Privacy Obligations For Organizations And Employee Snooping

The issue of "employee snooping," which is when employees access personal information without authorization and without a legitimate purpose, is currently top of mind with the Office of the Privacy Commissioner of Canada (the OPC). Recent employee snooping incidents at Canadian banks in which customer account information was inappropriately accessed by employees have compelled the OPC to issue a guidance document on how organizations can prevent and address employee snooping.¹

What You Need To Know

While employee snooping may represent the actions of an employee for his or her own purposes, the OPC considers the organization to be accountable to protect personal information from unauthorized use or disclosure. In the recent incidents referenced above, the OPC found the banks to be in contravention of the Personal Information Protection and Electronic Documents Act (PIPEDA).