Turner v. Telus Communications Inc.

Turner v. Telus Communications Inc.
Court (s) Database
Federal Court Decisions
Date
2005-11-29
Neutral citation
2005 FC 1601
File numbers
T-1862-04, T-1863-04, T-1864-04, T-1865-04
Notes
Digest
Decision Content
Date: 20051129
Docket: T-1865-04
Citation: 2005 FC 1601
BETWEEN:
RANDY TURNER AND
THE TELECOMMUNICATIONS WORKERS UNION
Applicants
AND
TELUS COMMUNICATIONS INC.
Respondent
AND
THE PRIVACY COMMISSIONER OF CANADA
Added Respondent
T-1864-04
BETWEEN:
PAUL BERNAT AND
THE TELECOMMUNICATIONS WORKERS UNION
Applicants
AND
TELUS COMMUNICATIONS INC.
Respondent
AND
THE PRIVACY COMMISSIONER OF CANADA
Added Respondent
T-1863-04
BETWEEN
HENRY FENSKE AND
THE TELECOMMUNICATIONS WORKERS UNION
Applicants
AND
TELUS COMMUNICATIONS INC.
Respondent
AND
THE PRIVACY COMMISSIONER OF CANADA
Added Respondent
T-1862-04
BETWEEN:
PAUL WANSINK AND
THE TELECOMMUNICATIONS WORKERS UNION
Applicants
AND
TELUS COMMUNICATIONS INC.
Respondent
AND
THE PRIVACY COMMISSIONER OF CANADA
Added Respondent
REASONS FOR ORDER
GIBSON J.
INTRODUCTION
[1] By applications filed the 15th of October 2004, Paul Wansink, Henry Fenske, Paul Bernat and Randy Turner, each together with The Telecommunications Workers Union, sought a hearing or hearings in respect of the subject matter of complaints made by them to the Privacy Commissioner (the "Commissioner") that were responded to by the Commissioner by letters dated the 3rd of September, 2004. The applications were filed pursuant to subsection 14(1) of the Personal Information Protection and Electronic Documents Act ("PIPEDA")[1]. Subsection 14(1) of PIPEDA reads as follows:
14. (1) A complainant may, after receiving the Commissioner's report, apply to the Court for a hearing in respect of any matter in respect of which the complaint was made, or that is referred to in the Commissioner's report, and that is referred to in clause 4.1.3, 4.2, 4.3.3, 4.4, 4.6, 4.7 or 4.8 of Schedule 1, in clause 4.3, 4.5 or 4.9 of that Schedule as modified or clarified by Division 1, in subsection 5(3) or 8(6) or (7) or in section 10.
14. (1) Après avoir reçu le rapport du commissaire, le plaignant peut demander que la Cour entende toute question qui a fait l'objet de la plainte - ou qui est mentionnée dans le rapport - et qui est visée aux articles 4.1.3, 4.2, 4.3.3, 4.4, 4.6, 4.7 ou 4.8 de l'annexe 1, aux articles 4.3, 4.5 ou 4.9 de cette annexe tels que modifiés ou clarifiés par la section 1, aux paragraphes 5(3) ou 8(6) ou (7) ou à l'article 10.
While there are some variations in the reliefs sought and the grounds for the reliefs sought on the four applications, the factual background to the four (4) applications is essentially identical.
[2] By order dated the 31st of December, 2004, Prothonotary Hargrave consolidated the four (4) applications and provided that the application on file T-1865-04, that of Randy Turner and The Telecommunications Workers Union, would be the "lead file for the purposes of ongoing proceedings." The four applications were heard, as one, at Vancouver, British Columbia on the 20th, 21st and 22nd of September, 2005. This single set of reasons will apply in respect of all four (4) applications. Separate orders providing identical reliefs will be issued.
[3] By further order dated the 22nd of February, 2005, Prothonotary Tabib granted leave to the Privacy Commissioner of Canada to appear as an added Respondent on the consolidated application.
BACKGROUND
a) The Parties
[4] Randy Turner, Paul Bernat, Paul Wansink and Henry Fenske (the "Individual Applicants") were, at all relevant times, employees of Telus Communications Inc. and members of a bargaining unit of employees of that employer represented exclusively by the trade union applicant, The Telecommunications Workers Union.
[5] Telus Communications Inc. ("Telus") is a federal work and undertaking and provides wire-line telephone, internet and other services in numerous provinces in Canada, including Alberta and British Columbia.
[6] The Telecommunications Workers Union ("TWU") is a trade union as defined by the Canada Labour Code. It represents the Individual Applicants in matters of employment pursuant to the terms of a collective agreement between TWU and Telus. It purports to have complained to the Commissioner and to come before this Court in a representational capacity as certified bargaining agent on behalf of the Individual Applicants.
[7] The Commissioner is the Privacy Commissioner appointed under section 53 of the Privacy Act[2]. The Commissioner is assigned responsibilities under PIPEDA.
b) "e.Speak" and "Nuance Verifier"
[8] In late 2002, Telus introduced a new technology called "e.Speak" to its operational practices. e.Speak uses voice recognition technology to allow employees of Telus to access and use Telus' internal computer network by speaking commands through a telephone, as opposed to using a designated computer terminal or having another employee, typically a clerk, access the network on their behalf. Using e.Speak, Telus employees working in the field can execute various network operations by using any available telephone, including a cellular telephone. Telus alleges, and provides substantial evidence in support of its allegation, that the use of e.Speak has resulted in business advantages for Telus by increasing employee efficiency and reducing costs.
[9] Because e.Speak is a direct connection to the Telus internal computer network, when an employee attempts to access e.Speak by telephone, their identity must be verified so that confidential information held within the data stores of the network is protected. Unauthorized access to the data stores and to confidential information held therein would, it is alleged, be significantly damaging to Telus.
[10] The identity verification system that is used by Telus to grant or withhold access to e.Speak is a computer program known as Nuance Verifier which uses speaker verification technology to verify the identity of persons seeking to access e.Speak.
[11] Nuance Verifier was apparently developed and is marketed by a company called Nuance Communications ("Nuance").
[12] Nuance describes its Nuance Verifier speaker verification technology in written materials distributed by it that are annexed as exhibits to the affidavit of Randy Turner filed with the Court. The following are extracts from that material:
...
Voice authentication, also known as "speaker verification", is defined as the automated verification of a person's claimed identity, based on unique characteristics of their voice.
There are three main ways to verify a person's identity: it can be done based on something that the person has (ID card, badge), something that the person knows (password, PIN, personal information), or something that the person "is": that is the biometric. One of the better-known biometrics is a fingerprint. In fact, a voice print is as unique as fingerprint. A voice print measures behavioral characteristics of the way the person speaks, as well as physical characteristics of the person's vocal track. During voice authentication, the voice of the user is compared to the stored voice print to verify the claimed identity.
Voice authentication offers many advantages over other verification methods, including other biometrics (fingerprint, iris and face-scans.)
· Voice authentication is much more secure than passwords and PINs, which can be stolen, guessed and forgotten.
· It is ubiquitous and unobtrusive - voice authentication can be seamlessly integrated into the callers' experience.
· It does not require special hardware, or scanning devices - just the user's voice and a telephone or microphone.
...
Nuance Verifier uses voice biometrics to securely authenticate the identity of a caller.[3] ...
...
This biometric technology captures specific physical characteristics of the human voice, using those characteristics to identify callers.
...
Like a fingerprint, Nuance Verifier voice authentication software creates individual voice prints to authenticate callers and customers with just their voices, enabling secure access to information.[4]
...
In a controlled environment, voice print and fingerprint will provide similar accuracy. However, there are significant deployment and usability disadvantages associated with fingerprint and other biometric technologies, such as iris and facial scans.
...
... Voice is also much less intrusive for the end-user than iris, finger, or face scanners. People feel uncomfortable having their eye or face scanned. Fingerprints are somewhat less intrusive, but require physical contact with a device, which has its own set of usability issues.[5]
[13] In order for an employee to use the Nuance Verifier speaker verification technology, the employee must initially participate in an "enrollment process" that results in the generation of a "voice template", sometimes referred to by Telus and Nuance as a "voice print".
[14] Nuance describes the "enrollment process" in the following terms:
...
A caller goes through a one-time voice enrollment process where a sample of the voice is taken and a voiceprint is created and stored. Voiceprints are not audio samples, but a matrix of numbers that represent the characteristics of the user's voice and vocal tract.[6]
...
... Callers participate in a brief one-time enrollment process during which they answer several questions, allowing Nuance Verifier to capture and store their voice- print.[7] ...
[15] Enrollment voice templates or voice prints which, as noted in the second-above brief quotation are a "matrix of numbers" rather than an audio sample, are stored, according to Telus' evidence, under substantial security, presumably for as long as the provider remains an employee of Telus or continues to work with Telus in a capacity that requires him to access e.Speak by telephone. Access to e.Speak then requires production of a second voice template or voice print which in turn is digitalized and matched against the caller's enrollment voice template or voice print. Assuming a match, access is provided. If a match is not obtained, access is denied. The second voice template or voice print, that is to say the "access voice template or voice print", is destroyed in a relatively short period of time, that is to say, one or two months.
c) The "Consultation" Process
[16] Telus has identified certain of its employees, including the four (4) Individual Applicants, as employees who are expected to undergo the enrollment process. Telus takes the position that the efficiency and effectiveness of the e.Speak system is dependent on the enrollment of all such identified employees. In the absence of enrollment, a parallel secure access system to data stores is required resulting in less efficiency and effectiveness. While Telus urges that it has consulted broadly and effectively with its employees, not their collective bargaining agent, on implementation of e.Speak, it has made it known that, for those who fail to enroll, "progressive discipline" will be invoked.
[17] The Individual Applicant Henry Fenske did enroll. That being said, he alleges that his enrollment was coerced and that he underwent enrollment against his will. He has apparently withdrawn his consent to enrollment. The remaining Individual Applicants have refused to enroll. To the date of the hearing before me, Telus had not yet implemented discipline against any of the Individual Applicants, apparently pending the outcome of this proceeding.
[18] The Individual Applicants take the position that neither at the time of their employment with Telus nor at any time during the course of their employment with Telus have they consented to the collection and use of any of their biometric personal information. Further, they allege that the collective agreement which governs the terms and conditions of their employment does not contain any provision whereby TWU, their representative, has provided consent on their behalf. The Individual Applicants deny that there was "meaningful" consultation in the implementation of e.Speak and further deny the allegation by Telus that it has "...carefully considered the balance between the needs of the business, and the privacy rights of our employees, and has taken steps to ensure employee privacy is maintained."[8]
THE COMPLAINTS TO THE PRIVACY COMMISSIONER
[19] Randy Turner filed with the Commissioner an extensive complaint, extending to thirty-six (36) pages and supported by some forty-one (41) pages of exhibits[9]. His complaint was noted as received in the office of the Commissioner on the 13th of February, 2004. In his complaint, Mr. Turner alleged that the implementation of e.Speak by Telus violated subsections 5(1) and (3) and section 7 of PIPEDA and Principles 4.1.4, in particular paragraphs (c) and (d) of that Principle, 4.3.1, 4.3.4, 4.3.5, 4.3.6 and 4.3.8 and 4.4 in Schedule 1 to PIPEDA. Further, Mr. Turner urged that such violations were contrary to the Canadian Charter of Rights and Freedoms[10], were contrary to principles of fairness and reasonableness and were irrational and an abuse of power and process.
[20] The other Individual Applicants filed much less formal and extensive complaints with the Commissioner.
PROVISIONS OF PIPEDA RELEVANT TO RANDY TURNER'S COMPLAINT TO THE COMMISSIONER AND TO THESE APPLICATIONS
[21] Subsection 14(1) of PIPEDA is quoted earlier in these reasons. Other provisions of PIPEDA that are relevant to Randy Turner's complaint to the Commissioner and to these applications are set out in full in a Schedule to these reasons.
