Date: 20110321
File: 525-34-29
XR: 561-34-177
Citation: 2011 PSLRB 34
| Labour Relations Act
|
|
Before the Public Service
Labour Relations Board
|
Between
PROFESSIONAL INSTITUTE OF THE PUBLIC SERVICE OF CANADA
Complainant
and
Canada Revenue Agency
and
ELIZABETH BERNARD, OFFICE OF THE PRIVACY COMMISSIONER, NATIONAL RESEARCH COUNCIL OF CANADA, PARKS CANADA AGENCY, TREASURY BOARD, CANADIAN FOOD INSPECTION AGENCY, CANADIAN ASSOCIATION OF PROFESSIONAL EMPLOYEES AND PUBLIC SERVICE ALLIANCE OF CANADA
Intervenors
Indexed as
Professional Institute of the Public Service of
Before: Ian R. Mackenzie, Vice-Chairperson
For the Complainant: Sarah Godwin, Professional Institute of the Public Service of Canada
For the Respondent: Caroline Engmann, counsel
For the Intervenor Elizabeth Bernard: Herself
For the Intervenors Canadian Food Inspection Agency, National Research Council, Parks Canada Agency and Treasury Board: Caroline Engmann, counsel
For the Intervenor Canadian Association of Professional Employees: Jean Ouellette, Canadian Association of Professional Employees
For the Intervenor Office of the Privacy Commissioner: Louisa Garib, counsel
For the Intervenor Public Service Alliance of Canada: Andrew Raven, counsel
REASONS FOR DECISION
|
I.
Matter before the Board
[1] This decision is a reconsideration of a consent order issued by the Public Service Labour Relations Board (“the Board”) in Professional Institute of the Public Service of Canada v. Canada Revenue Agency, 2008 PSLRB 58. The consent order addressed the provision by the Canada Revenue Agency (CRA or “the employer”) of employees’ home contact information to the Professional Institute of the Public Service of Canada (PIPSC), the certified bargaining agent for the Audit, Financial and Scientific (AFS) Group at the CRA. This reconsideration was ordered by the Federal Court of Appeal (FCA) in Bernard v. Attorney General of
[2] Consent orders substantively similar to the one in this reconsideration were issued by the Board as follows: Professional Institute of the Public Service of Canada v. Treasury Board, 2008 PSLRB 57; Public Service Alliance of Canada v. Treasury Board, 2008 PSLRB 43; Public Service Alliance of Canada v. Canada Revenue Agency, 2008 PSLRB 44; Public Service Alliance of Canada v. Parks Canada Agency, 2008 PSLRB 45; Professional Institute of the Public Service of Canada v. National Research Council of Canada, 2009 PSLRB 13; and Canadian Association of Professional Employees v. Treasury Board, 2009 PSLRB 59. Given the similarities, the Board asked for submissions from the parties subject to the other orders. After hearing the submissions of the parties, the Board agreed to grant full intervenor status to each of the following: the National Research Council of Canada, the Parks Canada Agency, the Treasury Board (TBS), the Canadian Association of Professional Employees (CAPE) and the Public Service Alliance of Canada (PSAC).
[3] Elizabeth Bernard is an employee of the CRA and is in the AFS bargaining unit. She filed the judicial review application of the consent order between the CRA and the PIPSC. The FCA directed the Board to give Ms. Bernard notice of the reconsideration and to offer her an opportunity to participate. Ms. Bernard was granted full participation rights as an intervenor.
[4] The FCA also ordered the Board to give the Office of the Privacy Commissioner (OPC) notice of these proceedings and to draw the OPC’s attention to its right to apply for intervenor status. The OPC requested and was granted full intervenor status. The OPC did not lead any evidence at the hearing; nor did it cross-examine any of the witnesses. In its final written submissions, the OPC characterized its role as “[p]urely to clarify issues for the Board and the parties with respect to the application of the Privacy Act, and to explain [its] statutory authority” (final submissions of the OPC, November 15, 2010).
[5] The Canadian Food Inspection Agency (CFIA) and the PISPC applied to the Board for a comparable consent order. That application is being held in abeyance pending the outcome of this reconsideration. The Board granted intervenor status to the CFIA.
[6] At the request of the Board, the OPC was asked to provide a summary of its concerns before the hearing. That summary was provided on October 1, 2010. The OPC’s final submissions include its concerns, and I have summarized those submissions later in this decision.
[7] After hearing the submissions of the parties, the Board defined the issue to be decided in this reconsideration as follows:
As directed by the Federal Court of Appeal, what changes, if any, are required to the terms of the consent order in the Board’s July 18, 2008 decision (2008 PSLRB 58) to address the privacy rights of employees?
[8] Before the hearing, all parties intending to call witnesses were required to provide “will-say” statements. The witnesses that testified adopted those statements under oath, and they are part of the record. Will-say statements of those who did not testify have not been considered in this decision. Two witnesses testified on behalf of the complainant and one on behalf of the respondent, and Ms. Bernard testified on her own behalf.
[9] In her will-say statement, Ms. Bernard stated that she objected to the disclosure of her personal information on the basis of her freedom not to associate, as guaranteed by the Canadian Charter of Rights and Freedoms (“the Charter”). The PSAC raised an objection on the basis that the FCA’s order did not include a direction to assess any Charter issues. After hearing the submissions of the parties, I ruled that the Charter arguments would not be considered in this reconsideration. The FCA’s instructions are limited to assessing the privacy rights of employees.
II.
Background
[10] In Professional Institute of the Public Service of Canada v. Treasury Board and Canada Revenue Agency, 2008 PSLRB 13 (“the interim decision”), the Board addressed two complaints filed by the PIPSC against, respectively, the CRA and the TBS under paragraphs 190(1)(b) and (g) of the Public Service Labour Relations Act (“the PSLRA”). The PIPSC alleged in its complaints that the respondents to that decision had failed to bargain in good faith under section 106 and had committed an unfair labour practice within the meaning of section 185. In the interim decision, the Board found no failure to bargain in good faith, but it declared in principle that the respondents interfered with the PIPSC’s representation of employees — viewed against the obligations established by sections 183 and 184 — by failing to provide it with necessary employee contact information. The Board found that such interference constituted an unfair labour practice.
[11] In addition to declaring a violation of paragraph 186(1)(a) of the PSLRA, the Board directed the parties to attempt to reach a voluntary agreement on employee contact information, failing which the remaining issues were to be addressed at a hearing (at paragraphs 82 and 83).
[12] The Board subsequently convened a hearing to determine the remaining issues. At the hearing, the parties reached an agreement, and by letters to the Board dated July 14, 2008, requested that the terms of that agreement be incorporated into an order of the Board. The Board issued the following two orders: Professional Institute of the Public Service of Canada v. Treasury Board, 2008 PSLRB 57, and Professional Institute of the Public Service of Canada v. Canada Revenue Agency, 2008 PSLRB 58.
[13] Ms. Bernard is an employee of the CRA. She pays dues to the bargaining agent, the PIPSC, but has declined to become one of its members (she is commonly referred to as a “
[14] The FCA found in Ms. Bernard’s favour, in part, and set aside the Board’s consent order in 2008 PSLRB 58. It found as follows:
. . .
[39] Given the types of information which the union had requested, the Board had a choice as to the kind of information which it would order to be produced. It had carefully avoided confusing the issue of the obligation to disclose with the nature of the disclosure and correctly identified that the union’s request raised important privacy issues. The Board asked the parties for submissions on whether:
…there are approaches under which the employers can meet their obligation to provide information in a fashion that reasonably addresses possible concerns under the Privacy Act? …
[40] By the Board’s own admission, these were questions which required further submissions and, perhaps, further evidence. In light of all this, the Board erred in simply adopting, without analysis, the agreement between the employers and the union by which the union was to receive on a quarterly basis, out of all the information it requested, only that information which was fully protected under the Privacy Act. Even on the more deferential standard of review of reasonableness, this decision could not stand.
[41] The Board was seized of the questions which it had raised because those questions went beyond the interests of the employers and the union and engaged the interests of persons who were not before it. Those persons had statutorily protected privacy rights of which the Board was well aware. The Board had an obligation to consider those rights and to justify interfering with those rights to the extent that it did. It could not abdicate that responsibility by simply incorporating the parties’ agreement into an order.
[42] As a result, the matter must be remitted to the Board for re-determination and for a reasoned decision as to the information which the employer must provide the union in order to allow the latter to discharge its statutory obligations. . . .
. . .
III.
Summary of the evidence
[15] The PIPSC and the CRA signed a memorandum of agreement on the disclosure of employee contact information on July 11, 2008 (Exhibit R-6). Part of the agreement was that the parties would request that the Board issue a consent order incorporating its terms. The consent order of the Board is reproduced in its entirety in Annex A to this decision. I will set out in this decision those portions of the consent order that are relevant to this reconsideration.
[16] The consent order required the employer to provide the home mailing addresses and home telephone numbers of employees in the AFS bargaining unit on a quarterly basis, subject to a number of conditions.
[17] The PIPSC agreed in 2008 PSLRB 58 to the following conditions for the information that it would receive:
. . .
6. The bargaining agent will:
. . .
