Labour and Employment Law Blog

On December 18, 2013, the Alberta Office of the Information and Privacy Commissioner ordered an employer to provide training to its staff on appropriate management of personal information in response to the employer viewing a former employee’s personal email account in breach of Alberta’s Personal Information Protection Act (“Alberta PIPA”).

The employer, Moore’s Industrial Service Ltd. (“MIS”), accessed a former employee’s (the “Complainant”) personal web based email account located on a company issued laptop that the employee had returned prior to retiring.  In particular, the CEO accessed the Complainant’s personal email account, reviewed emails and forwarded some emails to other employees in the company.  

MIS’s argued that it only reviewed emails that had the appearance of pertaining to MIS business. MIS argued that this was reasonable because the parties had entered into a termination agreement under which the Complainant was not to contact customers of MIS or discuss MIS’s business.

MIS first argued that the emails were "personal employee information" rather than "personal information." "Personal employee information" is personal information that is reasonably required for establishing, managing or terminating an employment relationship or managing a post-employment relationship and may be collected, used and disclosed for those purposes without the employee’s consent. Unlike B. C., in Alberta, it also expressly applies to managing a post employment relationship. The adjudicator determined that the Complainant’s personal email account was not "personal employee information" on the basis that reviewing the Complainant’s personal email was not "reasonably required" to enforce the termination agreement. In particular, there was no reason to believe the Complainant was violating the termination agreement.

Similarly, while personal information can be gathered without consent for the purposes of an investigation without consent, this is so only if it is reasonable to believe that a breach of any agreement had occurred.

MIS also argued that the Complainant was deemed to have consented to MIS viewing his personal email since the Complainant left the email account on the company issued laptop. The adjudicator also rejected this argument on the basis that simply leaving his email account on the laptop did not mean that the Complainant consented to MIS accessing his email account on an ongoing basis.

MIS was ordered to stop collecting, using and disclosing the Complainant’s personal information. Further, as a condition of complying with the Order, MIS was required to provide training to staff on the appropriate management of personal information.

This case pertains to an employee’s personal email account. As a general rule employers should not be accessing or reviewing employees personal email accounts, even where the personal emails may pertain to the workplace. Even if an employee consents, viewing an employee’s personal email is likely to be found to be unreasonable except in very limited circumstances. If an employer believes that as part of a workplace investigation, it needs to access an employee’s personal email account, the employer should seek legal advice prior to doing so.

While this case does not directly deal with company email, the Supreme Court of Canada has stated that employees have a reasonable expectation of privacy in the contents of a workplace computer, including email.

As such, employers need to be extremely cautious about viewing employees’ personal email sent using a workplace computer and all employers should have a policy in place on technology use in the workplace. Alberta’s Personal Information Protection Act is substantially similar to B.C.’s Personal Information Protection Act and the same analysis would apply in British Columbia.