THE REPORT BY THE PRIVACY COMMISSIONER
[22] For the purposes of these reasons, I will focus on the report of the Commissioner to the Individual Applicant Randy Turner, as did counsel before the Court. That report is dated the 3rd of September, 2004[11]. After a brief introduction and a summary of the investigation conducted, the Commissioner's representative recorded her findings in the following terms:
This Office, in the past, has had the opportunity to consider the issue of employee consent with respect to certain job requirements that impinge upon privacy. In considering the appropriateness of making a privacy-invasive measure a job requirement, the purposes for introducing the measure must be looked at in the context of the reasonable person test, outlined in subsection 5(3) [of PIPEDA].
Simply put, would a reasonable person consider it appropriate for TELUS to collect your voice print to access e.Speak applications, in the circumstances? The company has provided three reasons for introducing e.Speak with its voice password technology: security, efficiency, and cost-effectiveness. Such a system is clearly more efficient and cost effective than paper processes and password management, and it is logical that a company would want to introduce economies and efficiencies to remain competitive in the telecommunications industry. The more persuasive argument, however is that the voice password is needed to ensure security. TELUS evaluated the risk associated with managing large amounts of customer data and concluded that e.Speak offers the highest level of protection from unauthorized access. This proactive approach is aimed at safeguarding the personal information of customers and meeting the expectation of customers that their data will be protected.
The purpose of the Act is to balance the individual's right of privacy with respect to their personal information and the need of organizations to collect, use, or disclose personal information for appropriate purposes in the circumstances. Is the loss of your privacy proportionate to the benefits the company is likely to gain? The first step in answering that question is to determine just how privacy invasive a voice print really is.
There is no question that a voice print is an encroachment upon your person. TELUS is collecting the behavioural and physical characteristics that make your voice unique. But how much does it tell about you? Can a voice print - in and of itself - reveal, for example, your work history, the state of your health or any possible criminal record? In my view, the voice print does not tell much about the individual so the issue to consider is could it be used to find out more about the individual or misused in some other way? Indeed, you expressed concern about the various uses to which your voice print could be subjected, such as spying on employees or identifying an employee who calls into a radio talk show to criticize the employer. But those who know you also know your voice. If an employee was publicly critical of his or her employer on a talk show, and the individual's supervisor happened to hear it, the fact that the employer has a voice print on file has no effect on the likelihood of the employee being recognized. Moreover, TELUS has demonstrated to our satisfaction that, technically speaking, it can only use the voice print for authentication purposes in its current setup, and cannot use it for spying or other nefarious purposes. In the circumstances of this complaint, therefore, a voice print that is used solely for one-to-one authentication purposes seems to be fairly benign.
On the other side, TELUS' need to remain competitive is one that has very real consequences for employees. If a third party were to gain access to customer data, consumer confidence in the company's ability to protect its information would be seriously eroded. In today's highly competitive business environment, customers would likely turn to another company for service and the potential losses to TELUS could be enormous. The cost savings of streamlining business processes are also of importance in today's market place. If the company cannot make money and remain competitive, it cannot stay in business, and employees are soon out of work. Given that the voice print does not appear to be unduly invasive, it would seem that an appropriate balance has been struck. That is not [to] say that any privacy-impinging measure a company introduces would be considered appropriate. The loss of privacy must always be weighed against the benefits, and the purposes for the measure must be grounded in a defensible need.
In our view, a reasonable person would likely consider TELUS' purposes in the circumstances to be appropriate. The company informed employees of its purposes, and clearly has appropriate safeguards in place to protect the voice print information. Given the above, I find TELUS in compliance with subsection 5(3), and Principles 4.2 and 4.7.
To return then to consent, employees are obliged to record certain work-related information as part of their job requirements. Must TELUS provide you with an alternative? Since the purposes, which were explained to employees, for collecting and using the voice print are reasonable, and providing an alternative concurrent with e.Speak would not ensure the desired level of security and thus would not meet these purposes, my response is no. I am of the view that the collection and use of this particular biometric, in this particular set of circumstances, is reasonable. I therefore find that the consent requirements set out in Principle 4.3 have been met.
Accordingly, I conclude that the portion of your complaint concerning the collection of the voice print is not well-founded.
You also raised concerns regarding the absence-reporting application. We agree that e.Speak should not be prompting employees to input the medical reason underlying their sickness. The provision of such information to a manager for the purpose of calling in sick is excessive and contrary to Principle 4.4 which limits the collection of personal information to that which is necessary for the purposes identified. TELUS has agreed to amend its absence reporting e.Speak application so that employees are not prompted to specify why they are calling in sick. I am requesting that the company report back to me within 120 days of the date of this finding to confirm that these changes have been implemented.
Accordingly, I conclude that the part of your complaint regarding the collection of personal information by the absence-reporting application is resolved.
[emphasis added]
[23] The Commissioner's delegate then continues in her reporting letter to outline the recourse available to the Applicant, Randy Turner, under section 14 of PIPEDA, which recourse has been adopted by the Individual Applicants through this proceeding. Recourse in respect of the Commissioner's conclusion regarding reporting of medical reasons underlying sick leave applications was not pursued at hearing since each of the Individual Applicants was essentially successful before the Commissioner in this regard.
THE RELIEFS SOUGHT
[24] The reliefs sought on these applications were not entirely uniform in the Notices of Application filed. That being said, a uniform set of reliefs was provided in the consolidated Applicants' Memorandum of Fact and Law in the following terms:
The Applicants seek:
A Declaration that Telus has contravened Sections 5(1) and 5(3) of PIPEDA by requiring employees, including the Applicants, to provide biometric personal information for Telus' use in authenticating identity.
A Declaration that Telus has contravened Sections 5(1) and 5(3) of PIPEDA by requiring employees to provide the medical reason underlying a claim of illness-related absence.
An Order, pursuant to Section 16(a) of PIPEDA, that Telus correct its practices by:
1. Ceasing and desisting from requiring employees to provide biometric personal information; and
2. Ceasing and desisting from requiring employees to provide the medical reason underlying a claim of illness-related absence.
An Order pursuant to Section 16(b) of PIPEDA, that Telus publish a notice of any action taken and/or proposed to be taken to correct its practices.
An Order pursuant to Section 16(c) of PIPEDA, that Telus pay damages in an amount to be determined by the Court to the Applicant, Henry Fenske, for the humiliation that he suffered as a result of Telus' contravention of PIPEDA.
Costs of this Application.
Such further and other relief as counsel may request at the hearing of this Application and which this Honourable Court deems appropriate.
[25] At the close of the hearing, the foregoing list of reliefs was revisited. Counsel for Telus urged that, if the Applicants were successful, counsel should be provided an opportunity to review and make submissions as to the form and content of the proposed relief. Counsel for the Commissioner took no position as to appropriate relief except to urge that no costs should be ordered payable by or to the Commissioner. Also on the issue of costs, counsel for the Applicants urged that, if Telus was successful, no costs should be ordered against the Applicants since significant issues of broad importance were raised on this application and, in the submission of counsel, and this is a submission for which I have some sympathy, Telus had been somewhat high-handed in its dealings with employees regarding the implementation of e.Speak and the Nuance Verifier technology.
[26] The second relief sought regarding the provision of medical reasons underlying a claim for illness-related absence, was, as earlier indicated, dropped since the Applicants were essentially successful in this regard before the Commissioner.
[27] Some modification of the first branch of the third relief was suggested so that any injunction against a requirement that employees provide biometric personal information would not apply if the appropriate collective agreement was modified to permit such a requirement. The second branch of the third relief, that is to say the request for an order that TELUS cease and desist from requiring employees to provide medical reasons underlying a claim of illness-related absence was, like the second relief, withdrawn.
[28] Finally, I advised counsel that I was disinclined to order any payment of damages.
[29] No "further and other relief" was requested by counsel at hearing.
THE ISSUES
[30] A proceeding under section 14 of PIPEDA is not a judicial review of the Commissioner's report or her conclusions or recommendations. Rather, it is a fresh application to this Court in the nature of a de novo proceeding. In Englander v. Telus Communications Inc.[12], Justice Décary, for the Court, wrote at paragraphs 47 and 48:
...I find no difference on a procedural point of view between an application "for a remedy" ("former un recours") under subsection 77(1) of the Official Languages Act and an application "for a hearing" ("que la Cour entende") under subsection 14(1) of [PIPEDA]. The investigations carried out pursuant to a complaint by the Official Languages Commissioner and the Privacy Commissioner basically follow the same pattern. The application to the Federal Court in both cases may be made by a complainant and is to be heard in a summary way. What is at issue in both proceedings is not the Commissioner's report, but the conduct of the party against whom the complaint is filed. And the remedial power of the Court in the PIPED Act, even though not drafted in Charter language, is remarkably broad.
As found in Forum des maires, therefore, the hearing under subsection 14(1) of the Act is a proceeding de novo akin to an action and the report of the Commissioner, if put in evidence, may be challenged or contradicted like any other document adduced in evidence.
[31] Against the foregoing, counsel for the Applicant urged that the points in issue in this proceeding are the following:
1. Has Telus met its obligations under PIPEDA to obtain consent prior to collecting and using employee biometric personal information?
2. Do the reasons provided by Telus for its collection and use of biometric personal information constitute purposes that a reasonable person would consider appropriate in the circumstances?[13]
[32] While counsel for Telus phrases the foregoing issues differently, I am satisfied that there is no disagreement in substance. That being said, counsel for Telus raises a third issue, that being whether TWU has standing in this proceeding.
[33] Counsel for the Commissioner asserts the same issue raised on behalf of Telus regarding standing of TWU. Further, counsel for the Commissioner raises issues regarding: the weight to be given to the factors taken into consideration by the Commissioner in balancing the interests of the parties under subsection 5(3) of PIPEDA; whether this Court should apply the legal-analytical framework and factors considered by the Commissioner in balancing those interests; the role of a union such as TWU where an employer such as Telus seeks consent for the collection and use of personal information from its employees; and the appropriate principles to govern an assessment of whether the Applicants consented to the collection and use of their personal information in accordance with Principle 4.3 in Schedule 1 to PIPEDA.
ANALYSIS
a) Standing for The Telecommunications Workers Union
[34] Subsection 11(1) of PIPEDA (see the Schedule to these reasons) provides that an individual may file with the Commissioner a written complaint against an organization, such as Telus, for contravening a provision of Division 1 of PIPEDA or for not following a "recommendation" set out in Schedule 1 to PIPEDA. Sections 5 to 10 of PIPEDA constitute Division 1 and are under the heading "Protection of Personal Information". The "Principles" quoted in the Schedule to these reasons are all contained in Schedule 1 to PIPEDA and are presumably among the "recommendations" referred to in subsection 11(1). The Individual Applicants filed such complaints, which were investigated and responded to on behalf of the Commissioner, in a manner that eventually led to this proceeding. The Telecommunications Workers Union filed no such complaint and, urged counsel for Telus and the Commissioner, was not entitled to, since it is not an "individual".
[35] Pursuant to subsection 14(1) of PIPEDA[14], a complainant may, after receiving a report from the Commissioner in respect of his or her complaint, apply to this Court for a hearing. The Telecommunications Workers Union purports to apply to this Court in accordance with subsection 14(1) of PIPEDA.
[36] I am satisfied that The Telecommunications Workers Union was not entitled to apply to this Court and is not a proper party to this proceeding. As noted, it did not make a complaint in accordance with subsection 11(1) of PIPEDA and thus, it is not a "complainant" within the meaning of subsection 14(1). Further, even if it were an appropriate "complainant", there is no evidence before the Court that it received any of the Commissioner's reports here before the Court, nor is there any evidence that it was entitled to receive those reports.
[37] Finally for the purposes of this issue, I am satisfied that The Telecommunications Workers Union is not an "individual" within the meaning of that term in subsection 11(1) of PIPEDA. Whether The Telecommunications Workers Union or an equivalent could be such an "individual" in circumstances where a collective agreement between an employer such as Telus and itself authorized or required it to represent its members, for purposes of consent, in respect of a matter within the scope of PIPEDA, is a matter for another day.
[38] In the result, during the course of the hearing of this matter, I indicated that orders would go striking The Telecommunications Workers Union as an Applicant in these proceedings. That conclusion on behalf of the Court had essentially no impact on the course of the hearing since the same counsel represented the Individual Applicants and The Telecommunications Workers Union before the Court.
b) The Collection of Personal Information that is at issue - Was it only for purposes that a reasonable person would consider are appropriate in the circumstances?
[39] The issue question as here phrased reflects the terminology of subsection 5(3) of PIPEDA which is set out in the Schedule to these reasons. It reflects an acknowledgement that characteristics of a person's voice are personal information, an acknowledgement not disputed before the Court and that I accept without reservation. Subsection 5(3) requires a balancing of interests viewed through the eyes of a reasonable person; in this case, the business interests that Telus alleges and the privacy interests of its employees, as put forward by the Individual Applicants. Neither interest is absolute.
[40] In R. v. Tessling[15], Justice Binnie, for the Court, wrote at paragraph 25 of his reasons:
Privacy is a protean concept, and the difficult issue is where the "reasonableness" line should be drawn. Sopinka J. offered a response to this question in the context of informational privacy in Plant, supra, at p. 293, as follows:
In fostering the underlying values of dignity, integrity and autonomy, it is fitting that s. 8 of the Charter should seek to protect a biographical core of personal information which individuals in a free and democratic society would wish to maintain and control from dissemination to the state. This would include information that tends to reveal intimate details of the lifestyle and personal choices of the individual. [emphasis added by Justice Binnie]
[41] While the Supreme Court, in the Tessling matter, was considering the concept of privacy in a very different context, that being a criminal law context and a Charter challenge, I am satisfied that the foregoing is applicable here. Privacy is a variable or changing concept, which is to say, a "protean" concept. Privacy rights are neither absolute at one extreme nor insignificant at the other. Their location on the spectrum between those two extremes is variable, depending upon the totality of the factual situation in which they are being examined. I adopt, as my own and on the evidence before me, the Commissioner's conclusion that, while voice characteristics are undoubtedly personal information, on the spectrum just described, they are towards the lower end, notwithstanding the contrary view urged on behalf of the Individual Applicants.
[42] Once again in a criminal law context, Justice Cory, in R. v. Edwards[16] enumerated a series of factors to be addressed, on the facts there before the Court, in determining whether an expectation of privacy was reasonable. One of those factors was whether or not the information was already in the hands of third parties. A person's voice is a unique feature of his or her person that he or she exposes to a greater or lesser number of persons every day. Indeed, I am satisfied that it is safe to say that the Individual Applicants, in the course of their employment, exposed the unique nature of their voices to some of their colleagues and likely others every day. It is this same unique feature of their persons that Telus sought to have recorded, not merely exposed, but not recorded in its natural form, but rather in a digitalized form.
[43] Telus provided substantial information to its employees, albeit arguably self-serving information, regarding the nature of the Nuance Verifier technology, the uses to which the digitalized recording of voice characteristics would be put and the security measures which would be undertaken to protect the digitalized recordings.
[44] By contrast, counsel for the Individual Applicants raised the spectre of potential future uses, against a rather Orwellian background and highly hypothetical risks that the security measures adopted by Telus would be breached.
[45] I am satisfied that the test of what a reasonable person would consider to be appropriate in the circumstances must be applied against the circumstances as they exist. I accept that circumstances can change, that new uses and applications can be contemplated and adopted, and that new technologies to breach security can be developed. I am satisfied that those new uses and applications, and changes in technology that might render Telus' security precautions inadequate, are to be tested only when they are real and meaningful, not when they are hypothetical.
[46] I am further satisfied that the foregoing is supported by the words of Justice Binnie in Tessling, above, where, at paragraph 55, he wrote by reference to the reasoning in the Court below:
I agree with Abella J.A. that the spectre of the state placing our homes under technological surveillance raises extremely serious concerns. Where we differ, perhaps, is that in my view such technology must be evaluated according to its present capability. Whatever evolution occurs in future will have to be dealt with by the courts step by step. Concerns should be addressed as they truly arise. ...
[emphasis in the original]
I am satisfied that the foregoing applies directly here with Justice Binnie's text modified to read as follows:
I agree...that the spectre of Telus utilizing voice prints collected on consent for specific purposes, for purposes that constitute an unreasonable extension of the original purposes, or others breaching the security surrounding the storage of the voice prints, raises extremely serious concerns. Where we differ, perhaps, is that in my view, collection and use must be evaluated according to present circumstances. Whatever evolution occurs in future will have to be dealt with by the courts step by step. Concerns should be addressed as they truly arise. ...
[47] Once again in Englander v. TELUS Communications Inc., above, at paragraphs 38 and 39, Justice Décary wrote:
The purpose of the PIPED Act is altogether different [from the purpose of the Privacy Act]. It is undoubtedly directed at the protection of an individual's privacy; but it is also directed at the collection, use and disclosure of personal information by commercial organizations. It seeks to ensure that such collection, use and disclosure are made in a manner that reconciles, to the best possible extent, an individual's privacy with the needs of the organization. There are, therefore, two competing interests within the purpose of the PIPED Act: an individual's right to privacy on the one hand, and the commercial need for access to personal information on the other. However, there is also an express recognition, by the use of the words "reasonable purpose", "appropriate" and "in the circumstances" (repeated in subsection 5(3)), that the right of privacy is not absolute.
The PIPED Act is a compromise both as to substance and as to form.
[48] Taking into account the foregoing, and against the above brief analysis of: the degree of sensitivity associated with voice prints as personal information; the security measures implemented by Telus; the bona fide business interests of Telus as established on the evidence before the Court and to which the collection of voice prints is directed; the effectiveness of the use of voice prints to meet those objectives; the reasonableness of the collection of voice prints against alternative methods of achieving the same levels of security at comparable cost and with comparable operational benefits; and the proportionality of the loss of privacy as against the costs and operational benefits in the light of the security that Telus provides; I conclude that the collection of the voice print information here at issue would be seen by a reasonable person to be appropriate in the circumstances, as they existed at all times relevant to this matter, and against the security measures adopted by Telus.
c) Has Telus met its consent obligations under PIPEDA?
[49] It was not in dispute before the Court that consent to the collection, use or disclosure of personal information from an employee is required "except where inappropriate" and subject to certain exceptions. The general principle is expressed in Principle 4.3, the relevant provisions of which are set out in the Schedule to these reasons. I am satisfied that the "except where inappropriate" qualification does not here apply.
[50] Subsection 7(1) of the Act, also set out in the Schedule, enumerates further exceptions to the general principle. Only two of those exceptions might apply here: first, that set out in paragraph 7(1)(a), to the effect that the collection is clearly in the interests of the individual and consent cannot be obtained in a timely way; and secondly, that set out in paragraph 7(1)(d), the information is publicly available and is specified by regulations made under PIPEDA.
[51] I am loathe to conclude that, on facts such as those before the Court where consent is sought from a large number of individuals by the employer of those individuals and the vast majority provide consent, while a very small minority, as here, refuse consent, Parliament intended that that small minority should be able to paralyse action by the employer that it considers to be in its business interests and that view is not opposed by the vast majority of the affected employees. Such a situation is, I am satisfied, within the scope of paragraph 7(1)(a). Thus, in circumstances such as those here before the Court, an organization, in this case Telus, may collect personal information without the consent of individuals such as the Individual Applicants where the collection is clearly in the interests of those individuals and their consent cannot be obtained in a timely way.
[52] On the facts of this matter, Telus sought to obtain voice prints from a substantial number of its employees and the vast majority of that number consented. Those who did not consent knew that Telus wished to obtain their consent. They continued to refuse to consent so that their consent could not be obtained in "...a timely way". They exercised their right to complain to the Commissioner. They received a report from the Commissioner which concluded that Telus' wish to obtain their consent was reasonable. The non-consenting employees exercised their right to come to this Court for a de novo review of the situation. Assuming that they will be unsuccess