The District of Saanich violated employees’ privacy rights when it installed employee monitoring software, B.C.’s information and privacy commissioner has found.
"The district can only collect personal information that is directly related to and necessary for the protection of IT systems and infrastructure,” said Elizabeth Denham in a release.
“An employee's every keystroke and email, or screen captures of computing activities at 30-second intervals clearly exceeds that purpose and is not authorized by privacy law."
The way the software was being used could have led to collection of data about website searches, online banking transactions and personal messages, according to Denham.
The Office of the Information and Privacy Commissioner launched its investigation after the Mayor of Saanich, Richard Atwell, claimed that the district had violated his privacy by installing the software on his work computer. Atwell had also accused the Saanich police of harassment and admitted he’d lied about having an affair with a campaign worker.
Atwell had refused to use his work computer until the software was removed.
Denham is recommending the district disable several features of the monitoring software, including keystroke logging, automated screenshots and continuous tracking of computer program activity. She is also recommending the district destroys any information it has already collected.
In her report, Denham said that previous statements made by the District of Saanich that “employees do not have a reasonable expectation of privacy at work” are inaccurate. The report notes that while the monitoring software, Spector 360, was installed in response to an IT audit, the audit never recommended installing monitoring software.
She has also recommended the district hire a privacy officer and put in place privacy management policies.
"One of the most disappointing findings in my investigation is the district's near-complete lack of awareness and understanding of the privacy provisions of B.C.'s Freedom of Information and Protection of Privacy Act,” Denham said.
