password technology. According to the company, the system is more efficient and cost-effective than paper processes and password management, and given the risk associated with managing large amounts of customer data, offers the highest level of protection from unauthorized access.
The judge acknowledged that obtaining an employee’s voice print is indeed an encroachment on the person, but he added that an individual’s voice print in and of itself reveals little about the person.
Lisa Warren, lawyer for Telus, and partner at the Vancouver law firm, Farris, Vaughan, Willis and Murphy, said the most important aspect of the case “is a recognition that there is what I’ll call a reasonable person test in the legislation and the judge found that Telus had met that test.”
Warren also noted that, although the four individuals who withheld their consent were not disciplined, “the judge is saying that once you meet a reasonable person test, then the refusal by the employee to comply with a request can and must necessarily lead to some consequences for the employee.”
Other lawyers aren’t so sure about the implications of the ruling on the question of employee consent. Chris Foulon, partner at Toronto’s Israel Foulon, said he found it problematic that, while acknowledging that the employees are legally entitled to withhold their consent, the judge at the same time said the company would be legally entitled to issue progressive discipline to the individuals if they do so.
“I have to admit I can’t reconcile that with the concept that an employee is entitled to refuse to give consent. I don’t think we get much direction from the court as to how this will be dealt with in the future,” said Foulon.
“(The judge) was quite clear in saying that the employees had a legal right to withhold their consent. If you have the legal right to do something, it’s difficult to see why you can be given progressive discipline for having done that.”
Foulon also has difficulty with the judge’s interpretation of section 7(1)(a) of PIPEDA, which allows for the collection of information without consent if that consent cannot be provided in a timely way.
In the decision, the judge said that particular provision would apply in this case to allow for Telus to go ahead and implement the system, despite the four individuals’ refusal to take part. Foulon said he found that interpretation to be a stretch.
“If he’s saying that your withholding consent means that consent cannot be obtained in a timely way, then that would be a problem. That would be an overly broad interpretation.”
Both Foulon and Lawson found it useful that the judge refused to consider “what if” scenarios that the non-consenting employees raised in objecting to the system.
“It looks like the employees were raising some hypothetical issues, like what might the company do with this voice recognition technology, and the judge said, ‘No, we look at what the company could do with it now. We’re not going to engage in Orwellian futuristic kind of thinking about what may be down the road,’” said Foulon.
At press time, David Aaron, lawyer for the four Telus employees declined to comment on the ruling. He said only that his clients were “still evaluating the decision so as to determine the next step.” He added that “the reasons for judgment don’t adequately deal with the extremely critical privacy issues of our time.”
