Rehn Enterprises Ltd. v United Steelworkers, Local 1-1937, 2018 CanLII 116968 (BC LA)
REHN Enterprises Ltd. (the “Employer”), a small forestry company, had appointed a third party named Global Total Care (“GTC”) as its agent to manage employee work absences resulting from injury or illness.
The Employer required employees to communicate with and provide medical information directly to GTC. When one union member refused to sign a release allowing his personal physician to discuss medical information directly with GTC, the Employer filed a policy grievance.
Arbitrator Richard Coleman dismissed the Employer’s policy grievance as the requirement to provide medical information directly to GTC could adversely affect employees’ privacy rights under the Personal Information Protection Act (PIPA) and the Collective Agreement.
Sections 4 and 34 of PIPA protect employees’ information that is shared with a second organization carrying out work on behalf of the first organization. However, those protections are limited by the language of PIPA to organizations who have “control” of the information in the first instance.
Thus bypassing the Employer and going directly to GTC would potentially undermine the employee’s rights under PIPA and the Collective Agreement. As stated by Arbitrator Coleman at paragraphs 34-36:
It is an extraordinary circumstance to require a person to share personal medical information with a party with whom they have no direct relationship; and I must presume that it is no accident that the legislature made specific provision for the original organization in control of the information—and with whom the person does have a direct relationship—to share that information (sec. 12(2) for defined purposes, but at the same time requiring the original organization to retain responsibility for security (secs. 4 and 34). Under that regimen, if Rehn was the initial recipient of the information, it could be held accountable for that security, through the collective agreement. But Rehn seeks to have the employee communicate directly with GTC, cutting Rehn out of the loop entirely. The latter would never have custody of the individual’s personal medical information, and thereby, in my view, would not, in any reasonable interpretation of the Act, be considered to be in “control” of the information.
…
Were Rehn employees compelled to hand over their private and personal medical information directly to GTC, “an employee who might be adversely affected by the policy [would be deprived] from exercising the full extent of his or her rights under the collective agreement.” Namely: holding their employer accountable for the protection of the private information collected by the agent.
Although the parties could negotiate an agreement allowing GTC to deal with injury management that contained mutually acceptable rules and restrictions, absent such agreement the Employer could not unilaterally force employees to provide medical information directly to a third party.