Employee privacy trumps employer requirement for surnames on nametags
This article originally appeared in CyberLex. |
What’s in a name? That which we call employee personal information, perhaps.
Prairie Montagues and Capulets can carry out their work with the public on a first-name-only basis, according to a recent ruling from a Saskatchewan labour arbitration panel. The panel sided with a healthcare union that complained about the employer’s policy requiring staff nametags to display both a first and last name. The panel found that requiring surnames to be displayed violated the employees’ privacy and occupational health and safety rights, and was inconsistent with the union’s collective agreement.
The union, the Canadian Union of Public Employees, Local 5111 (CUPE), represents most employees working for the Prairie North Health Region (PNHR). PNHR runs acute care hospitals, long-term care facilities, clinics, and other healthcare services in one of 13 health regions in Saskatchewan.
Prior to 2012, PNHR’s employee nametags only displayed the employee’s first name. The new nametag policy was introduced as part of PNHR’s implementation of the province’s “Patient First” philosophy. The objective was to put patients at the centre of the healthcare system, in part by making their relationship with healthcare providers more mutually transparent. Patients have an established right to know the identity of their caregiver, which is included with their healthcare records. As such, in PNHR’s view, identifying employees by their last name on nametags was no different, and helped to equalize the power between patients and caregivers. The new nametags were to contain the employee’s full name, job title, and photograph.
When the policy was announced, CUPE advanced 3 arguments:
Displaying employee last names violated employees’ privacy rights under the Saskatchewan Local Authority Freedom of Information and Protection of Privacy Act (LAFIPPA);
Displaying last names increased the personal risks faced by employees, thereby violating employee rights to a safe workplace under the occupational health and safety provisions of The Saskatchewan Employment Act; and
The nametag policy was an unreasonable exercise of management rights and was inconsistent with their collective bargaining agreement.
A number of employees presented evidence showing that by making their surname readily available on a nametag, their safety and privacy was endangered outside of the workplace should patients or their family members attempt to locate or make contact with them. Since the adoption of the 2012 policy, many employees had chosen to conceal their surname with tape. Yet, at the time of the arbitration, there was no evidence of actual harm to employees that could be attributed to the nametag policy.
In defending its decision, PNHR pointed to the standard practices of other public service providers. Five other Saskatchewan healthcare regions required full names on nametags, and the policies of two nursing associations whose members are employed by PNHR also supported the use of full names by staff. PNHR noted that employees in other occupations (including police officers, corrections staff, and social workers) wear nametags displaying their first and last names.
Authorities Relied on by the Parties
In the panel’s own words, the dispute before it was “deceptively simple”, which is reflected in their detailed review of the privacy law issues. The parties primarily relied on 5 authorities:
In Saskatoon Board of Education, a school board wished to use the photographs and names of its teachers on its website. The Saskatchewan Office of the Information and Privacy Commissioner (OIPC) ruled that publishing the photographs with names constituted personal information, and that the use was inconsistent with the purpose for which the information had been collected. The OIPC found that the voluntary provision of the photos by staff did not amount to implied consent, and that the use of the photos was unjustifiable. CUPE argued that PNHR similarly had no consent to display employee surnames, and that the use of the information was inconsistent with the purpose of its collection.
In Bernard v. Canada, the Supreme Court of Canada ruled that disclosing an employee’s name and address to a bargaining agent did not violate the privacy of a bargaining unit employee. The Court ruled that no breach of privacy rights occurred because the personal information was disclosed for a purpose consistent with that for which it was obtained (administration of the employment relationship). The Court also conceded that “[a] use need not be identical to the purpose for which information was obtained … it must only be consistent with that purpose.” A consistent use must be “such that an employee would reasonably expect that the information could be used in the manner proposed”. CUPE argued that PNHR’s use of surnames was not consistent with the purpose for which the information was collected.
In Kelsey Trail, the OIPC ruled that an applicant was entitled to disclosure of the names of nurses on duty at a Saskatchewan hospital on a particular date. The OIPC indicated that releasing only the names of the nurses in question did not reveal personal information about them. Any personal information linked with the employee’s name would have constituted personal information under the LAFIPPA, amounting to an infringement of employee privacy. PNHR took the position that the employee surnames on nametags would similarly not be considered personal information as they were not paired with other employee information.
