Skip to Content

Calgary Police Service breach privacy statute by accessing employee's personal email account, using photos

Jurisdiction: - Alberta

Here is April 30, 2012 news release that was issued by the Alberta Office of the Information and Privacy Commissioner in relation to Order F2012-07, which was issued on April 20, 2012:

Calgary Police Service in contravention of Freedom of Information and Protection of Privacy Act

An Adjudicator with the Office of the Information and Privacy Commissioner has determined that the Calgary Police Service was in violation of the Freedom of Information and Protection of Privacy Act (FOIP) when it accessed the personal email account of an individual.

The individual was a civilian employee of the Public Body and several of her coworkers had made complaints about her behavior at work, including allegations of inappropriate sexual conduct. As a result, the Public Body initiated a workplace investigation and started to monitor the Complainant's computer activities. While reviewing her work email, the IT Security Manager came across an email that contained the Complainant's login ID and password information for her personal web-based email. The Manager then accessed her personal email account and discovered photographs of a sexual nature, which appeared to have been taken on the Public Body's premises. The Manager copied the photos and turned them over to the Complainant's manager and a Human Resources consultant. The photos were used as part of the decision to terminate the Complainant's employment.

Adjudicator Amanda Swanek ruled that the Public Body's use of the Complainant's personal email login ID and password was not for the purpose of employee management, since the IT Manager had not been requested to monitor personal email accounts, and there was no evidence of wrongdoing that would justify the access of a personal email account. The Adjudicator also found that logging in to the Complainant's personal web-based email account was exceptionally invasive, and patently unreasonable in the circumstances. She determined that the collection and use of the Complainant's photographs from her personal email account could not be justified as "necessary" for the purpose of the Public Body's investigation, as they were found as a result of an unauthorized use of the Complainant's personal information. Swanek ordered the Public Body to stop collecting and using the Complainant's personal information and added a condition that employees should be given training on the collection and use of personal information in the course of investigating employment and personnel matters.