Employer Monitoring Employees With GPS Tracking

Last week, I attended mandatory Workplace Safety and Insurance Board (WSIB) certification training as a management member of my employer’s Joint Health and Safety Committee. One thing I found interesting is how employers control and monitor workplace hazards, in particular when the hazards relate to vehicles that are considered a workplace.

As you may know, Part 2 of this certification course is about learning how to identify, assess and control hazards specific to your workplace environment. I was surprised to hear many of the participants indicate that, to control business-related driving hazards, they use global positioning systems, or GPS, to help keep track of their employees, whether using an employer-provided vehicle or personal vehicle.

Safety is the expressed justification that’s driving the use of GPS in the workplace; however, from what was explained, most employers’ use goes beyond safety. Frankly, I was taken aback by the lengths to which employers are going to track the whereabouts and activities of their employees in the name of safety.

Employers are tracking, among other things: driving speeds, dangerous driving habits, location, responding to an alarming situation, misuse and non-work-related trips, hours worked, lunch and other breaks, how long it takes to do a job, ensuring efficient routing for jobs, estimated times of arrival for customers and also proof of arrival times when there are disputes about billing or meeting contracted delivery times. GPS also allows the vehicle to be located in the event of theft.

Unfortunately, these workplace technological improvements often come at the expense of employees’ privacy. Employees usually consider their location or what they do away from the office to be personal information and, as a result, they consider an employer’s use of technology such as a GPS an invasion of their privacy.

GPS systems have not yet received a great deal of scrutiny under privacy legislation, but they have been the subject of several decisions under the Personal Information and Protection of Electronic Data Act (PIPEDA). In a 2007 paper, Dan Michaluk, of Hicks Morley LLP, gave a good overview of cases on GPS surveillance, which is still relevant.

What we can take from Dan’s paper is that privacy commissioners have consistently supported the use of GPS for purposes of safety, efficiency and productivity, while rejecting its use for employee management. While the Privacy Commissioner of Canada accepted at the time that GPS is appropriate to address issues of productivity, she did express concern about using GPS to “continually monitor” employees for performance management and disciplinary measures.

The issue of the appropriate use of GPS in employees’ vehicles was revisited in 2009 in PIPEDA Case Summary #2009-011. The complainant employee alleged that the employer was improperly collecting personal information without consent to keep track of his time and route, and to ensure he did not take improper breaks or lunches. The employer alleged that it was not using the GPS to manage its employees but to provide efficient service to its clients.

To that end, the employer accessed the information only if there was a complaint from a client or for safety reasons. The privacy commissioner determined that the employer collected and used the information in dispute strictly for an appropriate purpose—that of providing an efficient service to clients.

The themes arising in the 2009 case and the cases discussed in Dan’s paper revolve around employee management, not the validity of GPS technology. It is an employer’s declared policy of not using GPS for performance management purposes that renders the technology acceptable.

Striking the proper balance between the employer’s right to manage and the employee’s right to privacy has long been an important exercise for employers, and this exercise applies also in the case of GPS tracking.

Retweet information »

Comments

  1. Thanks Yosie.

    You might disagree with the finding in the most recent case on vehicle tracking – Arbitrator Steeves’ decision in Otis Canada v. International Union of Elevator Constructors, Local 1 (Telematics Device Grievance), [2010] B.C.C.A.A.A. No. 121. He finds that vehicle telematics data is not personal information in the context, so there’s not even an employee interest to balance against the employer’s management rights. He employs similar reasoning to that employed by the Alberta Court of Appeal in the recent Leon’s case. No sign of a leave application in Leon’s… yet.

  2. Thanks Dan for bringing us up to date… I am sure there will be more debates and challenges on vehicle tracking.

  3. The finding that Dan mentions by Arbitrator Steeves is clearly wrong, or from an earlier decade in its conception of what privacy is intended to protect. The question is not how a particular bit of data is characterized but what it can be used for, in combination with other bits of data. I don’t have much problem with employers tracking employees during working hours (or the employers’ equipment at any time), but the reasoning in that decision is a step in the wrong direction.

    Location-based data is making the evolution of the notion of personal information clear – particularly in the US where the law tends to focus on specific PI like driver’s licences or credit card numbers – but there are other types of data that raise the same issues: clever data aggregation changes the risk and thus the policy and thus ultimately the law applicable to any individual datum.

  4. SO if the employer is implemening GPS Tracking on blackberry devices (company provided) among their sales staffs, is it LEGAL as far as QUEBEC’s law concern?
    Can anybody let me know?

  5. Yosie Saint-Cyr

    Quebec has its own private sector privacy legislation: the Act respecting the protection of personal information in the private sector. This Act has been deemed substantially similar to PIPEDA, even however, it is stricter than PIPEDA.

    In Quebec employee have a limited expectation of privacy in the workplace. In the employment context, the law imposes two conditions on the collection of personal information by an employer. First, the information must be absolutely necessary, meaning the employer must really need it. Second, the gathering of information must be legitimate, meaning that it must be done in a legal way (thus the technology you use to monitor employees needs to pass the test).

    This said, the Act to establish a legal framework for information techonlogy (paragraph 2 of section 43) provides the specific limits on GPS and biometric measurements… provides that “…a person may not be required to be connected to a device that allows the person’s whereabouts to be known.” The case law so far makes a difference between following a car (permitted) and following a person. And, often the use of this type of technology is necessary given the lack of other options.

  6. My employer (in BC) provides company iPhones for its sales-team. There are a couple apps for the iPhone that can be used to track the location of a phone at any time (Find My iPhone, Team Navigation). I understand the company wanting to keep track of its property. My concern is the potential legal issues around having an app installed on the phones that can track the location of the phone any time it is turned on.

    I think the employer has the right to track its property. I also understand if an employer wanted to make sure a salesperson that spends their days on the road was actually attending the job-sites rather than sitting at home all day.

    What I don’t know is if this is legal or a violation of of the employees rights?

  7. Are companies obligated to inform their employees if and when their vehicles have had a gps tracking device installed?

  8. The answer is that if it’s a vehicle owned by the business then it is likely covered by the firm’s policies, which will likely say that the technology is used for firm purposes, that the firm reserves the right to and that employees have no expectation of privacy.

    It all depends on the specific workplace, how the technology is being used, whether the workplace is unionized and what the employer has said to its employees about the possibility of monitoring.

    If it’s your own vehicle, then a GPS can only be used by the employer with your consent.

    The Privacy Commissioner of Canada’s finding, entitled Transit driver objects to use of technology (MDT and GPS) on company vehicle stated.

    In the circumstances, it was reasonable for the respondent to assume it had the drivers’ implied consent to collect and use their personal information by MDT/GPS since they continued to provide their services after being advised of the devices’ installation. Prior to installing the MDT/GPS, a bulletin was circulated to the drivers, the union was apprised of the situation and training was provided. Any drivers who objected to having their personal information collected by MDT/GPS could have objected at that time. Further, the Assistant Commissioner deemed the personal information collected not to be sensitive and that it is information the respondent has legitimate interests in collecting in order to effectively deliver the transportation service. She also noted that the collection was not particularly privacy-invasive and the amount and type of personal information being collected had not materially changed from the former collection method. (Principles 4.3, 4.3.5 and 4.3.6 upheld)

    Similarly, it is reasonable for the respondent to assume it has the implied consent of its clients to collect their personal information. Clients must be aware that the respondent and its drivers require their name (for client authentication purposes), pick-up location (to deliver the service) and drop-off location (for route planning and scheduling purposes). (Principle 4.7 upheld)

    The use of MDT/GPS technology to improve efficiency and increase the quality of the service is an appropriate purpose under section 5(3) of the Act. The respondent had the implied consent of its clients and of the drivers to collect and use their personal information for these purposes during the period prior to the complainant being directly employed by the respondent. Contractors were only provided with the information where it was reported that a driver did not arrive at the scheduled time. The respondent’s purpose for relaying this information was not to prompt disciplinary action against a driver, but rather to hold the contractor to the service levels to which it had agreed.

    There is no evidence to corroborate the allegation that the personal information collected through MDT/GPS is used for employee management. It would appear that, ever since the time when the organization hired the drivers directly, it has remained committed to using the personal information gleaned through the use of MDT/GPS technology only to improve service delivery and client safety.

  9. What are your thoughts on a gps installed on a fleet of company vehicles which then can be tracked by board members (or other volunteers) of a not-for-profit organization?
    The company machines might sometimes be operated by a paid employee and sometimes by a volunteer. The software does not reveal who the driver at the time is but often times one machine is only used by the same operator so you might know or have a fairly good idea of who the operator is.
    Is there a privacy issue involved here?

  10. I drive a company vehicle for 6 years now. My employer allows personal use if the vehicle. New hired staff is often told that there is no need to maintain a personal vehicle because the company will supply a vehicle.

    Last week we were informed that the vehicles will be equipped with GPS tracking devices. Apparently to improve efficiency and help staff with routing.

    1. I am concerned about privacy. This is my only vehicle and I am concerned about beeing monitored 24h by my company. The company statement was that they don’t care what we do after hours. What can I do to protect myself?

    2. Am I allowed to carry a GPS jammer while traveling after hour to protect my privacy?

    Thank you