Commissioner Frank Work authorized an investigation under the Personal Information Protection Act (“PIPA” or “the Act”) after receiving a complaint that Precision Drilling Corporation (“Precision”) contravened the Act.
The complaint alleged that Precision improperly collected personal information from an event data recorder (EDR) in a privately-owned motor vehicle and used the data in a decision to terminate the employee who was operating the vehicle for work purposes. The employee was in a car accident; the event data recorder revealed that he was not wearing his seatbelt at the time of the accident –a contravention of company safety policies and provincial traffic regulations.
The investigator found in the specific circumstances of this case, Precision did not breach the Act when it collected the data from the privately-owned vehicle.
This conclusion is based on the following:
- Consent to release the black box data was collected from the driver
- Driving was deemed to be a bona fide occupational requirement
- Precision had extensive policies in place to address vehicle safety on the job, as well as possible consequences for an employee’s failure to comply
- Precision adequately notified affected employees of safety standards and policies
The circumstances in the case illustrate that the collection of EDR information on employees is not a decision to be taken lightly. The collection of this data should be an exception to usual business processes. Occupational job requirements, the company’s documented safety standards and notification of these standards is critical. When an employee’s personal vehicle is involved, organizations are advised to take the additional step to obtain consent before collecting EDR data.