Employee alleges company forcing consent to security screening

PIPEDA Case Summary #2003-127

[Principles 4.3, 4.3.2 of Schedule 1; section 5(3)]

Complaint

An employee of a telecommunications company alleged that his employer was inappropriately requiring him to consent to the collection of his personal information. Specifically, he alleged that the company was forcing him to consent to a security clearance check in order to be able to work in a restricted area at an airport. His position was that his consent was neither informed nor voluntary since the company was threatening him with loss of employment if he did not consent.

Summary of Investigation

The federal government has required that any person working in restricted areas at its 29 (recently expanded to 89) designated Canadian airports must have security clearance. The complainant's employer has a facility located within a restricted area of one of the original 29 airports, and many of its employees, including the complainant, perform work at the airport. Although there has been a long-standing requirement for security clearance at the airport in question, it was not strictly enforced. Notwithstanding this, new employees of the company had always been required to sign a form acknowledging that a security clearance may be required and that failure to comply with the clearance or to obtain it could result in termination of employment. The complainant signed this form when he was hired some years earlier.

Following the terrorist attacks on the United States and the increased vigilance on the part of security personnel at the airport to ensure that persons entering restricted areas possessed security clearance, the company asked the complainant to consent to the screening process. Without clearance, an individual must be accompanied by security personnel through the restricted area. The company indicated that this is not always possible since employees need access to the site at any time of day or night and a security escort may not be available.

The complainant initially refused to sign the form and was suspended for three days. After being informed that he would be dismissed if he did not consent, he signed the form, received clearance and kept his job.

Commissioner's Findings

Issued March 4, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a telecommunications company is a federal work, undertaking, or business as defined in the Act.

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Principle 4.3.2 clarifies that the organization shall make a reasonable effort to ensure the individual is advised of the purposes for which the information will be used. Section 5(3) establishes that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

The Commissioner determined that, consistent with Principle 4.3.2, the company had properly informed the complainant when he was hired that a security check may be required and that failure to undergo the check or obtain clearance could result in job loss. Furthermore, the complainant consented to this when he signed the acknowledgement form. On the matter of voluntary vs. involuntary consent, the Commissioner indicated that although the complainant was faced with potentially negative consequences, he nonetheless had a choice. The Commissioner noted the fact that consent is often not unfettered and that it must be looked at in the context of the reasonable person test in section 5(3).

On that issue, the Commissioner considered whether it was appropriate for the company to collect the complainant's personal information in the circumstances. He deliberated as follows:

  • The company was prompted to ask for the security clearance because airport personnel decided to strictly enforce the clearance requirement.
  • It was reasonable for airport personnel to take such a measure given the increased threat of terrorism and the fact that it had always been required to ensure that personnel working in restricted areas of an airport have security clearance.
  • A reasonable person would consider it appropriate for the company to comply with federal requirements that individuals working in restricted areas in airports receive security clearance and to collect and use personal information for those purposes.

The Commissioner therefore found that the company was in compliance with Principles 4.3, 4.3.2, and section 5(3).

He concluded that the complaint was not well-founded.

Report a problem or mistake on this page
Please select all that apply (required): Error 1: This field is required.

Note

Date modified: