Page 36 - CCCA61_2013

CCCA_V7No1_Privacy-FIN_CCCA 2/12/13 5:03 PM Page 36 between our analog and digital lives blur — and with them the lines between our personal and professional personas — both employees and employers must perform a delicate balancing act in order to efficiently conduct business while protecting privacy rights. The Government of Canada, along with B.C., Alberta and Quebec, has adopted privacy legislation that requires employers to conduct a privacy im- pact assessment, establish a privacy pol- icy and appoint a privacy officer. Mary Beth Currie Employers can collect, use and disclose Partner Bennett Jones LLP personal information about an employ- Toronto ee or prospective hire only if it’s neces- sary or relevant to the employment relationship. Outside of those jurisdic- tions, employees and job candidates must rely on human rights legislation for privacy protection. But policy alone isn’t enough, says Michael Paris, an associate at Bennett PAUL EEKHOFF Jones in Toronto, “It’s about making Walking the talk on privacy Wondering how to create a privacy-compliant workplace? Consider employers should make clear that all equipment is provided for the following: business purposes and subject to review. “I go so far to recom- Have a privacy policy! It may seem like a no-brainer, but compa- mend the [employer] say, ‘If you don’t want us to review it, don’t nies need to create thoughtful policies tailored to their operational store it on our system,’” says Mary Beth Currie. realities, especially in provinces that haven’t passed legislation to Enforce the policy: Facebook and Twitter aren’t allowed? this effect. “It’s not enough to simply adopt a precedent of a pri- Everybody uses them anyway? Companies who don’t enforce their vacy policy without giving a lot of thought to its actual content,” policies will have a difficult time defending them in court. “You can says Monica Muller. And, she notes, make sure your policy actu- have the greatest social media policy in the world but if everyone ally aligns with privacy legislation: “It varies so much across is issued with their own computer with their own individual pass- Canada, so it’s not a simple question.” word and are permitted to do whatever they like, that policy isn’t Educate, educate, educate: Make sure that employees know going to amount to a hill of beans,” says Currie. about and understand exactly what is and isn’t acceptable under Monitor personal use: It might not be feasible — or even desirable your privacy policies, and why. — to enforce an outright ban on personal use. If that’s the case, Require annual certification: Michael Paris recommends that says Paris, employers need to set clear parameters about what employees sign or acknowledge the policy and attend annual kinds of personal use are permissible and make clear that status reviews to certify understanding and acceptance of the policies. updates, tweets, browser history and the like may be monitored. Assert powers of ownership and review: Employers should make Think before you Google: Before you type a job candidate’s name into it clear in offer letters, policies and manuals that the employer your search engine, weigh the risks and benefits of social media back- owns and may review all communications on the employer’s sys- ground checks and decide whether it’s truly necessary. Can you get tems, Paris says. To the extent any personal use is permitted, the same information offline? If you go ahead, proceed with caution: 36 CCCA Canadian Corporate Counsel Association SPRING 2013