Artificial intelligence in the workplace

Artificial Intelligence (“AI”) has now become a mainstay in all workplaces. AI is not only transforming the way that we work but also the way that we manage, monitor, and assess employees in the workplace.

The use of AI in the assessment of employees comes with myriad difficulties because of the biases that can creep into the utilized software. This paper will consider the utilization of AI to monitor employees in the workplace. This utilization creates tension with privacy obligations and is leading to a minefield of potential issues for employers. AI enables the collection of vast amounts of data, and the collection, storage and retention of that data is subject to the requirements of privacy legislation.

In British Columbia, the collection, use and disclosure of personal information by organizations, including employers, is governed by the Personal Information Protection Act (PIPA) or the Freedom of Information and Protection of Privacy Act (FIPPA) for public bodies. Both statutes protect the ability of individuals to control their personal information by imposing restrictions on its collection, use and disclosure.

Personal information is defined broadly to be any identifiable information about an individual.  The Office of the Privacy Commissioner, which is responsible for ensuring compliance with privacy legislation and our Courts, interprets the definition of personal information broadly and the right to privacy has been recognized as a quasi-constitutional right. 

AI has been used in a variety of iterations to manage and monitor employees, from GPS monitoring, key stroke and screen time tracking, video surveillance and biometric monitoring.  Utilization of AI in the management and monitoring of employees exploded with the significant changes to our workplaces following the COVID 19 pandemic. The move to remote work led to employers finding ways to monitor and manage offsite work. The utilization of any of these technologies results in the collection, use, and disclosure of personal information, and engages the requirements imposed by privacy legislation.

Part of the tension with respect to privacy in workplaces relates to the ability of an organization to collect, use, and disclose personal information without consent if it is reasonable for the purposes of establishing, managing or terminating the employee relationship, and if the individual is notified of the collection, use and disclosure and its purposes before it occurs. This engages the reasonable person standard with respect to the information that is being collected. What would a reasonable person deem appropriate in the circumstances? The factors considered in assessing reasonableness include:

1. the sensitivity and amount of information collected or used;
2. the likelihood of its effectiveness;
3. the manner of collection;
4. the availability of less intrusive alternatives; and
5. the potential offense to the employees’ dignity.[i]

Additional factors used to assess reasonableness include whether a legitimate issue exists, whether there is a direct link between the monitoring and the issue, and whether the implementation is reasonable.[ii] The greater the sensitivity of the data and the extent of collection, the greater the scrutiny that will be applied to the collection of the data.

Monitoring of employees in the workplace broadly fits into two buckets – covert and overt.  Covert, or secret surveillance or monitoring is much more difficult to justify in a privacy analysis. Covert monitoring is conducted without an employee’s knowledge and is subject to a very high threshold for justification. The higher standard is imposed because it is considered highly offensive to a reasonable person and is a more egregious violation of privacy.

For covert surveillance to be justified, there must be a substantial problem, a strong possibility that surveillance will be effective and no reasonable alternative to surreptitious surveillance. The onus is on the employer to demonstrate a substantial problem, a strong probability that surveillance will assist in solving the problem, the exhaustion of reasonable alternatives and that the surveillance is conducted systematically and non-discriminatory.

The Office of the Information and Privacy Commission for British Columbia in January 2015 issued in part the following press release with respect to the use of covert surveillance:

“The second type of monitoring is covert, which is done without an employee’s knowledge.  This type of monitoring could take the form of tracking Internet use, logging keystrokes, or taking screen captures at set intervals as part of ongoing monitoring.  The threshold for covert monitoring is very high, and may be part of a specific workplace investigation once all other less intrusive measures have been exhausted.

Decisions about whether employee monitoring is authorized under privacy law are context-specific and will depend on the circumstances of each case.  That being said, there have been no cases brought before this Office where covert monitoring was found to be justified under privacy law.”

That remains the case today. In a search of OIPC decisions since January 2015, there have been three which considered covert monitoring. All three found the monitoring to be unreasonable in the circumstances.

