Understanding notice and consent
There’s a popular issue on Vancouver island regarding the new mayor of Saanich, Richard Atwell. Most of the media attention I’ve chosen to ignore, as I don’t want to live in a Jerry Springer type world, gossiping about people. What matters is ideas, and policies.
One of the issues that Mr. Atwell officially announced yesterday, is that IT staff from the City of Saanich have been monitoring him using software called Spectre360, and more importantly that he didn’t consent to it monitoring him. A lot of media asked me for details about the software, but I stated it doesn’t have much relevance; what matters from a privacy law perspective, is notice and consent.
As I mentioned on CHEK News and in the Victoria Times-Colonist, the important question to ask from a privacy law perspective is:
- Was he given notice? Did he consent to being monitored?
A couple other questions that I feel should also be asked, while the issue is being investigated:
- What specifically is Sectre360 configured to record? Access to pornography websites is one thing, logging every keystroke is another.
- Was he targeted for his monitoring as part of an investigation, or did it apply to all employees?
- Who has access to these monitoring logs (including backups), and under what conditions can they be accessed? Is access to these logs also logged?
The last questions are relevant, as there is evidence information is being leaked to the media. I personally was made aware of the issue by multiple sources before it was announced, so I believe this to be true. It’s likely also worth asking, who is leaking these stories, and why. Mr. Atwell also alleges that there may be a leak from within Saanich police department.
It’s been noted since yesterday’s media flurry, Mr. Atwell was in attendance in December when Saanich city council approved the use of Spectre360. This in itself might not be considered notice, as there are a lot of different things this software can monitor, and I’m not aware that notice had been given or consent had been obtained in regards to what this software is recording.
If you’re curious, you’re entitled to ask your employer’s privacy officer if they’re monitoring any of your activities, the purpose for collecting it, and the legal authority for collecting it.
Section 27(2) of BC FIPPA reads:
A public body must ensure that an individual from whom it collects personal information is told (a) the purpose for collecting it, (b) the legal authority for collecting it, and (c) the title, business address and business telephone number of an officer or employee of the public body who can answer the individual's questions about the collection.
If you’re an employer for the public sector who is curious about how this may apply to you, the B.C. Office of the CIO has provided this tip sheet on the notification for collection [PDF].
The Freedom of Information and Protection of Privacy Act (BC FIPPA) applies to all records in the custody or under the control of a public body (with several exceptions). If you’re in the private sector, you’ll want to check out the Personal Information Protection Act (BC PIPA) instead.
From a criminal law perspective, we’d want to ask, also related to if notice or consent was given, was there a “reasonable expectation of privacy”? Section VI of the criminal code of Canada talks about the invasion of privacy. See section 183 and 184 of section VI:
Interception of Communications s. 183. "private communication” means any oral communication, or any telecommunication, that is made by an originator who is in Canada or is intended by the originator to be received by a person who is in Canada and that is made under circumstances in which it is reasonable for the originator to expect that it will not be intercepted by any person other than the person intended by the originator to receive it, and includes any radio-based telephone communication that is treated electronically or otherwise for the purpose of preventing intelligible reception by any person other than the person intended by the originator to receive it; Interception 184. (1) Everyone who, by means of any electro-magnetic, acoustic, mechanical or other device, willfully intercepts a private communication is guilty of an indictable offence and liable to imprisonment for a term not exceeding five years. Saving provision (2) Subsection (1) does not apply to (a) a person who has the consent to intercept, express or implied, of the originator of the private communication or of the person intended by the originator thereof to receive it;
So in summary, there is one question to be answered from a privacy law perspective, that will answer a lot of the other related concerns; was notice given, or did Mr. Atwell consent to being monitored?
I’m not a lawyer, so this is not legal advice. Thanks for reading.
Need this translated for your organization? PrivaSecTech offers confidential briefings, policy reviews, workshops, and privacy/security advisory for teams that need to decide what to do next.