In Regina Qu’Appelle, employees filed a privacy complaint after the health region published the names and salaries of those earning more than $50,000 per year. While the OIPC found that the names and salaries constituted personal information under the LAFIPPA, the statute contained an express exemption for the disclosure of salary information. In PNHR’s view, if publishing salary information along with employee names did not run afoul of LAFIPPA, presumably displaying full names alone on nametags was not restricted.
In Department of Health, a privacy commissioner in Prince Edward Island heard a complaint filed in respect of a policy requiring the display of surnames on nametags. The commissioner deemed that in PEI, full names alone qualified as personal information, but that the relevant statute called for a balancing of interests between the impact of privacy intrusion and the public interest benefits if information was disclosed. The commissioner ultimately concluded that that the employee privacy concerns outweighed the public policy benefits. The commissioner found that the security and safety of employees was clearly an overriding concern, and that there was no evidence to show that first-name-only nametags had shortchanged accountability to the public. The commissioner opined that had the nametags in question included a photo of the employee, the threshold for establishing the public interest in intruding on employee privacy would have been greater. CUPE and PNHR both relied on this decision, but disputed the balancing point in its application to the facts.
The panel was ultimately persuaded by Saskatoon, finding that the PNHR nametag policy was contrary to the LAFIPPA because it combined a name with a photograph of the individual, amounting to “other personal information that relates to the individual”. The panel went on to say that it would have reached the same conclusion without the photograph because the nametag is attached to a physical person, and patients and members of the public will be able to discern other information from the employee’s appearance, including colour, race, height, gender, and other characteristics. In short: the panel found that when a nametag is worn by an employee, it is impossible to separate the name from other personal information. In contrast, the disclosure in Kelsey Trail severed employee ID numbers from names, allowing for the separation of personal information. Regina Qu’Appelle was deemed irrelevant due to the express statutory exemption for salary information.
Having found the nametag policy contrary to LAFIPPA, the panel went on to evaluate whether the surnames could be displayed pursuant to any exceptions in the statute. The panel concluded that the employer had not obtained consent (s. 28(1)); that the purpose for which the information was obtained was inconsistent with the disputed use (s. 22(2)(a)); and that the public interest in disclosure did not outweigh the invasion of privacy that would result (s. 28(2)(s)), particularly given the analysis in Department of Health showing no negative impact arising from mononymous nametags.
The panel went on to conclude that the nametag policy failed to comply with the occupational health and safety provisions of the Employment Act due to the absence of a proper risk assessment and the implementation of appropriate safeguards that might be required on the basis of such assessment. The policy was also deemed to be inconsistent with the collective agreement and unreasonable. In result, the grievance was sustained on all 3 grounds of complaint.
There are some interesting substantive and process-based limitations to the panel’s adjudication of the privacy issues in this case. First, it is unclear whether a court, reflecting on Bernard, would arrive at the same conclusion as the arbitration panel. The panel appears to conflate information obtained from an observed, in-person encounter with an employee to that from a recorded image – only the latter of which is information that is collected. In addition, whether the use of the information was inconsistent for the purpose for which it was collected may also have been weighed differently, especially if PNHR had based their argument on a different purpose than its “Patient First” strategy.
Second, an arbitral award does not carry the precedential authority of a court, nor is it binding outside of Saskatchewan. Even if it was, privacy laws vary from province to province, often leading to a different outcomes in different jurisdictions. The panel itself points out that different pieces of provincial legislation formulate “personal information” in different ways. It also remains to be seen whether a more specialized tribunal may have arrived at a different conclusion. For instance, the panel reiterates the union’s position that its decision to pursue arbitration instead of filing its complaint with the OIPC should not be read as a lack of confidence, despite the fact that the OIPC jurisprudence put before the panel reflects different outcomes on similar disputes.
Overall, this decision serves as a cautionary reminder of the range of appropriate uses to which personal information collected from employees can be put, reproduced, or displayed. The decision underscores the importance of establishing, implementing, and communicating sound privacy policies and procedures for organizations that deal with the public, and of seeking employee consent, where necessary, in order to meet obligations under applicable privacy legislation and collective agreements.