As many CUPE activists know, privacy rights continue to be an important issue in our workplaces. CUPE is actively defending our members’ privacy rights at work, and we recently won an important arbitration decision.
A member working as a dietary aide with two different long-term care employers in Ontario needed an accommodation at one of the two locations. Management from the two facilities got in touch with each other, and ultimately one manager emailed a doctor’s note that the worker had submitted to the manager at the other employer. The worker was not consulted about the sharing of her private medical information, and did not give consent.
In this case, the collective agreement included a definition of personal harassment, and the arbitrator agreed with CUPE that sharing the doctor’s note without the worker’s permission was personal harassment and a breach of the collective agreement. The arbitrator understood that the workplace was supposed to be respectful, and the importance of preserving workers’ dignity. She decided that sharing the worker’s medical information without permission was disrespectful and offensive.
When the employer breached the member’s privacy and personally harassed her, it also breached Ontario’s Occupational Health and Safety Act. Section 63 of that Act says that when an employer gets custody of employee medical information, they must treat that information as confidential, and employers are prohibited from trying to get access to a worker’s medical records without the worker’s permission, unless they have an order from an arbitrator or a court.
The employer also breached the worker’s privacy rights under common law. The courts have found that it is a breach of the law for one person to intentionally, and with no “lawful justification” invade the private affairs or concerns of another person if a reasonable person would regard the invasion as “highly offensive” and causing distress, humiliation and anguish. The arbitrator said that when they shared the member’s doctor’s note without her consent, the employer broke the bond of trust that requires an employer to safeguard private medical information that it has received.
For these breaches, the arbitrator decided that the worker was entitled to damages of $1,000. The amount is five per cent of the maximum award for breaching privacy rights set out by the Ontario Court of Appeal. The arbitrator wanted to make clear that there were consequences for the employer’s wrongdoing. She also took into consideration that the employer had a privacy policy which was supposed to protect both residents and employees, but hadn’t done anything to make sure their contractors lived up to that policy, even after they found out what the manager had done.