Employee tracking apps raise worker privacy questions

A California woman is suing her former employer for more than $500,000 US after the company allegedly fired her for refusing to allow it to track her whereabouts around the clock.

In the American case, Intermex asked Myrna Arias to download Xora, a tracking app, on her company phone and keep it on "24/7," she claims in a lawsuit filed May 5 and first reported by the technology site Ars Technica.

Her employer admitted to monitoring off-duty employees and "bragged that he knew how fast she was driving at specific moments," the lawsuit alleges. Arias complained to her boss that it was illegal and uninstalled the app, which she compared to "a prisoner's ankle bracelet," less than a month later. Intermex fired Arias shortly afterwards.

• Read the Arias lawsuit at the bottom of this story

Employees have a fundamental right to privacy before and after work, says Gail A. Glick, one of the attorneys representing Arias.

"It's a case about maintaining boundaries between an employer and its employees," she says.

Employee consent somewhat 'fiction'

Privacy issues with employer tracking devices are increasingly coming to the fore, says David Fraser, partner at McInnes Cooper and a privacy law expert. 

Previously, tracking technology cost tens of thousands of dollars and was mostly used by big shipping companies to locate trucks and monitor safe driving, he says. Now, the technology is smaller, cheaper and often only requires a smartphone.

Not all surveillance and monitoring technologies are malicious or sneaky.- Kirsten Thompson, lawyer

There are apps that generate screenshots of staff computers at specific intervals, calculate the amount of time people use the phone or, like Xora, enable GPS to track employee whereabouts.

Canada's privacy laws afford employers the right to monitor their workforce under certain circumstances, says Kirsten Thompson, the co-lead of McCarthy Tétrault law firm's national cyber security, privacy and data protection group.

A company must have a good reason that is connected to its business dealings. 

"Not all surveillance and monitoring technologies are malicious or sneaky," she says. A company may, for example, track oil field inspectors working in remote areas for safety reasons. Shell oilsands workers carry trackers to help record efficiency and improve safety.

When companies decide to use such technology, they must have consent from their employees, who must understand what is being tracked and for what reason, she says. All companies should have a clear, easily available privacy policy that outlines their justification.

In an employer-employee relationship, that kind of consent "is a little bit of a fiction," says Fraser. Employees don't really have much of an opportunity to say no.

If the employee tracking is considered a reasonable invasion of privacy and a reasonable work condition, such as for drivers who need to be dispatched to the closest available job, he says, "then they can't really say no if they want to keep that job."

'Dim view' of monitoring outside of work

Still, they must at the very least be aware that their activities or movements are being followed.

The District of Saanich in Victoria, B.C., used a program called Spector 360 to monitor their employees' computer activities, including keystroke logging and taking timed screenshots.

I can certainly imagine in five or 10 years we'll probably see some cases like this.- David Fraser, lawyer

In March, the Office of the Information and Privacy Commissioner for B.C. determined the district violated the Freedom of Information and Protection of Privacy Act (FIPPA) by collecting "personal information in keystroke logs, screenshots, program activity logs, email and user logon information." It also did not give employees adequate notice about the tracking, the ruling read.

"There was no notice. There was no consent. There were no privacy policies in place," says Thompson, adding the district had little business rationale for using the software in the first place.

A "rare circumstance" where that might be permissible could be if the company holds high-value intellectual property or trade secrets, or if it has a reasonable suspicion of an internal threat to its cyber security, she says.

Difficult to justify

Other Canadian case law suggests it would also be difficult to justify tracking employees outside of work hours.

B.C. information and privacy commissioner Elizabeth Denham "takes kind of a dim view" of this practice, says Thompson, because it often lacks a strong business reason.

In December 2012, Denham ruled that it was okay for a company to track its service vehicles to help effectively dispatch them to jobs. She wrote that her decision was "particularly influenced" by intermittent monitoring practices.

"If an organization were to engage in continuous, real-time monitoring of employees' whereabouts, during or outside work hours, for employment management purposes, I would want to look very carefully at the situation," wrote Denham.

A company could argue that what its employees do outside of work can negatively impact their reputation, says Fraser.

"If I was a big telecom company and my employee is in a big van with my logo on the side of it, I might not want that parked in a strip joint parking lot on a Tuesday at lunch time."

Employees would have to be aware that the monitoring is taking place beyond their shift, he says, and that the information gathered could be used to discipline them.

Still, Fraser speculates that if a case similar to the Arias one appeared in Canada, the company would be told to "knock it off."

"I can certainly imagine in five or 10 years we'll probably see some cases like this," he says, adding workers wouldn't get "a jackpot" but could be entitled to some damages.

The Arias case will go to trial next summer at the earliest, her lawyer says, unless the parties reach an out-of-court settlement beforehand or the case is dismissed.