Saskatchewan: Reasonable Expectation of Privacy Not Violated in Examination of Employee Computer

This complete global solution for HR professionals combines custom research, strategic white papers, country primers, webinars, and the expert guidance you’ve come to expect from...

By Jeremy Hainsworth

July 28—A finding that Saskatchewan provincial power utility SaskPower acted within provincial privacy law to collect an employee's personal information from his work computer has implications for all Canadian organizations, the province’s privacy commissioner said July 25.

Commissioner Ronald Kruzeniski found that the employee's reasonable expectation of privacy was not violated because the company had an acceptable basis for conducting a focused investigation into the employee’s activities as part of managing a human resource issue.

Kruzeniski told Bloomberg BNA July 25 that, while the finding was under the provincial Freedom of Information and Privacy Act, private organizations have the same obligations under the federal Personal Information Protection and Electronic Documents Act.

A Legitimate Corporate Activity

According to Investigation Report 120-2016 released July 21, SaskPower collected an employee's personal information by conducting a forensic investigation of his work computer. The now former employee alleged that SaskPower breached his privacy by indiscriminately collecting personal information.

SaskPower rejoined that the data collection wasn't done in secret since employees saw a system access agreement on logon screens that read in part that “users have NO expectation of privacy on this system, or any other related equipment, networked device or storage.” The employer argued further that the forensic investigation initiated by its human resources department was focused on the former employee's activities only because of his failure to maintain a reasonable standard of work performance and productivity.

While non work-related information qualifies as personal information under the provincial Freedom of Information and Privacy Act, Kruzeniski said, managing human resources is a legitimate corporate activity.

Privacy Rights

Kruzeniski held that SaskPower's access agreement was too broad, however, since it failed to take into account employees genuine privacy rights and recommended that SaskPower revise the agreement by:

  •  deleting the statement that users have no expectation of privacy;
  •  inserting a statement that employee use of the system may be monitored if SaskPower believes on reasonable grounds that a user is violating its policies and standards;
  •  inserting a statement that any collection, use and/or disclosure of personal information would be done in compliance with the Freedom of Information and Privacy Act and
  •  inserting a statement that users may contact SaskPower’s privacy officer if they have any questions regarding the collection, use and/or disclosure of their personal information.

An employer gathering information on how an employee uses a work computer can be highly intrusive, Kruzeniski said, and should not be the first or only method an employer uses in human resources management. In addition, employers must have a reasonable basis for believing an employee’s computer use may be noncompliant with workplace policies and standards before initiating an investigation.

To contact the reporter on this story: Jeremy Hainsworth in Vancouver at

To contact the editor responsible for this story: Rick Vollmar at

For More Information

For more information on Saskatchewan HR law and regulation, see the Saskatchewan primer.

Copyright © 2016 The Bureau of National Affairs, Inc. All Rights Reserved.