3. ensure that the disclosed information is used solely for the legitimate purposes of the bargaining agent in accordance with the PSLRA;
4. ensure that the disclosed information will be securely stored and protected;
5. respect the privacy rights of the employees in the bargaining unit;
6. acknowledge that the employer is bound by the Privacy Act with respect to the protection of personal information as defined in that Act. The bargaining agent shall manage the personal information disclosed under this Memorandum of Agreement in accordance with the principles of fair information practices embodied in the Privacy Act and the Privacy Regulations. Specifically, it will keep private and confidential any such personal information disclosed by the employer to the bargaining agent under this Memorandum of Agreement;
7. for the sake of clarity, the bargaining agent shall among other things:
a. not disclose the personal information to anyone other than bargaining agent officials that are responsible for fulfilling the bargaining agent’s legitimate obligations in accordance with the PSLRA;
b. not use, copy or compile the personal information for any purposes other than those for which it was provided under this agreement;
c. respect the principles of the Government Security Policy . . . for the security and disposal of this personal information; and
d. ensure that all bargaining agent officials that have access to the disclosed information comply with all the provisions of this agreement;
8. recognize the sensitivity of the information being disclosed with respect to personal security of employees, especially where inadvertent mishandling/disclosure of this information could result in serious safety concerns, and accordingly, will ensure vigilant management and monitoring controls on this information at all times in light of these potential risks to employees and their families;
9. recognize that the information provided from the employer’s database in place at the time of disclosure was provided by employees and that the employer will not be held liable should a strike vote be challenged. The bargaining agent is responsible for updating its own database.
[18] Before the information was shared with the PIPSC, the parties agreed to jointly advise employees in the bargaining unit of the impending disclosure. The message was sent by email to all employees in the bargaining unit on October 16, 2008. The Board’s consent order was attached to the message. The message stated that any questions that employees had concerning the disclosure were to be directed to the PIPSC.
[19] In a separate memorandum of agreement, the PSAC and the PIPSC agreed to share the costs on a pro rata basis for the software system developed by the PSAC to receive the data from the TBS.
A.
For the complainant
[20] As Chief Negotiations Officer for the PIPSC, Walter Belyea is responsible for delivering national collective bargaining and representational services, providing policy advice and direction as it pertains to these responsibilities, performing research and analyzing that research, handling classification processes for member jobs, and retaining and recruiting members.
[21] Mr. Belyea testified that the PIPSC requires employee contact information for the following reasons: to gather employee input; to verify information provided by the employer; to give notice of a final-offer vote or strike vote (sections 183 and 184 of the PSLRA); and to develop essential service agreements as well as for representation purposes.
[22] Mr. Belyea testified that employee input was required to prepare bargaining positions. This requirement to consult employees can also arise on short notice; for example, when the employer wants to enter into an expedited bargaining process.
[23] Mr. Belyea testified that, when conducting votes (strike or final-offer votes), the PIPSC prepares a complete information package for all employees. This package contains information that the PIPSC expects will not be shared with the employer.
[24] When negotiating essential service agreements, the PIPSC may need to contact individual employees to understand the duties and working situations of the positions affected by the employer’s proposed essential service.
[25] Mr. Belyea testified that the PIPSC might need to contact individual employees (other than grievors) to explore the implications of pursuing a particular grievance.
[26] Mr. Belyea also testified that the PIPSC needs to contact employees directly outside of collective bargaining periods and gave examples. The PIPSC would contact employees if downsizing were planned, to ascertain whether some employees were willing to take early retirement to allow other employees to retain their positions. The PIPSC may need to contact employees when new legislation is promulgated or when pension, benefit, or employment equity issues or complaints arise.
[27] Mr. Belyea testified that only receiving employees’ work contact information was insufficient for the PIPSC to fulfill its statutory obligations. The employer has retained the right to review all electronic correspondence, and there is no expectation of privacy in communications received at the workplace. In addition, part-time employees and employees on leaves of absence or secondments do not necessarily receive mail sent to work addresses. Communications related to mandatory votes must be effected quickly, which can occur only when the PIPSC has home contact information.
[28] Mr. Belyea also testified that work contact information is not reliable, given the frequency of employee relocations.
[29] Mr. Belyea testified that the PIPSC cannot meet its duty to represent employees solely through its stewards’ network. He described the steward’s network as “sketchy.” Not all work sites have stewards. They do not report directly to negotiators and may not be able to provide necessary information to employees. Stewards have also received varying levels of training. In cross-examination, he testified that privacy issues are part of the second stage of stewards’ training. Mr. Belyea testified that either a staff member or a steward of the PIPSC might call an employee at home.
[30] Mr. Belyea testified that the PIPSC website is not an appropriate vehicle for providing information to employees. The website is public and does not permit the posting of information that the PIPSC does not want to share with the employer or the public. The website is not always updated. In cross-examination, Mr. Belyea testified that some delays occur in updating because of the time it takes for translation. Some employees have less access to the Internet based on their job duties (e.g., isolated posts or working off-site).
[31] Mr. Belyea testified that it was not appropriate to rely on the employer to inform employees of collective bargaining issues. He stated that the employer would colour its message to employees to reflect its interests. He also stated that the employer was limited in what it could convey to employees because of its obligation not to interfere in bargaining unit matters.
[32] Eric Ritchie is the section head of informatics at the PIPSC and is responsible for overseeing the activities of the informatics section, including planning for the effective use of technology, overseeing and administering the technology structure, and recommending policies for the use of information technology. In his position, he works closely with the PIPSC membership services.
[33] Mr. Ritchie testified that there is a password-protected area of the website for membership benefits, such as insurance, but that it is not secure. He agreed in cross-examination that it was possible to make that part of the website more secure but that it would be “very expensive.”
[34] He testified that the PIPSC received employee contact information in accordance with the consent order in August and again in November 2009. The CRA provided the contact information to Mr. Ritchie on a compact disc. It was couriered directly to Mr. Ritchie and was not encrypted. It is kept in a locked drawer in his office. The office is also locked when he is not at work. Mr. Ritchie testified that the information has been and will continue to be treated in accordance with the provisions of the consent order.
[35] Mr. Ritchie testified that the contact information from the TBS is obtained through a secure file transfer protocol that requires a confidential user name and password.
[36] The PIPSC has not yet used the data provided by either the CRA or the TBS, pending the outcome of this reconsideration. Mr. Ritchie testified that it was the PIPSC’s intention to review the information to see if it matched the information it currently has on its members. If the employer’s information has addresses different from those on file, the PIPSC will contact the employees to confirm the changes.
[37] Mr. Ritchie testified that the PIPSC sends a membership application form to all new members. When an employee’s name first appears on the list of employees provided by the employer, he or she is deemed by the PIPSC a
[38] Mr. Ritchie testified that employee contact information would be placed in the Professional Institute Membership System (PIMS). The PIMS is accessible only at the PIPSC’s offices and cannot be accessed remotely. It can be accessed only by the PIPSC staff with assigned usernames, passwords and security roles in the database. Mr. Ritchie testified that a threat assessment of the PIPSC computer network had been conducted and that the PIPSC had followed all the recommendations of the assessment.
[39] Mr. Ritchie testified that membership lists can be generated only by the head of the membership services section and in accordance with a membership list policy (Exhibit A-1, tab 12). The lists are generated rarely and do not contain home contact information (only work contact information).
[40] The OPC and the PIPSC agreed that the Privacy Act, R.S.C. 1985, c. P-21, and the Personal Information and Protection of Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA), do not apply to the PIPSC. The PIPSC has a privacy policy for the personal information of its members (Exhibit A-1, tab 11) and will extend that protection to all employee information in its possession (Exhibit A-1, tab 13). The PIPSC follows the following privacy principles (contained in Exhibit A-1, tab 13):
. . .
1. Accountability
The Institute retains responsibility for all bargaining unit employee contact information in its possession.
2. Identifying Purposes and Limited Collection
Personal information received from the employer about bargaining unit employees who are not members will be used only for PIPSC purposes in accordance with governing labour legislation, unless an affected employee provides for broader use.
3. Limiting Use, Disclosure and Retention
Employee information shall be retained as long as the individual remains an employee in a bargaining unit represented by the Institute, as long as it is required to fulfil [sic] the purposes for which it was collected, and as long as may be required by law. Once the information is no longer required, the information shall be destroyed in a safe and secure manner.
4. Accuracy
Employee information is kept as accurate, complete and up-to-date as possible based on the information received from the Employer. Employees may also ensure their personal information is kept up to date by contacting the Institute's Membership Section.
5. Safeguarding Member Information
Employee information will be protected in a manner appropriate to the sensitivity of the information and as required under order of the Public Service Labour Relations Board, memoranda of agreement or otherwise as directed by law.
6. Openness
The Institute will make available information regarding practices with respect to employee personal information.
7. Employee Access
Upon written request, employees may be informed of the existence, use and disclosure of their personal information and shall be provided access to it. Employees are not entitled access to information about a third party, information which may harm another party, certain confidential information in respect of a formal dispute resolution process, or information subject to solicitor/client privilege.
8. Challenging Compliance
The Institute is not subject to the Personal Information and Protection of Electronic Documents Act. The Institute does, however, remain available to discuss any issues or respond to any questions which may arise in respect of the foregoing privacy principles or with the treatment of personal information in general. Enquiries should be addressed, in writing, to the Institute's Executive Secretary and Chief Operating Officer. . . .
. . .
B.
For the respondent
[41] The CRA has approximately 43 000 employees across the country. That number increases during peak periods and can reach 50 000. There are two bargaining units at the CRA. One is represented by the complainant, and the other is represented by the PSAC. Approximately 30 to 35 percent of employees are represented by the PIPSC. The employer does not collect information about membership in the PIPSC. A number of employees work mostly outside the workplace, at taxpayers’ sites.
[42] Helen Lücker is a functional analyst for the CRA’s Corporate Administrative System (CAS). The CAS is the CRA’s human resources information system. The system is used for the following processes: classification, staffing, compensation, time and activity recording, leave management, staff relations, training and learning, and human resources planning.
[43] The CRA collects personal information from its employees when they are initially hired via a Personal Identification Template (Exhibit R-5). This form is used to collect a range of information about an employee. For the purposes of this reconsideration hearing, the relevant information collected is the following: the employee’s permanent address, mailing address (if different from the permanent address) and home telephone number. The employee is required to provide his or her permanent and mailing addresses. Providing a home telephone number is optional. Ms. Lücker testified that the address information is collected for compensation purposes. She testified that a telephone number is collected for business continuity purposes — in other words, in case a manager needs to reach an employee.
[44] Ms. Lücker testified that employees can change their personal information either online or by asking their human resources advisor to make changes for them. Employees cannot change their addresses online if it involves changing the province, because the province of residence impacts income tax deductions. Only a human resources advisor can change the province of residence information.
[45] The online employee profile (Exhibit R-3) contains a data field for “home address.” The CRA does not use that field. In cross-examination, Ms. Lücker was asked if that field could be used to allow employees to consent to the disclosure of home contact information. Ms. Lücker testified that there would be a significant cost to the CRA to change the CAS.
[46] The CRA does not collect employees’ home email addresses.
[47] The CRA provides a monthly report of transactions to the PIPSC (Exhibit R-4). Transactions include terminations, appointments and acting assignments, among others. The reports include the following information about employees in the bargaining unit: name, occupational group and level, transaction, reason for transaction, and effective date. Other information available to the PIPSC (although no longer provided, at its request) includes name, position number and work section. The office information contained in this report is misleading, Ms. Lücker testified, because it is derived from the “responsibility centre,” which can be different from the work location.
[48] The CRA intranet has a section called “Infozone” that the employer uses as a primary mechanism for communications to employees. The CRA has used the Infozone to advise its employees of the progress of collective bargaining.
[49] The CRA’s Monitoring of the Electronic Networks’ Usage Policy (Exhibit R-2) states that all information stored or disseminated using the CRA’s electronic networks is subject to monitoring by the CRA. The policy provides a list of unacceptable uses of its electronic networks and includes “. . .obtaining, storing, sending or participating in . . . union notices or other union material without prior approval of the employer.”
[50] Under collective agreements with the PIPSC and the PSAC (Exhibit A-4), the CRA is required to provide bulletin boards in the workplace for bargaining agent notices and information. All bargaining agent postings require the advance approval of management. Ms. Lücker testified that approval must be obtained at the CRA’s national level. Ms. Lücker provided a copy of the approval of and the notice for ratification votes of the collective agreement between the CRA and the PSAC (Exhibit R-8).
C.
For the intervenor Ms. Bernard
[51] Ms. Bernard commenced employment with the CRA (then known as Revenue
[52] In January 1992, Ms. Bernard received a letter from the PSAC at her home. When she asked her employer how the PSAC had obtained her home address she was advised that the employer provided the home address information of all employees in the bargaining unit to the PSAC. She filed a complaint with the OPC in February 1992.
[53] In May 1993, the OPC completed its investigation and found that the employer had violated the Privacy Act by providing Ms. Bernard’s personal information to a third party. It advised her that the employer would no longer provide that information to the PSAC.
[54] In 1995, Ms. Bernard was appointed to a position as an auditor, which was later reclassified AFS. The AFS bargaining unit is represented by the PIPSC. Ms. Bernard testified that she had been approached a few times by representatives of the PIPSC to become a member. She declined.
[55] On October 20, 2008, Ms. Bernard returned to work from leave and read the email about the consent order. She then proceeded to challenge the consent order at the FCA.
[56] Ms. Bernard testified that she has received updates on the status of contract negotiations from her employer through her work email address or Infozone. She also testified that she has received correspondence from the PIPSC at work through her work email address. She gave as an example an email from the President of the AFS subgroup of the PIPSC, advising employees in the bargaining unit of upcoming contract ratification information sessions.
[57] Ms. Bernard also testified that her employer authorized the use of her work email to send messages not related to her work duties, including
[58] Ms. Bernard testified that she consulted the PIPSC website for information about contract negotiations. She testified that the names, office locations and telephone numbers of stewards are posted on the PIPSC website and on the bulletin board at her workplace.
[59] Ms. Bernard testified that she provided the employer with her home address for the sole purpose of receiving correspondence from her employer about her compensation and pension entitlements. She provided her employer with her home telephone number so that it can contact her in emergencies or for urgent work-related matters.
[60] Ms. Bernard tendered as exhibits two letters that she received through an access to information request, a letter sent by Drew Heavens, Director, Employer Representation and Discipline, TBS, to the OPC on September 21, 2007 (Exhibit I-2), and the OPC’s reply, dated October 25, 2007 (Exhibit I-3). Mr. Heavens had requested the OPC’s opinion in preparation for discussions with the PSAC on sharing home contact information with it. The other parties objected to the introduction of the two letters as exhibits on the basis that Ms. Bernard was not the recipient, that there was no opportunity to cross-examine the authors and of relevance. Ms. Bernard stated that the letter from Mr. Heavens showed that concerns about privacy had been expressed by other employees. She also submitted that the OPC letter raised a number of questions that needed to be addressed. I reserved on this objection. I have concluded that the letters are not necessary for any determination. The questions raised in the letters can be addressed by Ms. Bernard and the OPC in final submissions.
[61] The fact that other employees may have raised concerns about privacy is not relevant to this reconsideration. The FCA ordered the Board to examine the issue of the privacy of employee information. The number of employees who may have complained is simply not relevant. The OPC is an intervenor in this proceeding and has a full opportunity to present its submissions. Therefore, the OPC’s letter is not relevant. Accordingly, I have not considered either letter.
[62] In cross-examination, Ms. Bernard testified that it was her view that strikes bring out the worst in people and that she was concerned about individuals having her home contact information. She also testified that she has an interest in knowing about her terms and conditions of employment but that, if she wanted that information, she could consult the PIPSC website or speak to a steward.
IV.
Summary of the arguments
A.
For the OPC
[63] The OPC stated that it was offering its analysis of the legal and policy issues that arise under the Privacy Act. It stated that it was seeking to assist the Board in coming to its decision and that it was offering guidance to the parties.
[64] In
[65] Ms. Bernard’s status as a
[66] The OPC’s general position is that, if an employer discloses home contact information of employees in a bargaining unit to the bargaining agent without their consent, it contravenes the Privacy Act. Home or mailing addresses and home telephone numbers are personal information under that Act. Under section 3 of that Act, no minimum threshold of personal information is required to trigger its application. However, the OPC recognizes that, under the PSLRA (subsection 184(1) and paragraph 194(1)(q)), a bargaining agent must give all employees in the bargaining unit a reasonable opportunity to participate in a strike vote and to be informed of the results. The OPC also recognizes that a bargaining agent represents all employees in the bargaining unit, regardless of whether they are members. The OPC also recognizes that the Board, acting under its statutory authority, may order the disclosure of personal information pursuant to the PSLRA.
[67] However, in the absence of an order, and when read with an employer’s concurrent obligations under the Privacy Act and with the personal information handling practices set out by the TBS in its directive on privacy practices, the OPC views a bargaining agent’s obligations under the PSLRA as general and broad. It is left to the Board to determine, precisely, the extent of a bargaining agent’s responsibility under subsection 184(1) and paragraph 194(1)(q) of the PSLRA, particularly with respect to
[68] Employers are required to maintain accurate records under subsection 6(2) of the Privacy Act. The OPC is concerned that an order of disclosure, in conjunction with that provision, could potentially require an employer to collect more personal information than needed to manage the employment relationship and to continually update that personal information to regularly provide accurate data to the bargaining agent. Given the CRA’s evidence about the cyclical and fluctuating nature of employment with it, it may be challenging to maintain the accuracy of home contact information, especially if the employer relies on self-reporting. While labour jurisprudence supports disclosing information to bargaining agents, it is not established under the Privacy Act that an employer can regularly collect and disclose personal information that it might otherwise not need, to serve the needs of the bargaining agent.
[69] The employer has not yet fully articulated how collecting and disclosing employee home contact information to the PIPSC is a consistent use of that information under paragraph 8(2)(a) of the Privacy Act, particularly in cases in which an employee has not provided consent for the disclosure.
[70] The parties have not demonstrated that they have fully turned their minds to alternative and less privacy-intrusive means to meet their statutory obligations under the PSLRA. Internet and database technologies currently used by the employer may offer the ability to facilitate appropriate information sharing between the parties while protecting the privacy of employees. Based on the evidence presented at the hearing by the parties, the OPC is also of the view that there may be alternative ways for the PIPSC to meet its obligations under the PSLRA. It remains unclear whether the parties have yet fully turned their minds to alternatives. Traditionally, employers and bargaining agents have communicated with employees via mail to a home or other mailing address. Internet and networking technologies now offer new methods of communication, via internal and external websites, email, texting, and social media. In some cases, these channels of communication are near instant. They are increasingly the primary means of communication for individuals, particularly for the new generation of workers. Based on the testimony of Ms. Lücker, it is possible that existing data fields in the employer's corporate database system could be reconfigured to produce reports that exclude the home contact information of bargaining unit employees, such as Ms. Bernard, who have not given consent to provide that personal information to the PIPSC. Both witnesses for the PIPSC also indicated that it can identify employees who are not, in their view, eligible for recruitment. According to those witnesses, the identified employees would not be contacted to become members. Using home contact information to recruit members would constitute a purpose for the collection and use of personal information distinct from that of satisfying requirements under the PSLRA.
[71] Employees who have chosen to become bargaining agent members have provided implied consent for the disclosure of a range of personal information by the employer for the purposes of collective bargaining and the administration of collective agreements. Bargaining agent members may also choose to consent to the disclosure of their personal information for the purposes of other bargaining agent activities. The same cannot be said for employees such as Ms. Bernard. She has declined to become a bargaining agent member since 1991 and has expressly and consistently stated that she does not consent to her employer disclosing her home contact information. The number of
[72] The parties, including Ms. Bernard, have acknowledged during the proceedings that the PIPSC requires some information about her to carry out its duties as the bargaining agent in her workplace. The Privacy Act does not stand in the way.
[73] It was Parliament's intention that the Privacy Act protect against the unauthorized disclosure of personal information held by the departments and agencies of the federal government. From the OPC's perspective, this statutory objective requires the parties to fully turn their minds, and in certain cases commit time and resources, to finding reasonable and practical ways to meet shared labour relations obligations in a manner that minimally intrudes on employee privacy. A more nuanced approach informed by Privacy Act obligations may entail altering some long-standing perceptions about information sharing practices that have been unchallenged in labour law, until now.
[74] The OPC made the following recommendations in its written submissions:
. . .
a. The OPC recommends using less privacy-intrusive means to notify employees about strike votes;
b. The OPC Recommends using existing database technology to prevent disclosure of employee home contact information without consent; and
c. The OPC recommends that the Board ensure adequate safeguards for all employee personal information, and the implementation of privacy best practices.
[75] The internal privacy practices of bargaining agents as organizations that collect, use and disclose personal information are a relatively new consideration. Perhaps because neither the Privacy Act nor the PIPEDA currently apply to a bargaining agent’s day-to-day activities, they may not have had the same impetus as employers and other organizations to turn their minds to the protection of the personal information that they hold. Unions are not accountable to an independent oversight body under the Privacy Act, the PIPEDA or even the PSLRA for their personal‑information handling practices.
[76] The PIPSC’s practice of collecting home contact information to contact employees for different purposes has been described, at least in part, as required from an abundance of caution. While this is understandable from a labour relations view, such a broad approach to the collection and use of personal information does not fit with established privacy best practices, which recommend that organizations limit the collection of personal information to only what is required to fulfill a given purpose.
[77] In terms of privacy training, the training in standards and practices of information handling that the PIPSC’s staff have received is unclear. It is also unclear how those standards and practices compare to those that the employer is required to meet, by law, under the Privacy Act and the TBS Guidelines.
[78] In addition, Mr. Ritchie testified that the CRA sent home-contact information to the PIPSC on an unencrypted compact disc via courier, which required a signature upon delivery. The OPC is concerned that weak encryption or a lack of encryption, particularly when combined with the over-collection of personal information, leaves organizations vulnerable to data breaches. While Mr. Ritchie stated that the information is kept locked and separate from membership data, it is not clear how long that personal data needs to be retained to fulfill its purpose for collection, particularly since its accuracy has become uncertain. At this stage of the proceedings, it was not clear how and when such personal information would be destroyed according to a destruction schedule.
[79] The Board should take into consideration the current gap in privacy protection under federal legislation for employees whose personal information is held by bargaining agents. The OPC also referred the Board and the parties to the PIPEDA’s “10 Fair Information Principles,” the OPC’s A Guide for Businesses and Organizations: “Your Privacy Responsibilities,” and the TBS documents as guidance to build a privacy best-practices model for labour organizations.
[80] In the OPC’s view, Ms. Bernard has voiced genuine concerns over the PIPSC’s potential misuse of her personal information, particularly in a strike-vote situation. She is concerned about the potential for harassment by individuals who might take issue with her status as a
[81] The Board should consider the gap in privacy protection and lack of recourse for individuals such as Ms. Bernard, whose personal information is held by a bargaining agent not subject to privacy legislation. All workers are entitled to have their privacy protected by their employers and respected by bargaining agents. This case has shown that employees, such as Ms. Bernard, expect and rely on regulatory bodies such as the Board to uphold their privacy rights when resolving workplace disputes. Effective privacy protection for employees in
B.
For the PIPSC
[82] The PIPSC must be able to contact all employees in its bargaining unit quickly, easily and privately to meet its obligations to the employees that it represents.
This information (home addresses and telephone numbers) is required regularly. The CRA collects this information from all employees, and it ensures that it is accurate. The PIPSC will use this information in keeping with the employment purposes for which it was collected, its statutory obligations to represent its members and the public interest. The PIPSC will continue to ensure that the information it receives is kept secure and confidential and that it is used for the stated limited purposes. The PIPSC’s position is that no changes are required to the terms of the consent order.
[83] The 2008 PSLRB 58 decision held that, at a minimum, contact information was required for the PIPSC to meet its obligations under sections 183 and 184 of the PSLRA. These statutory obligations did not exist before the Public Service Modernization Act, S.C. 2003, c. 22, came into force in 2005.
[84] In the interim decision, the Board encouraged the parties to reach a negotiated resolution. The Board also suggested that the parties consider the following (at paragraph 77):
77 . . . In practical terms, exactly what employee contact information do the employers possess or could they possess among the types of information sought by the complainant? How is that information maintained to ensure its accuracy and timeliness? What precise types of information are necessary with respect to the complainant’s representational obligations, and which among those types of information should be provided by the respondents? When should the respondents supply information to the complainant? What are the recurring requirements, if any, to update that information? Are there approaches under which the employers can meet their obligation to provide information in a fashion that reasonably addresses possible concerns arising under the Privacy Act? What, more specifically, are those concerns? Should any conditions be placed on the complainant’s use of the information by the complainant once the employers have provided it?
[85] As evident from the agreement contained in the consent order and the evidence at this hearing, the parties addressed all the issues raised by the Board. In particular, the consent order addressed the following concerns: a) accuracy: by inviting employees to verify their contact information with the PIPSC; b) consistent use: by ensuring that the disclosed information is used solely for legitimate purposes under the PSLRA; and c) limiting use and respecting privacy: by ensuring the secure storage and protection of the data and by disclosing the information only to those PIPSC officials responsible for fulfilling its obligations.
[86] The evidence was clear that a reconfiguration of the employer’s CAS either to allow an employee to use a different address or to provide consent to disclosure to the PIPSC would be expensive and time consuming. In addition, the employer has no stated employment reason for obtaining that information.
[87] As outlined in Mr. Belyea’s testimony, the PIPSC requires home contact information for a number of reasons, both within and outside the collective bargaining context. It is difficult to predict when the information will be required. It could be needed on very short notice. Without this contact information, the PIPSC has no reliable means of contacting
[88] Work contact information is not reliable. It would also not allow the PIPSC to contact employees quickly in the event of a mandatory ratification or strike votes. Employees on leaves of absence or secondments would not necessarily receive correspondence sent to their work sites. In any event, the employer cannot often provide current work location information for employees because of the nature of the work at the CRA.
[89] Using stewards to fulfill the PIPSC’s obligations is not reliable, as testified by Mr. Belyea and he and Mr. Ritchie confirmed that using the PIPSC website is also not reliable. Making changes to the PIPSC website to allow for secure access would be expensive.
[90] It is unacceptable for the employer to have to convey important information on the PIPSC’s behalf. It is important for the PIPSC to convey its own position to bargaining unit employees to counter any information tainted by the employer or the media.
[91] The PIPSC keeps the home contact information secure, as testified by Mr. Ritchie. The information that the PIPSC sends to employees would not result in the inadvertent disclosure of personal information were it sent to an outdated address, as the information is not personal.
[92] The PIPSC has carefully structured its request so that it is for the minimal contact information required to meet its obligations under the PSLRA.
[93] Personal information can be disclosed without the explicit consent of an individual, in accordance with subsection 8(2) of the Privacy Act; see Privacy Act, [2000] 3 F.C. 82 (C.A.), at para 14-19 and upheld in 2001 SCC 89. Disclosure without consent is permitted if the information is to be used for a purpose consistent with that for which it was obtained, if the disclosure is in accordance with any statute or regulation, to comply with an order of a relevant adjudicative body, and if the public interest in disclosure clearly outweighs any invasion of privacy.
[94] The information that the PIPSC is seeking is for a use consistent with the purpose for which the information was collected; see paragraph 8(2)(a) of the Privacy Act. The home contact information of employees is collected for employment-related purposes, and the PIPSC’s use of that information is also employment-related. In Public Service Alliance of Canada v. Treasury Board, PSSRB File Nos. 161-02-791 and 169-02-584 (19960426), the Public Service Staff Relations Board (PSSRB) determined that the provision of home contact information to a bargaining agent was a consistent use of that information. Consistent use was also found in the context of collective bargaining in United Food and Commercial Workers, Local 401 et al. v. Economic Development Edmonton, [2002] Alta. L.R.B.R. 161. The Canada Industrial Relations Board (CIRB) has held that personal information relating to salary can be disclosed to a bargaining agent as a consistent use under paragraph 8(2)(a) of the Privacy Act (Society of Professional Engineers and Associates v. Atomic Energy of Canada Ltd., 2001 CIRB no. 110). A similar finding has been made in British Columbia in B.C. Rapid Transit Co. v. Canadian Union of Public Employees, Local 7000 (2008), 180 L.A.C. (4th) 204.
[95] The disclosure of home contact information is required to comply with the PSLRA. This is an exception for the requirement of consent under the Privacy Act, as the PSSRB found in Public Service Alliance of Canada v. Treasury Board. A number of other labour boards have found that disclosure of home contact information is required because of statutory obligations under the relevant labour relations legislation, as shown in the following jurisprudence: Economic Development Edmonton; Hotel & Restaurant Employee CAW Local 448 National Automobile, Aerospace, Transportation and General Workers’ Union of
[96] In Millcroft Inn, the Ontario Labour Relations Board (OLRB) recognized that employees in a unionized setting may no longer speak directly to their employer about the terms and conditions of their employment. All communications about the terms and conditions of employment must be conducted through the bargaining agent. As such, individual privacy rights have been partially superseded by the bargaining agent’s right as their representative (at paragraph 37). In
. . .
. . . The union must be placed in a position where it can effectively represent all of the employees in the bargaining unit. To the extent that some individual privacy rights must yield to that interest, this is a necessary consequence of the union’s exclusive bargaining rights and the obligations it undertakes on behalf of the employees. . . .
. . .
[97] The Alberta Privacy Commissioner has stated that provincial privacy legislation was not intended to impede the legitimate flow of information from employer to bargaining agent (“The New Privacy Laws – Workplace Issues,” 20th Annual University of Calgary Labour Arbitration and Policy Conference, 2002, cited in University of Alberta v. Non-Academic Staff Association (2006), 151 L.A.C. (4th) 365, at para 61). He further stated that an adequate information flow, including personal and health information, was critical to the proper functioning of a unionized workplace. Similar findings have been made in British Columbia (Governor and Company of Adventurers of England Trading into Hudson’s Bay (2004), 108 C.L.R.B.D. (2n) 259, at para 27 and 33) and in the federal jurisdiction (General Teamsters, Local Union No. 362 v. Monarch Transport Inc. and Dempsey Freight Systems Ltd., [2003] CIRB. no. 249, at para 22 to 25).
[98] In 2008 PSLRB 58, the Board determined that the PIPSC is statutorily required to have employee contact information for strike votes and Minister-ordered votes and likely for other reasons as well. Mr. Belyea testified about the PIPSC’s requirements that justify it receiving employee home contact information.
[99] Disclosing this information is also in the public interest, pursuant to paragraph 8(2)(m) of the Privacy Act, which allows for disclosure if the public interest “. . .clearly outweighs any invasion of privacy. . .” or if disclosure would “. . .clearly benefit the individual to whom the information relates.” The public interest in disclosure must be seriously considered when balancing the right to privacy along with whether any real harm would arise as a result of the disclosure; see Bland v. Canada (National Capital Commission), [1991] 3 F.C. 325 (T.D.), at para 23, overturned in [1993] 1 F.C. 541, and see Canada (Information Commissioner) v. Canada (Minister of Public Works and Government Services), [1997] 1 F.C. 164 (T.D.).
[100] In Public Service Alliance of Canada v. Treasury Board, the PSSRB concluded that the disclosure of names and addresses of employees who might be subject to lay off would benefit the individuals to whom the information related.
[101] In this redetermination hearing, the Board must balance the public interest in maintaining the viability of the PSLRA structure against the individual privacy rights set out by Ms. Bernard. The ability of the PIPSC to meet its statutory obligations, particularly in light of the privacy protections in place in the consent order, must outweigh any inconvenience to employees of being contacted at home. Consequently, home contact information ought to be disclosed, in keeping with paragraph 8(2)(m) of the Privacy Act.
[102] There is no satisfactory alternative to the provision of home contact information, for the reasons already stated. In
[103] The evidence has shown that allowing employees to opt out of disclosing their home contact information would be inappropriate. It is not possible to opt out of statutory obligations. In addition, allowing opting out would require some kind of informed waiver by employees of any future duty of fair representation complaints against the PIPSC arising from the opting out.
[104] The home contact information obtained by the PIPSC will be maintained in accordance with privacy principles. This has been explicitly recognized in the agreement of the parties that was contained in the Board’s consent order.
[105] Individuals who believe that the PIPSC has breached their privacy rights have the following remedies: directing enquiries to the PIPSC executive secretary and chief executive officer, filing a duty of fair representation complaint against the PIPSC, or filing an unfair labour practice complaint against the PIPSC.
C.
For the PSAC
[106] The PSAC agreed with the PIPSC’s submissions.
[107] The Supreme Court of Canada’s decision in Weber v. Ontario Hydro, [1995] 2 S.C.R. 929, significantly expanded the representational responsibilities of unions. To adequately meet them, bargaining agents must be able to communicate with all employees in the bargaining unit. Indeed, the OLRB has noted in the context of those broad and expanding responsibilities that the only meaningful way for bargaining agents to fulfill those obligations is to communicate directly with employees; see Millcroft Inn, at paragraphs 22 and 29. In doing so, the OLRB identified names, addresses and telephone numbers as significantly valuable. See also Economic Development Edmonton, B.C. Rapid Transit Co. and P. Sun’s Enterprises (
[108] The extensive representational responsibilities placed on bargaining agents clearly demonstrate Parliament’s confidence in their role in the employment relationship and indicate public interest sufficient to outweigh any privacy concerns that may arise from disclosing employee contact information to labour relations representatives, as contemplated by paragraph 8(2)(m) of the Privacy Act.
[109] In Bernard, the FCA acknowledged that the employer must provide some employee contact information but held that further consideration of the nature of the personal information to be provided and the circumstances under which it must be provided was warranted. Both the jurisprudence and the evidence in this hearing confirm the clear need for bargaining agents to communicate directly with employees in a timely and confidential manner outside the workplace. Accordingly, the names, addresses and home telephone numbers of all employees constitutes the bare minimum of personal information required to meet a bargaining agent’s statutory obligations.
[110] The employer prohibits the conduct of union business in the workplace and the use of work email or internet resources for union purposes. The Monitoring of Electronic Networks’ Usage Policy is clear that all information obtained, stored or disseminated using the CRA’s electronic networks is subject to monitoring. Posting union notices or information without the prior approval of the employer is cited in that policy as an example of misuse.
[111] In any event, the statutory obligations imposed on bargaining agents require more than simply posting something on a union bulletin board. For such important labour relations purposes, bargaining agents must be provided sufficient personal contact information to ensure that all employees are adequately notified and afforded a meaningful opportunity to participate in important issues that concern the terms and conditions of their employment. The OLRB recognized the limitations of bulletin boards and of relying on stewards in Millcroft Inn and stated as follows that there was no justification to force unions to rely on those mechanisms: “The employer has the information, the union needs it, the union is entitled to it and it should have it. The employer is best placed to provide it, and it should do so” (at paragraph 32).
[112] The need for home contact information is made even greater by the unique work environment of the CRA, in which some auditors do not have regular access to the office. The OLRB considered communication difficulties caused by a dispersed membership in Ontario Public Service Employee, at paragraph 9.
[113] The bargaining agents’ right to home contact information does not exist solely because of the changes to the statutory obligations introduced by the PSMA. This right has always existed. It is found in paragraph 8(2)(m) of the Privacy Act because it is information that “clearly benefits” the employee. In addition, the use of the personal information is a consistent use within the meaning of paragraph 8(2)(a) of the Privacy Act.
[114] The concern about the disclosure of personal information cannot be whether the home contact information will be used for legitimate purposes. Rather, Ms. Bernard’s privacy concerns clearly relate to the PIPSC’s potential abuse of her personal information. In the consent order, the PIPSC has undertaken to respect the privacy rights of employees and to take all reasonable steps to ensure that personal information is safeguarded and that it is not disclosed or used for any purpose other than the PIPSC’s legitimate obligations under the PSLRA. Should any abuses occur, individual employees retain their right to seek redress either by a complaint under the Privacy Act or by seeking a remedy from the Board for a breach of the terms of its consent order. No evidence of any abuse was tendered at this hearing. The only evidence of any concern about privacy is Ms. Bernard’s complaint.
[115] Any suggestion that individual consent to disclosure is required is inconsistent with the bargaining agent’s status as the exclusive bargaining agent for all employees (Public Service Alliance of Canada v. Forintek Canada Corp. and Jacques Carette, [1986] OLRB Rep. April 453). An employee cannot opt out of a bargaining agent’s right to receive his or her home contact information.
[116] It is clear that the employer cannot be asked to collect personal information that it does not normally collect or require (see Telus Advanced Communications, 2008 CIRB 415, at para 20). The employer does not collect home email addresses and has no need to.
[117] The issue of the accuracy of contact information, raised by the OPC, is not before this Board. In any event, the records are accurate and are the best contact information available.
[118] The OPC has referred to the fact that the parties did not turn their minds to alternative means of contacting employees. The OPC and Ms. Bernard did not tender any evidence of alternative means.
D.
For the CAPE
[119] The
[120] Employees cannot opt out of an obligation that rests with bargaining agents. The disclosure of home contact information as set out in the consent order is reliable and efficient and has appropriate privacy safeguards.
E.
For the CRA and the employer intervenors
[121] The employer and the intervenors who are also employers adopted the submissions of the PIPSC. I have not repeated those submissions in this summary.
[122] The preamble to the PSLRA is important in interpreting the statutory provisions at issue. It reads in part as follows:
. . .
. . . effective labour-management relations represent a cornerstone of good human resource management and that collaborative efforts between the parties, through communication and sustained dialogue, improve the ability of the public service to serve and protect the public interest;
. . . collective bargaining ensures the expression of diverse views for the purpose of establishing terms and conditions of employment;
. . .
. . . the Government of Canada recognizes that public service bargaining agents represent the interests of employees in collective bargaining and participate in the resolution of workplace issues and rights disputes;
. . . commitment from the employer and bargaining agents to mutual respect and harmonious labour-management relations is essential to a productive and effective public service;
. . .
[123] The statutory authority for the employer to collect personal information is found in sections 30 and 31 of the Canada Revenue Agency Act, S.C. 1999, c.17. Personal information collected by the employer falls within the provisions of the Privacy Act. Its disclosure to a bargaining agent for the purposes of complying with its obligations under sections 183 and 184 of the PSLRA falls within the “consistent use” provision of the Privacy Act (at paragraph 8(2)(a)). For a use to be consistent, it must have a reasonable and direct connection to the original purpose for collection. A test of whether a proposed use or disclosure is consistent with the original purpose is whether it would be reasonable for the individual to whom the information relates to expect that it would be used in the proposed manner. In the present context, the employment-related purposes for which the information was collected is a use consistent with the secondary purpose of a bargaining agent communicating with its members for legitimate employment-related matters.
[124] The jurisprudence is now settled that employers cannot resist a union’s request for employee contact information on the grounds that such a disclosure is an invasion of privacy. The bargaining agent is an agent for all employees and is entitled to receive the same contact information as the employer.
[125] The requirement in subsection 6(2) of the Privacy Act about the accuracy of the information collected is not applicable because the disclosure does not constitute using the information for an administrative purpose within the meaning of the Privacy Act (see Zarzour v. Canada (Attorney General), [2000] F.C.J. No. 2070). The requirement in the Privacy Act is in place to ensure that a decision affecting an individual is based on current and accurate information. In the alternative, the evidence demonstrates that the employer has measures in place to ensure accuracy.
[126] The purpose for which the information is provided to a bargaining agent is so that it can communicate with employees to meet its obligations under sections 183 and 184 of the PSLRA. In their submissions, the bargaining agents have suggested an expanded use of the information. In this redetermination, the Board does not need to revisit its original order and decide the other purposes for which bargaining agents can use the home contact information.
[127] Ms. Bernard suggested that employees could opt out of having their home contact information sent to a bargaining agent. The employer has no business reason for collecting information about employee preferences and should not be required to collect that information. In addition, obtaining that kind of information is intrusive and could lead to allegations of interference with union activities. In addition, the information would have to be collected manually and would require reconfiguring the employer’s CAS, which would be very expensive.
[128] When employees choose to be represented by a bargaining agent, they implicitly consent to the release of personal information to the bargaining agent in order to allow it to negotiate on their behalf (Public Service Alliance of Canada v. Bank of Canada, [2007] CIRB no. 387).
F.
For Ms. Bernard
[129] There is no evidence that the PIPSC needs the home contact information of all employees. The PIPSC has not had this information since 1993 and has been able to fulfill its statutory obligations. With respect to the new obligations introduced in 2005, the PIPSC has been without this information since that time. The evidence has not demonstrated that the PIPSC has had any problems meeting its obligations under the PSLRA.
[130] The PIPSC is entitled to some contact information, namely, work addresses and work telephone numbers.
[131] The employer is obligated to ensure the accuracy of personal information (see subsection 6(2) of the Privacy Act). Deficiencies in personal information remain the responsibility of the employer and not the bargaining agent.
[132] The PIPSC already has tools to reach all employees. For example, a message was recently sent from a PIPSC representative to all AFS employees (Exhibit I-1, tab 4). The PIPSC could also make better use of its website. Correcting issues with the currency of information is within its control. The PIPSC already has a password-protected area of its website and could use it to provide confidential information to employees. The use of stewards could be improved as well, to meet statutory obligations. Bulletin boards are in the workplace, and the PIPSC could use them to better communicate with employees.
[133] An employee’s privacy rights cannot be waived just because an employee is in a unionized environment. The collective cannot waive an individual’s rights. Individual privacy rights cannot be set aside because they are too difficult or expensive to guarantee. The Privacy Act has been held to be quasi-constitutional legislation.
[134] In the jurisprudence of labour boards that the other parties relied on (e.g., Millcroft Inn) there was no mention of individual privacy rights, and individual employees did not participate in those proceedings. Ms. Bernard stated that it was an uphill battle to establish standing to be heard on this issue.
[135] The statement in Millcroft Inn that individual privacy rights have been “. . .partially superseded by the union’s rights as their representative” (at paragraph 37) is directly contradicted by the OPC’s recommendation on the protection of individual privacy rights. Deference should be shown to the OPC’s opinion. In a case involving the list of voters for Elections Canada, the OPC decided that active consent, not implied consent, was required (see attachment A of Ms. Bernard’s submissions).
[136] Bargaining agents have abused personal information, as demonstrated by a 1992 complaint against the PSAC. There are no guarantees of information security, which is why individuals are free to choose whether to grant their consent to the disclosure of their personal information. The employer sent unencrypted data to the PIPSC, which does not have a specific policy on destroying expired data. The evidence showed that the PIPSC still has the first compact disc.
[137]
[138] Employees have an obligation to inform themselves of matters relating to their terms and conditions of employment. The employees that the PIPSC represents are highly skilled and well educated. There are many sources of information for employees, including the website, a “1-800” telephone number, work email addresses, the CRA website, bulletin boards, stewards, colleagues and media reports.
[139] An opt-in solution is not ideal because front-line managers should not know whether an employee is a
[140] Ms. Bernard noted that there are no guarantees as to the safety of private information. She provided examples of reported security breaches from the OPC Annual Report. In the case of the PIPSC, there are concerns even though the witnesses testified on the protections in place. The CRA provided unencrypted data to the PIPSC on compact discs that were couriered to the PIPSC. The PIPSC has received two discs and has not yet destroyed the first disc. The disposal of personal information has not been addressed by the parties.
[141] Ms. Bernard submitted that the following changes were required to the consent order: only work address and telephone numbers should be provided, and emails sent at regular intervals can continue to remind employees to provide home contact information to the PIPSC, if they choose.
G.
Further submissions of the OPC
[142] After hearing the submissions of all the parties, the OPC made submissions to clarify its position and made further observations.
[143] There is no requirement to demonstrate harm when assessing privacy rights.
[144] The OPC is not advocating the collection of home email addresses.
[145] The OPC is suggesting that the disclosure of personal information that is short of disclosing home addresses may be sufficient.
[146] The OPC submitted that, when it stated that the employer had not fully articulated a consistent use of the information, it had not yet heard the employer’s arguments. The OPC’s comments were not meant to convey the impression that the employer could not substantiate that claim. In addition, the OPC was not pronouncing on the sufficiency of the evidence to support a conclusion that the consent order constituted a consistent use of the personal information.
[147] The OPC noted that it could not overrule a decision of the Board or independently challenge it.
[148] The voters’ list example raised by Ms. Bernard was a highly contextual finding of the OPC. The OPC recognizes that the context of the consent order under reconsideration is different.
H.
Reply of the PIPSC
[149] The PIPSC submitted that its communication with employees extended beyond the purposes of sections 183 and 184 of the PSLRA. The interim decision of the Board (2008 PSLRB 13) was not limited to communications for that purpose.
[150] When the OPC examined the complaint raised by Ms. Bernard in 1993, it did not address the bargaining agent’s obligation to meet its statutory obligations.
[151] There was no evidence to show that home contact information was inaccurate.
[152] With respect to the expertise of the OPC, in the very specific context of federal labour relations, the Board has the necessary expertise. The Board cannot fetter its discretion by relying on the expertise of another body.
[153] There is no gap in privacy protection, as alleged by both the OPC and Ms. Bernard. The PIPSC has agreed to be bound by the principles of the Privacy Act. The remedy for a breach of privacy is the only issue here. The remedies before this Board are more robust than complaining to the OPC and receiving a non-binding recommendation.
I.
Reply of the PSAC
[154] The relationship between a bargaining agent and an employer is an agency relationship. The OPC did not recognize that fact in its submissions. Ms. Bernard is asking that the Board overrule its 2008 decision, which is clearly not part of this reconsideration.
J.
Reply of the CAPE
[155] At issue is not an obligation on employees to be informed but an obligation on bargaining agents to contact employees. The ability of employees to inform themselves of matters relating to employment conditions is therefore irrelevant to this reconsideration.
K.
Reply of the CRA and the employer intervenors
[156] The employer considered privacy concerns in reaching the agreement on the disclosure of contact information. The agreement is clear that the parties are bound by privacy principles. All the concerns initially raised by the OPC have been addressed in the agreement (that then became the consent order).
[157] There is no provision in the consent order about transmitting the contact information. No specific evidence was tendered on transmitting the information. The parties have found a fairly secure means of transmitting the information. The Board does not need to make any order about transmitting the contact information.
V.
Reasons
[158] The employer placed the scope of the consent order at issue in this reconsideration hearing. The employer’s position was that I need not consider the use of the home contact information beyond that of use under sections 183 and 184 of the PSLRA. Although the interim Board order focussed primarily on these sections, the consent order is not so limited. The consent order refers to the use of home contact information for “. . .the legitimate purposes of the bargaining agent in accordance with the PSLRA” (paragraph 3 of the bargaining agent part of the consent order). The FCA was clear that this reconsideration is limited to a reconsideration of the consent order. The FCA stated that the only issue before it was the type of information that the employer must provide (para. 30). The FCA also identified as an issue, the types of information necessary for the bargaining agent to meet its “representational obligations” (para. 18). Later in its decision, the FCA referred the matter back to the Board for a re-determination “as to the information which the employer must provide the union in order to allow the latter to discharge its statutory obligations” (para. 42). In light of the FCA’s earlier reference to representational obligations, it is likely that the later reference to “statutory obligations” included a reference to all of the obligations of the bargaining agent that flow from the PSLRA, not just those obligations specifically set out in the PSLRA (i.e., sections 183 and 184).
[159] I have therefore concluded that the scope of this reconsideration includes the use of personal information for the legitimate purposes of the bargaining agent under the PSLRA.
[160] The central issue in this reconsideration is an assessment of whether the consent order adequately takes into account and protects the privacy interests of employees who are not members of a bargaining agent (also known as “
[161] The FCA was clear that this reconsideration is not of the original order of the Board that found the failure to provide contact information to the PIPSC an unfair labour practice. In the interim decision, the Board suggested some questions that needed to be explored before it could rule on the information that must be provided. Those questions may be paraphrased as follows:
• What contact information does the employer possess?
• How is the information maintained to ensure its accuracy and timeliness?
• What precise types of information are necessary with respect to the representational obligations of a bargaining agent?
• When should the employer provide the information?
• What are the recurring requirements, if any, to update that information?
• Are there approaches under which the employer can meet its obligation to provide information that reasonably address any Privacy Act concerns?
• Should any conditions be placed on the use of the information by a bargaining agent?
[162] The evidence has shown that the employer has the following contact information for all employees: work address, work email address and home address. It has the home telephone number of those employees who have chosen to provide it. It is clear that home contact information (address and telephone number) is considered personal information under the Privacy Act, while work contact information is not. However, it is not appropriate for a bargaining agent to use employer facilities (including telephones and email) for its business. In common with most collective agreements, the applicable collective agreement in this case clearly sets out the parameters for conducting union business at the workplace. The ability of a bargaining agent to communicate with employees at the workplace is clearly constrained. Most notably, communications from bargaining agents must be vetted and approved by the employer before posting. See for example, International Association of Machinists and Aerospace Workers and District Lodge 147, National Association of Federal Correctional Officers v. Correctional Service of Canada, 2006 PSLRB 76; and International Association of Machinists and Aerospace Workers and District Lodge 147, National Association of Federal Correctional Officers v. Correctional Service of Canada, 2006 PSLRB 46. In addition, there is no expectation of privacy in electronic communications at the workplace. For those reasons, work contact information is not sufficient to allow a bargaining agent to meet its obligations to represent all employees in the bargaining unit.
[163] The OPC raised a concern that the employer might collect more personal information than needed to manage the employment relationship. There was no evidence to support this contention and the concern of the OPC remains hypothetical.
[164] The OPC suggested that the parties had not considered other mechanisms for contacting employees that did not require personal information. The OPC and Ms. Bernard did not provide any detailed descriptions of those mechanisms. The OPC referred to new technologies such as social media and the Internet without further elaboration. Ms. Bernard suggested using the stewards’ network or the PIPSC website. Both the OPC and Ms. Bernard have misconstrued the nature of the communication issue. There is no doubt that all organizations can use such tools for disseminating information. The issue here is not one of disseminating information but one of contacting employees directly. The Board has concluded that a bargaining agent has a right to contact all employees directly — relying on employees going to a website or talking to a steward does not meet that obligation. As noted in Co Fo Concrete Forming Construction Ltd, [1987] OLRB Rep. October 1213, (cited in Millcroft Inn, at paragraph 13), if a bargaining agent is to fulfill its duty of fair representation, it must be able to communicate directly with each employee that it represents.
[165] The OPC and Ms. Bernard appear to consider the PIPSC part of the public. As the British Columbia Court of Appeal noted in Canadian Office of Professional Employees’ Union, Local 378 v. Coast Mountain Bus Company Ltd., 2005 BCCA 604, it is important not to confuse the disclosure of personal information to a union with disclosure to the general public (at paragraph 74). As the name states, a bargaining agent is the agent of all employees in a bargaining unit (Ottawa-Carleton District School Board). The employee supplies home contact information to the employer in the context of the employment relationship. This relationship has been described as follows by the CIRB (in Telus Advanced Communications) as a “three-way, not a two-way relationship” (at paragraph 13):
The personal information about employees that is collected by the employer is not proprietary to the employer. If such information can be said to have an “owner,” that owner is the individual employee. An employee supplies this information to the employer in the context of the employment relationship, which in a unionized environment is a three‑way, not a two‑way relationship. The purpose for which basic personal contact information (i.e., the employee’s name, home address and home telephone number) is collected is so that those who need to make contact with the individual regarding employment‑related matters are capable of doing so. This purpose applies as much to the union that represents the employees as it does to the employer. Given the restrictions on union contact with employees during working hours, it may be said that the union has an even greater requirement for access to this basic personal contact information.
[166] As the OLRB noted in Millcroft Inn (at paragraphs 31 and 32):
A consequence of the union possessing exclusive bargaining status on behalf of the employees is that the union is placed in an equal bargaining position with the employer in its collective bargaining relationship. To the extent that the employer has information which is of value to the union in its capacity to represent the employees (such as their names, addresses and telephone numbers), the union too should have that information. The employees’ privacy rights are compromised (no doubt legitimately) by the employer having details of their names, addresses and telephone numbers. The union’s acquisition of that information would be no greater compromise, nor any less legitimate.
The employer has made much of the availability of alternative methods for the union’s acquiring the information it wants. Of course, with effort, the union could put a notice on its bulletin board asking each employee to let it have his or her address, and perhaps all, but more likely, less than all of the employees would bother to do so. Also, with effort, the union’s stewards could, in their own time (at meal breaks and before and after work), seek out each employee and obtain his or her address and telephone number. That too would probably result in some success. The question, though, is why the union should be put to such toil when the employer can easily, without hardship, supply the information? To my mind, there is no justification for putting the union to the exertion. The employer has the information, the union needs it, the union is entitled to it and it should have it. The employer is best placed to provide it, and it should do so.
[167] To fulfill its bargaining agent role, the PIPSC must be able to communicate with employees quickly and effectively, particularly when employees are dispersed (Ontario Public Service Employees, at paragraph 9, and Canada Post Corporation, at paragraph 27).
[168] The PSSRB examined the issue of the disclosure of personal information in 1996. It concluded without much analysis that the disclosure of personal information was authorized under paragraph 8(2)(a) and subparagraphs 8(2)(m)(ii) of the Privacy Act. In Atomic Energy of Canada, Ltd., the CIRB concluded that information collected for employment purposes should generally be disclosed to bargaining agents in accordance with paragraph 8(2)(a) because that disclosure is consistent with one of the main purposes for which the information was gathered — the appropriate administration of the employment relationship (at paragraph 34). In Economic Development Edmonton, the Alberta Labour Relations Board came to the same conclusion (at paragraph 27). Employees provide home contact information to their employers for the purpose of being contacted about their terms and conditions of employment. This purpose is consistent with the PIPSC’s intended use of the contact information in this case. The PIPSC is limited in its use of home contact information. The intended use is to meet the PIPSC’s obligations to represent the interests of employees in the bargaining unit. Therefore, I have concluded that the disclosure of home contact information is permitted by paragraph 8(2)(a).
[169] Given that I have concluded that the right to disclosure is provided for in paragraph 8(2)(a) of the Privacy Act, I do not need to consider the other provisions of the Privacy Act relied on by the parties.
[170] The OPC and Ms. Bernard raised a concern about the accuracy of the home contact information. I agree with the employer that subsection 6(2) of the Privacy Act does not apply to home contact information, subsection 6(2) is in place to ensure the accuracy of information for decisions made affecting an individual. In any event, the ability of employees to make changes to their home contact information is sufficient to ensure the accuracy of that information. Given that one of the purposes of providing home contact information is to receive compensation and benefit-related information, employees have an incentive to update that information. Further, the PIPSC would not be sending personal information to employees, so there is no risk of compromising personal information by sending correspondence to an employee’s former address.
[171] In their arguments, the parties have addressed the frequency at which the home contact information should be sent. A quarterly schedule was agreed to as adequately ensuring that the home contact information is up to date.
[172] I now turn to an examination of the terms of the consent order to determine if the privacy interests of the employees are adequately protected. It is important to note that the OPC has identified a gap in privacy legislation in
[173] As already noted, the parties’ agreement has addressed the use to which the home contact information can be put by the PIPSC: it is limited to legitimate obligations pursuant to the PSLRA.
[174] Ms. Bernard has identified her concerns with the potential abuse of disclosed information. The PIPSC has committed to protect the information that it receives from the employer. I agree that abuse cannot be presumed. The PIPSC has as much interest in protecting this information as the employer. It is not in its interest as an agent of employees for information to be disclosed to others. The disclosure of such information could seriously undermine the trust that must exist between an employer and his or her agent. It has also agreed to be bound by privacy principles that should prevent any abuse. In the unlikely event that there is abuse or a breach of security by the employer in the transmission of the information, employees have recourse under the Privacy Act. In the event of abuse or a breach of security of the information by the PIPSC, employees have a right to raise those concerns with the Board. Given that potential abuse is hypothetical and not supported by any evidence, it is not appropriate for me to reach any specific conclusions on how a complaint under the PSLRA would be framed or addressed by the Board.
