School custodian refuses to download phone app that monitors location, says it got her fired
Increase in 'tattleware' a slippery slope for loss of workers’ privacy, employment lawyer warns
Michelle Dionne was excited about her new job, helping to prevent the spread of COVID-19 by doing extra cleaning in an elementary school in Darwell, Alta. — about 85 kilometres west of Edmonton.
But last October, after being on the job for about six weeks, her boss at the cleaning company sent out a companywide message — telling employees to download an app on their personal phones that would check their location and ensure they were working their scheduled hours.
Dionne found the request offensive and refused.
"I was at the school working so that I could provide for my son," she told Go Public. "We're not thieves. We don't need an ankle monitor."
Less than two months later, the single mom was fired — her refusal to download the app was mentioned in her letter of termination.
- Got a story for Go Public? Contact Erica and the Go Public team
Other Canadians have been asked to download software that helps employers remotely monitor their productivity — such as phone apps that register an employee's location via GPS, and software that monitors the activity of their computer mouse. Others have tracking devices in their vehicles.
It's prompting some employment lawyers Go Public consulted to sound the alarm.
"Tracking of employees … is the beginning of a cautionary tale that might take us to a place we don't really want to go," said Toronto employment lawyer Soma Ray-Ellis.
"We need to take a pause … before we go down some path of being tracked all day, every day, wherever we are."
'Everybody install this app'
Dionne says she was thrilled to get the job last fall — responsible for things like disinfecting door handles, light switches and bathrooms to prevent possible spread of the coronavirus.
"With the pandemic going on, I felt like I was an important part of the team," she said. "I was complimented [by her employer and school authorities] for doing such a good job."
When her boss told her to download the app, Dionne says she was concerned about her privacy. The app would go on her personal phone and, she says, her boss didn't clearly explain how it worked or what would happen to any data it collected.
"It was just a blanket statement — 'Everybody install this app on their phone. This is how we're doing things from now on,'" said Dionne.
The app, called Blip, generates a geofence — a virtual boundary, created by the employer using GPS — that detects when an employee enters or leaves. The app registers a signal from the worker's cell phone, when their "locations" setting is turned on, so the boss can tell whether an employee is on site and how many hours that person works. It only registers an employee's location when they enter and exit the geofence and doesn't track their specific movements.
WATCH | Custodian who refused to download tracking app was later fired:
It's not clear where that data is stored, or whether any other employee information might be included.
Go Public reached out to the maker of the app, U.K.-based BrightHR. Spokesperson Natalie Shallow said, although the app collects data, that data "belongs to the customer organization" — meaning, the company using the app — and therefore is subject to the company's own policies.
The data's protection "complies with all applicable laws, including Alberta's Personal Information Protection Act," Shallow said.
Dionne worried about where the information might end up. She knew apps like Instagram, Facebook and others had been breached. She says no one told her how securely the information would be protected.
Location, location, location
Companies that make similar apps — such as ActivTrak, Teramind and Hubstaff — have told CBC News they've seen a spike in customer inquiries, but didn't provide Canadian numbers.
BrightHR says it has more than 60,000 small business customers worldwide and that Blip use "has increased exponentially over the last two years."
The increase is raising questions about what is, or isn't, personal information.
According to Alberta's privacy legislation, a worker's location is considered personal information when it's collected to manage that employee.
In B.C. — which has similar privacy laws — a 2013 case before the Office of the Information and Privacy Commissioner similarly found that a company was using employee personal information when it relied on GPS-enabled cell phones to, in part, "confirm employee attendance and to otherwise manage relationships with its employees."
When is consent truly consent?
Ray-Ellis says just because an employee downloads an app when asked by the boss, it doesn't mean they're giving informed consent. Employers need to know how any data collected will be stored, shared or used — and that information must be clearly explained during proper training about the new software.
"The employer should be explaining what the app is for," said Ray-Ellis. "Who has access to it? Is the data being stored in a secure manner? Is the data being tracked in real time? And what is the real purpose?"
Toronto employment lawyer Lior Samfiru told Go Public that employers can compel employees to download an app on their cell phone — but only if they're told it's a requirement when they are hired.
Otherwise, refusing to download it "would not be considered misconduct."
However, Samfiru added, an employer can let an employee go "for pretty much any reason" as long as any severance that is owed is paid out.
One of the biggest concerns about tattleware, says Ray-Ellis, is employers often don't know enough about how data will be used — making informed consent difficult.
"Employers … should understand where that data is going," she said. "Is there a third party that has access to it? Is it migrating to a foreign jurisdiction?"
Dionne's former boss admits she didn't know where the data generated by Blip would be stored when she introduced the app to her workforce last fall.
"I never asked that question and it never came up in my mind to ask," said Hanan Yehia, founder and owner of H.Y. Cleaning Services, which operates cleaning services for eight locations in northern Alberta.
She says after Dionne raised concerns, she went back to BrightHR for more information and was told employees' movements within the geofence are not specifically monitored. Yehia says she shared that information with Dionne.
The app was a solution to a problem, says Yehia — she was looking for a way to simplify payroll by easily tracking hours and making sure employees who claimed they were working were actually on the job.
"We had some issues in some locations where they would say they were on site, that they were working, but they weren't," she said, clarifying that attendance was not an issue with Dionne. She also says Dionne's refusal to download the app wasn't the sole reason she was fired.
Ray-Ellis argues that using such apps should be a last resort to avoid any breach of privacy legislation.
"If there's any other mechanism, I would certainly advise my employer clients to think of other ways of tracking their employees first," she said.
WATCH | When 'tattleware' goes to court:
Dionne said she's worked other places that used a timecard punch-in for tracking hours and was happy to do that.
"You leave at the end of the day, the card stays there. But this was my [personal] phone," she said.
'Reasonable opportunity'
All provinces and territories have legislation that regulates the collection, use and disclosure of personal information in the public sector, but when it comes to the private sector only B.C., Alberta and Quebec have similar legislation.
H.Y. Cleaning Services must abide by Alberta's Personal Information Protection Act (PIPA). It states companies may collect personal employee information for "reasonable purposes related to recruiting, managing or terminating personnel" as long as "reasonable notice" is provided and employees are told why the information is going to be collected.
It also states that an organization "must give the person a reasonable opportunity to decline his or her consent."
"I don't think it was an option," said Dionne. "I don't think it was, because it led to my termination."
Concerns about what companies can do with the personal data they collect on employees partly prompted the government to launch Canada's Digital Charter and Implementation Act last fall.
Once implemented — not expected any time soon, it's in second reading — it will "modernize the framework for the protection of personal information in the private sector."
Even then, Ray-Ellis doesn't think the charter goes far enough with certain employee protections, such as "what they are protected from and … when can they refuse their consent."
"We are giving away a lot of our privacy rights without even realizing what we're giving up," she said. "Before it's too late and we go down some slippery slope, it's time that we looked at this."
Dionne says it was a blow to be fired, but the experience has a silver lining.
She now wants to learn how to help other employees who feel they weren't treated right, either.
"I'm going back to school," said Dionne. "I'm thinking of going into law."
ABOUT THE AUTHOR
With files from Kimberly Ivany