The Office of the Information and Privacy Commissioner has found that Hearing Conservation Consultants Ltd. (HCC) did not contravene the Personal Information Protection Act (PIPA) when HCC disclosed a letter from an employee’s healthcare worker describing his medical condition to Alberta Infrastructure & Transportation’s Driver Fitness and Monitoring Branch (DFMB). The DFMB’s collection of this information was also found to be in compliance with the Freedom of Information & Protection of Privacy Act (FOIP).
HCC stated that when it received the letter, which was intended to support the employee’s absence from work, the organization became concerned about the employee’s ability to drive. In the interests of public safety, HCC disclosed the letter to the DFMB. Upon receiving the information, the DFMB investigated the individual’s (now no longer an HCC employee) fitness to drive and then decided to place conditions on his driver’s license requiring an annual medical examination.
PIPA enables organizations to disclose an individual’s personal information without consent to public bodies that are authorized by legislation to collect the information. Since the DFMB is a public body authorized by legislation to collect and respond to complaints about drivers, HCC did not contravene PIPA by disclosing this information to the DFMB. FOIP permits public bodies to collect and use information about individuals for the purposes of law enforcement. In this case, the DFMB conducted an investigation under the Traffic Safety Act and Operator Licensing and Vehicle Control Regulation. Therefore, the DFMB’s activities were in compliance with FOIP.
Although neither HCC nor the DFMB were found to be in contravention of privacy legislation, the investigator recommended that HCC:
- Make standardized insurance forms available to employees to submit directly to its benefits provider in cases of short and long-term illness or disability.
- When a doctor’s note is required for HCC’s own purposes to support casual illness, provide employees with a standardized form for doctors to complete that do not include fields for symptoms or diagnoses.
- Amend its policies according to the above and notify employees of these changes.
- Develop and follow a written privacy policy.
HCC agreed to implement these recommendations and the matter was closed.