Federally regulated trucking companies in Canada have been obliged to abide by the Personal Information Protection and Electronic Documents Act (PIPEDA) for the past three years. Since 2001, the Act has applied to any business or organization that’s governed by the Canada Labour Code and collects and discloses personal information about its employees.

But only since Jan. 1, 2004, when PIPEDA stretched to cover most provincially regulated companies, did the average Canadian worker begin paying attention to who knows what about him. (B.C., Alberta, and Quebec are exempt from PIPEDA because they have enacted similar provincial legislation.) In essence, PIPEDA is about employee consent, and it regulates how personal information–either factual or subjective, recorded or not–is collected, stored, and distributed to third parties.

This includes but is not limited to age, worker ID numbers, ethnicity, health, wages, work performance, disciplinary reviews, and details about dependents or beneficiaries. It’s simpler to state what’s not subject to the law: standard business-card info–a person’s name, title, and company contact numbers. Contravention can result in a court date and fines from $10,000 to $100,000.

PIPEDA is especially pertinent to truck fleets, which by law must keep extensive records about their drivers and other workers. Many motor carriers are only now coming to terms with the legislation in part, according to Laura Williams, an expert in privacy law and an attorney with Crawford, Chondon & Andree LLP, because no company has been audited for compliance yet.

Most employers find out about PIPEDA the hard way.

“The (legislation) is basically complaints-driven. (Cases) will be based on individuals’ perceptions of how their personal information should be handled by their employers,” Williams told members of the Private Motor Truck Council at a seminar in March. “Individuals believe they own their personal information, and they’ve become quite sensitive to how it is used.”

Moreover, PIPEDA is still in its infancy, bureaucratically speaking. The law will evolve and interpretations will become more clear through individual challenges to the Privacy Commissioner.

“There’s much to be defined,” Williams told Today’s Trucking. “There’s still a fair bit of adjudication that has to take place to really crystallize how the Act will apply and what the parameters are.”

In the meantime, employers have to follow the rules as written. The first step, says Williams, is to designate one person or a team of people to draft, implement, and manage a company-wide PIPEDA compliance policy, an obligation under the Act. But be aware, she warns, that liability for non-compliance rests with the employer. “As a (company owner) you can’t just appoint someone to take care of it and then leave him or her out to dry if something goes wrong.”

The cornerstone of a solid PIPEDA compliance program is to ensure that: a) you’re open about why you’re collecting personal information and how it may be disclosed; and b) the company always receives consent for the collection and disclosure. Typically, this is expressed in writing, but there are times where it can be implied. A potential employee who fills out a job application, for example, is implying consent for the purposes of the job-seeking process, says Williams.

Consent is not a green light to disclose information “for any purpose that a reasonable person would not consider appropriate, even where consent has been given,” Williams says. The definition of “reasonable person” is for the Privacy Commissioner to decide on a case-by-case basis.

The law also regulates how a company must store or safeguard personal information. Physical access restrictions, secure office equipment, “need-to-know” policies, and safeguards for computer files must all be implemented.

The idea behind PIPEDA is to protect employees by regulating how information about them is disclosed to third parties. In this capacity, employers are responsible for ensuring compliance of third parties such as training schools or driver employment services. If you disclose employee information to another company, Williams recommends that you make sure it too complies with PIPEDA.

The rule also requires companies to give employees access to any of their personal information within 30 days’ notice and to have a system in place that allows workers to challenge information they perceive to be incorrect.

Hundreds of PIPEDA cases have been ruled on over the last few years; details are online at www.privcom.gc.ca (you can also download the Act). Cases 179 and 228, for example, involve trucking companies over issues dealing with safeguarding information and allowing a former employee access to his personal information.

Businesses can also get a sense of how PIPEDA is responding to a whole range of other privacy-related situations in the workplace. Rulings on individual cases provide new direction on limits regarding the use of surveillance cameras and private investigators. There also are indications that PIPEDA’s reach may overlap existing regulations such as drug testing for truck drivers. Williams says some cases currently before the Privacy Commissioner do deal with drug tests and the disclosure of results, although it’s too early to tell if future decisions will alter current drug testing requirements for cross-border drivers under U.S. law.

“The (drug testing criteria) is exposed under the Act,” warns Williams. She says PIPEDA will act as an overlay to a whole host of rules–the full reach of which has yet to be determined.