[175] The consent order is clear that the PIPSC can use the home contact information only for legitimate purposes under the PSLRA, that it shall not disclose the information to anyone other than those officials responsible for fulfilling its obligations and that it shall not use the information for any other purposes (subparagraphs 7(a) and (b) of the bargaining agent part of the consent order).
[176] The evidence showed one unacceptable risk factor in the transmission of home contact information. Home contact information was sent to the PIPSC on an unencrypted compact disc by courier. The consent order is clear about the secure storage and protection of the disclosed information by the PIPSC (at paragraph 4 of the bargaining agent section) but does not address the secure transmission of the data. Home contact information should be transmitted in as secure a manner as possible. The evidence showed that the transmission of home contact information from the TBS is both encrypted and password protected. If the method of transmission is a compact disc, it should be encrypted or require a password to access it. Accordingly, the consent order is amended to make it clear that home contact information transmitted from the employer shall be encrypted or password protected.
[177] Ms. Bernard raised some questions about the proper disposal of expired home contact information. These are legitimate concerns. The fact that the first compact disc of home contact information has not yet been destroyed is perhaps explained by the fact that the PIPSC has not yet had an opportunity to use the information on it. No explanation was forthcoming from the PIPSC. The consent order requires that it respect the principles of the Government Security Policy for the security “. . .and disposal of this personal information. . .” (subparagraph 7(c) of the bargaining agent part of the consent order). The Government Security Policy does not contain any instructions on the disposal of private information. Privacy principles require the timely destruction of personal information that is no longer relevant to the purpose for which it was collected. Accordingly, the consent order is amended to clarify that home contact information records provided by the employer are to be appropriately disposed of after the updated home contact information is provided by the employer.
[178] The parties’ agreement did address the matter of advising employees that home contact information would be shared with the PIPSC (paragraph 4 of the employer part of the consent order). The parties did not address the ongoing need to advise new employees in the bargaining unit that home contact information will be shared with the PIPSC. The employer can address this issue either by amending the form provided to employees or by providing a notice to all new employees. The mechanism to be used for advising new employees is up to the employer, but the consent order will be amended to require that all new employees receive a notification that their home contact information will be shared with the PIPSC.
[179] For all of the above reasons, the Board makes the following order:
(The Order appears on the next page)
Order
[180] The consent order set out in Professional Institute of the Public Service of Canada v. Canada Revenue Agency, 2008 PSLRB 58, is amended. The portion of the order setting out the employer’s obligations is amended to add the two following paragraphs:
5. Home contact information transmitted from the employer shall be password protected or encrypted to ensure its safe transmission;
6. Subsequent to initial appointment to a position in the bargaining unit represented by the PIPSC, an employee shall be notified by the employer that his or her home contact information will be shared with the bargaining agent.
[181] The portion of the order setting out the bargaining agent’s obligations is amended to add the following paragraph:
10. Home contact information provided by the employer shall be appropriately disposed of after it has been replaced by current home contact information
March 21, 2011.
Ian R. Mackenzie,
Vice-Chairperson
ANNEX A
Text of consent order 2008 PSLRB 58
II. Order
[5] The employer will:
1. on a quarterly basis, disclose to the bargaining agent the home mailing addresses and home telephone numbers of its employees belonging to the AFS bargaining unit, that the employer possesses in its human resources information systems. The employer will endeavour to provide this information to the bargaining agent within 3 months of the PSLRB Order endorsing this MOA;
2. subject to the receipt of an express written consent from the Public Service Alliance of Canada (PSAC) granting permission to use the business process and system developed for the PSAC (Public Service Alliance of Canada v. Canada Revenue Agency, 2008 PSLRB 44) for the sole purpose of transmitting employee home contact data to the bargaining agent, the employer agrees to provide the data as outlined in paragraph 1;
3 provide the data in a flat file comma delimited format specified in Appendix A (field lengths to be confirmed);
4. prior to the initial disclosure of the information outlined in paragraph 1 above, the employer and the bargaining agent will jointly advise employees that the information will be disclosed. The message will explain the reasons why the information is being disclosed. Attached to the joint message will be the Board Order. Any questions concerning the disclosure will be directed to the bargaining agent. The joint message is attached to this agreement as Appendix B.
[6] The bargaining agent will:
1. withdraw complaint 561-34-177;
2. agree that this is a full and final settlement of all claims they have, or shall have in respect of home contact information for employees in the bargaining unit, against Her Majesty in right of Canada, Her employees, agents and servants arising out of this application and, subject to the provisions of the PSLRA, agrees not to take any proceeding of any manner with respect to them;
3. ensure that the disclosed information is used solely for the legitimate purposes of the bargaining agent in accordance with the PSLRA;
4. ensure that the disclosed information will be securely stored and protected;
5. respect the privacy rights of the employees in the bargaining unit;
6. acknowledge that the employer is bound by the Privacy Act with respect to the protection of personal information as defined in that Act. The bargaining agent shall manage the personal information disclosed under this Memorandum of Agreement in accordance with the principles of fair information practices embodied in the Privacy Act and the Privacy Regulations. Specifically, it will keep private and confidential any such personal information disclosed by the employer to the bargaining agent under this Memorandum of Agreement;
7. for the sake of clarity, the bargaining agent shall among other things:
a. not disclose the personal information to anyone other than bargaining agent officials that are responsible for fulfilling the bargaining agent’s legitimate obligations in accordance with the PSLRA;
b. not use, copy or compile the personal information for any purposes other than those for which it was provided under this agreement;
c. respect the principles of the Government Security Policy at http://www.tbs-sct.gc.ca/pubs_pol/gospubs/TBM_12A/gsp-psg_e.html for the security and disposal of this personal information; and
d. ensure that all bargaining agent officials that have access to the disclosed information comply with all the provisions of this agreement;
8. recognize the sensitivity of the information being disclosed with respect to personal security of employees, especially where inadvertent mishandling/disclosure of this information could result in serious safety concerns, and accordingly, will ensure vigilant management and monitoring controls on this information at all times in light of these potential risks to employees and their families;
9. recognize that the information provided from the employer’s database in place at the time of disclosure was provided by employees and that the employer will not be held liable should a strike vote be challenged. The bargaining agent is responsible for updating its own database.
[7] The terms and conditions of this agreement are made without prejudice or precedent.
[8] It is expressly understood and expressly agreed that neither implementation of the terms of settlement nor acceptance of this agreement constitutes any admission of liability on behalf of any of the parties and that such liability is expressly denied in this or any other matter.
ANNEX B
Appendix A to 2008 PSLRB 58
Canada Revenue Agency Union Address File (UAF) DRAFT
| Person:
|
|
To
|
| IAN (9)
|
Num (9)
|
Y
|
| Person Name
|
|
|
| Mixed Char (3)
|
Initials
|
Y
|
| Mixed Char (20)
|
Family Name
|
Y
|
| Person Address
|
|
|
| Mixed Char (55)
|
Home Address Line (1)
|
Y
|
| Mixed Char (55)
|
Home Address Line (2)
|
Y
|
| Mixed Char (55)
|
Home Address Line (3)
|
Y
|
| Mixed Char (55)
|
Home Address Line (4)
|
Y
|
| Mixed Char (30)
|
Municipality/City Name
|
Y
|
| Mixed Char (30)
|
Province / Territory
|
Y
|
| Upper Char (30)
|
Country
|
Y
|
| Upper Char (10)
|
Postal Code
|
Y
|
| Person Telephone
|
|
|
| Num (3)
|
International Country Code
|
Y
|
| Num (3)
|
|
Y
|
| Num (7)
|
Subscriber Number
|
Y
|
| Example
|
|
888888888,hl,garson, 123 somewhere lane, around the corner,,,
e8n4e6,011,613,
9999999
|
Appendix B to 2008 PSLRB 58
Message to Employees in Bargaining Units Represented by the Professional Institute of the Public Service of
With the introduction of the Public Service Labour Relations Act, bargaining agents who conduct strike votes must now permit all employees in the bargaining unit to participate in those votes, not merely members of the union in good standing, as was previously the case.
In order for the PIPSC to comply with its obligations under the PSLRA to give proper notice of strike votes to all employees, and also to fulfill its other duties in accordance with the PSLRA, it is necessary that the employer disclose to the PIPSC the home contact information for all employees in the bargaining unit.
The provision of this information is governed by an order of the Public Service Labour Relations Board, which is attached. The information provided to the PIPSC will be used for the legitimate purposes of the union and its security is to be carefully maintained. The PSLRB order sets out the privacy and security safeguards to which your information will be subject.
To this end, it is in every employee’s interest that their contact information be kept up to date with their bargaining agent. You are therefore encouraged to submit your current contact information to the PIPSC and to advise your union of any changes to that information that may occur in the future.
You can provide your contact information via the PIPSC website at http://www3.pipsc.ca/portal/page/portal/website/memberservices/membership or by communicating with the PIPSC at 1-800-267-0446.
Thank you for your attention and cooperation. Should you have any questions arising from this message, please do not hesitate to communicate with the PIPSC at the above number.