Written by Cristina Lavecchia, Editor, First Reference Inc.
An employee working for a an international trucking company that is considered a federally regulated employer alleged that while his accident claim was active with a provincial workers’ compensation board (WCB), his employer informed the WCB, without his knowledge and consent, that he had tested positive in a drug test.
According to the employer, they were required to disclose this information by law. However, the WCB and the Office of the Privacy Commissioner of Canada both affirmed that the circumstances in this case did not require the employer to make such a disclosure. As a result, the Privacy Commissioner concluded that the employer did contravene Canada’s private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA).
After getting hurt on the job, the employee took a medical leave and applied for workers’ compensation benefits. The employee was put on a modified duties work plan. A few days before he was to return to work, the employee was informed that he was required to submit to a random drug test. The employee’s drug test came back positive for drug use, and as a result he was suspended from work.
What is the issue?
The employee claimed that the employer had disclosed his drug test results to a WCB adjudicator and his co-workers without his knowledge or consent.
The employee filed a complaint with the Privacy Commissioner of Canada.
In defence, the employer stated that the manager handling compensation claims sincerely believed that he was obliged to inform the WCB about the results to explain the reason for the employee’s employment status change. In support of its actions, the employer noted a provision of the provincial Workers’ Compensation Act (WCA), which states that employers must provide the WCB with any information it requires in connection with an accident. However, according to the WCB, “the WCA creates no express duty for any party to make an unsolicited disclosure of information to the WCB, except in certain limited circumstances related to notification requirements after a workplace accident.”
Regarding the employee’s co-workers being notified of his test results, according to the employer, it could find no evidence of a disclosure of test results to co-workers and that the employee’s results were placed in his personnel file, to which only a limited number of people had access. Also in this respect, the Privacy Commissioner contacted the employee’s co-workers; they stated that they were aware that the worker was required to take a drug test (as the list of individuals to be tested was publicly posted on a workplace bulletin board), and when he stopped coming to work shortly after taking the test, they had assumed it was due to the test outcome.
The Privacy Commissioner did not find any evidence that the drug test results were disclosed to the employee’s co-workers. As a result, it was concluded that this aspect of the complaint was not well-founded.
However, the Privacy Commissioner did find that the employer inappropriately disclosed the employee’s drug test results to the WCB:
“We found that the individual’s drug test results constitute personal information that had been collected for one particular purpose: to fulfill the company’s substance abuse policy requirement. However, the information was later used and disclosed for another purpose ─ the WCB claim and return to work process ─ to which the complainant had not consented.
Our Office further determined that the disclosure of the complainant’s drug test results to the WCB was not required by law since, as confirmed by WCB, the drug test results was not information that the WCB had required the organization to provide in accordance with the WCA. Therefore, the exception to consent under paragraph 7(3)(i) of PIPEDA could not be relied on in this case. Accordingly, we found the organization contravened Principles 4.3 and 4.5 in respect of this disclosure.”
The Privacy Commissioner made a few recommendations to the employer:
- Cease displaying the list of personnel selected for drug testing in the workplace.
- Revise its substance abuse policy to better describe: (i) the company’s obligations regarding a drug testing program; (ii) when the company may report testing results to third parties and the need for employee consent to do so; and, (iii) how the company reports the results.
- Provide a copy of its revised substance abuse policy to its employees prior to any drug testing they undergo.
- Provide a privacy training session to its employees, including management.
After the employer demonstrated that it had implemented all of the Privacy Commissioner’s recommendations, the Privacy Commissioner found that the employee’s complaint regarding the disclosure of his drug test results was well-founded and resolved.
Lessons learned from this case
- Unless one of PIPEDA’s exceptions to consent can be applied, an organization must obtain an individual’s consent for all disclosures of their personal information to any third party. See the Office of the Privacy Commissioner of Canada’s publication Privacy Toolkit for Businesses.
- Prior to an organization disclosing an individual’s personal information without consent because it believes it has a legal obligation to do so, pursuant to paragraph 7(3)(i) of PIPEDA, it should ensure that such a belief is accurate. “Where such belief is inaccurate, such a disclosure of an individual’s personal information will be in contravention of PIPEDA,” stated the Privacy Commissioner.
Interested in testing your knowledge when it comes to managing and protecting personal information in your workplace? Take the Office of the Privacy Commissioner of Canada’s privacy quiz, which may help you identify some issues that your organization is not aware of.