The reasonableness of overt employee monitoring is assessed within the context of the reasonableness factors noted above. For overt employee monitoring to be found by the OIPC to be reasonable, there must be:

• an identified purpose for the monitoring
• demonstration that the monitoring that is being conducted fulfills the purpose for the monitoring
• demonstration that other less invasive means of monitoring had been considered and found to be inadequate either in terms of fulfilling the purpose or not practicable for some other reason.
• reasonable notification of the monitoring has been provided
• the data that results from the monitoring is not overly broad, but rather satisfies the purpose for which the monitoring has been conducted.

An example of the analysis conducted by the OIPC in determining reasonableness of monitoring is Canadian Forest Products Ltd. (Plateau Sawmill Division) v. United Steelworkers Local 1-2017[iii]. Canfor installed a new biometric technology that took a fingerprint scan for timekeeping purposes. The scan was utilized to not just to track time, but also to track attendance at work and improve accuracy and operational efficiency.

The union did not like the installation of the biometric finger scan and grieved its implementation, citing privacy concerns under PIPA. The biometric system collected an encrypted mathematical representation of the fingertip rather than storing the original fingerprint image. The collected image could not be reverse engineered to create an actual fingerprint. Canfor had considered and rejected alternative timekeeping methods, such as swipe cards. Canfor said these alternatives were ineffective due to concerns about “buddy punching” and associated costs. Canfor provided advance notice to both the union and the employees about the new system.

The arbitrator found that the biometric fingerprint scan was a reasonable intrusion into privacy and authorized under PIPA. The factors considered by the arbitrator in making this determination included a consideration of the sensitivity and amount of information that was collected, the likelihood of the system’s effectiveness, the manner of collection, the availability of less intrusive alternatives and the potential offense to employee dignity.

The arbitrator found that while the acquisition of a fingertip image might be considered highly sensitive information, that information became significantly less sensitive because the original fingerprint image was not stored and could not be reconstructed. The arbitrator found that the employer’s purpose for the system was legitimate and that the system itself was minimally invasive due to the security and processing of the biometric data.

An example of the reasoning for finding that overt surveillance is unreasonable can be found in the decision of Rehn Enterprises Ltd. v. United Steelworkers Union, Local 1-1937[iv]. This case concerned video and audio surveillance cameras in company vehicles. Rehn was a falling contractor for Western Forest Products. Its fallers would travel to and from the cut block in company vehicles. The travel time was between two and three hours per day and fallers were paid for travel time. 

The camera that was at issue was installed in the interior of the vehicle. This camera also had a GPS system. The camera tracked data such as vehicle speed, following distance, vehicle location and route. Rehn said that the purpose of the interior camera was to capture road conditions not seen in the exterior cameras, monitor distractions in the cab such as eating, smoking, texting, and horseplay as well as distractions such as loud music, arguments in the vehicle, improper radio use, radio usage and potential auditory distractions to the driver. The interior camera was continuously recording while the vehicle was in motion and all information collected by the camera was uploaded to a cloud-based platform and stored for a period of time prior to it being overwritten. 

Not all of the recorded data was viewed by Rehn management or supervisors, rather they utilized an AI program to generate safety alerts based on road safety criterion that was set by Rehn. The road safety criterion included drivers use of a cell phone, not wearing a seatbelt, speeding, following too closely, harsh breaking, collisions, near misses, hard turns and blocking the camera. If the AI program generated an Event Warning, further information is obtained such as vehicle location, vehicle speed, posted speed limit and a picture of the embedded video.

The union argued that the interior audio and video camera was an unreasonable invasion of an employee’s privacy. The arbitrator agreed. Key aspects of the decision included the fact that the camera was used during travel time when employees were not actively “working” and may be engaged in personal activities. Because of this, the monitoring and resulting data was found to be highly intrusive. 

Rehn had also not considered less intrusive alternatives such as seatbelt reminders prior to implementing the technology. The information that was obtained was also considered to be beyond the scope of managing the employment relationship and therefore would have required specific consent for its collection. Also noted was that the employer had failed to provide sufficient notice to employees prior to installing the dash cameras.

These two decisions demonstrate the balance that is applied in determining whether any monitoring is reasonable. While employers have a right to manage employees and that right may, in appropriate circumstances, extend to monitoring in some form or another, that right is not absolute. It must be exercised reasonably. To be reasonable it has to have a purpose, the data collected must achieve that purpose, the employer must be collecting no more information that is necessary, the employer must have considered less intrusive alternatives, and reasonable notice must be given to employees that the monitoring will be conducted.