CIPPIC News Release on Alberta privacy decision

NEWS RELEASE - July 8, 2005

Surreptitious keystroke logging by employers held illegal in Alberta

In a precedent-setting case, the Alberta Privacy Commissioner has ruled that surreptitious employee monitoring by way of keystroke logging violates that province's public sector privacy law. The case was brought by an individual who lost his job as a computer technician at a public library after he discovered and complained about a keystroke logging program that was monitoring his computer use. The individual represented himself, relying on legal advice provided by the Canadian Internet Policy and Public Interest Clinic (CIPPIC).

Under Alberta privacy law, public bodies can collect personal information without consent where the information "relates directly to and is necessary for an operating program or activity of the public body". The employer, Parkland Regional Library, argued that the keystroke logging was necessary in order to ensure that the employee was not using the computer for personal purposes, and was being sufficiently productive. The Privacy Commissioner, Frank Work, was convinced by neither of these justifications, noting that there are other, much less intrusive means of monitoring employee productivity and addressing concerns about working time, and that in any case, there was no good reason in this case not to inform the employee of the monitoring.

"This is an important win for employee privacy", said Philippa Lawson, Executive Director of CIPPIC. "While it is specific to the Alberta Freedom of Information and Privacy Act, the general principles applied by the Commissioner in his reasons are more broadly applicable - that is, employers should be open about any employee monitoring they are engaging in unless they have clear justification for covert surveillance, such as suspected fraud. Moreover, they should use methods of monitoring that collect no more information than they need. Even if this case had been brought under different privacy legislation, we think the result would have been the same."

The successful complainant, Dan Armeneau, says he's happy with the decision but disappointed that it has no teeth. "This whole incident was costly to me in a number ways, not just the lost job. I have a validating decision now, but no compensation for the time and effort, emotional stress, and adverse impact on future employment prospects that the incident has caused me. And the employer walks away from this without having incurred any penalty for its illegal actions. Something is wrong with that, I think."

- 30 -

For more information, contact:

Philippa Lawson, CIPPIC

tel: 613-562-5800 x2556

Dan Armeneau

tel: 403-668-0903

Privacy Commissioner's Decision:

Dan Armeneau's account of the case: