TORONTO, — While it’s applied to federally-regulated companies since 2001, only as of Jan. 1, this year — when the Personal Information Protection and Electronic Documents Act (PIPEDA) stretched to cover most provincially regulated companies — did the average Canadian worker begin paying attention to who knows what about him.

In essence, PIPEDA is about employee consent, and it regulates how personal information — either factual or subjective, recorded or not — is collected, stored, and distributed to third parties. This includes but is not limited to age, worker ID numbers, ethnicity, health, wages, work performance, disciplinary reviews, and details about dependents or beneficiaries. It’s simpler to state what’s not subject to the law: standard business-card info — a person’s name, title, and company contact numbers.

PIPEDA is especially pertinent to truck fleets, which by law must keep extensive records about their drivers and other workers. Many motor carriers are only now coming to terms with the legislation in part, according to Laura Williams, an expert in privacy law and an attorney with Crawford, Chondon & Andree LLP, because no company has been audited for compliance yet. Most employers find out about PIPEDA the hard way.

“The (legislation) is basically complaints-driven. (Cases) will be based on individuals’ perceptions of how their personal information should be handled by their employers,” Williams told members of the Private Motor Truck Council at a seminar in March. “Individuals believe they own their personal information, and they’ve become quite sensitive to how it is used.”

Moreover, PIPEDA is still in its infancy, bureaucratically speaking. The law will evolve and interpretations will become more clear through individual challenges to the Privacy Commissioner. “There’s much to be defined,” Williams told Today’s Trucking. “There’s still a fair bit of adjudication that has to take place to really crystallize how the Act will apply and what the parameters are.”

In the meantime, employers have to follow the rules as written. The first step, says Williams, is to designate one person or a team of people to draft, implement, and manage a company-wide PIPEDA compliance policy, an obligation under the Act. But be aware, she warns, that liability for non-compliance rests with the employer. “As a [company owner] you can’t just appoint someone to take care of it and then leave him or her out to dry if something goes wrong.”

The cornerstone of a solid PIPEDA compliance program is to ensure that: a) you’re open about why you’re collecting personal information and how it may be disclosed; and b) the company always receives consent for the collection and disclosure. Typically, this is expressed in writing, but there are times where it can be implied.

The idea behind PIPEDA is to protect employees by regulating how information about them is disclosed to third parties. In this capacity, employers are responsible for ensuring compliance of third parties such as training schools or driver employment services. If you disclose employee information to another company, Williams recommends that you make sure it too complies with PIPEDA.

At the Privacy Commissioner’s website (www.privcom.gc.ca), businesses can get a sense of how PIPEDA is responding to a whole range of other privacy-related situations in the workplace. Rulings on individual cases provide new direction on limits regarding the use of surveillance cameras and private investigators. There also are indications that PIPEDA’s reach may overlap existing regulations such as drug testing for truck drivers. Williams says some cases currently before the Privacy Commissioner do deal with drug tests and the disclosure of results, although it’s too early to tell if future decisions will alter current drug testing requirements for cross-border drivers under U.S. law.

“The [drug testing criteria] is exposed under the Act,” warns Williams. She says PIPEDA will act as an overlay to a whole host of rules-the full reach of which has yet to be determined.