As biometric technologies become more sophisticated and accessible in the marketplace, employers doing business in Quebec are increasingly considering the opportunity to implement biometric identification systems. At first glance, these systems may appear convenient and cost-effective, and, in some circumstances, they indeed are. Unfortunately, convenience is not the decisive criterion to justify their implementation: necessity is that criterion. In addition, since the entry into force on November 1st, 2001 of the Act to Establish a Legal Framework for Information Technology (the ''Act''), employers must comply with relatively burdensome formalities before proceeding with the implementation of such systems.
Types of biometry
Physiological biometry is based on particular physical features which are unique and permanent for each person such as fingerprints, the form of hands and of the face, the iris and retina of an eye. On the other hand, behavioural biometry refers to the analysis of the behaviours of a person such as his signature, his voice or his keyboard typing habits.
Biometric technologies available for employers in the marketplace for identification purposes are usually based on physiological biometry. For instance, unlike Integrated Automated Fingerprint Identification Systems used by government agencies for forensic and law enforcement purposes, a well-known fingerprint identification technology developed by Kronos (Kronos Touch ID Technology) does not store hard-copy fingerprint images. No images are stored since this technology is equipped with a scanner which scans employees' fingers and then converts the fingerprint images into an encrypted binary mathematical representation (the ''Mathematical Representation Technology''). An employee enters his personal identification code and puts his finger on a screen, thereby allowing his employer to record properly his working time and attendance.
The legal framework in Quebec
The implementation of biometric systems may raise concerns in connection with employees' rights to the respect of their private life, integrity and dignity. Depending on the nature and use of the biometric characteristics or measurements recorded, certain practices may lead to discrimination claims. They also beg the question whether they infringe section 46 of the Quebec Charter of Human Rights and Freedoms which provides that: ''Every person who works has a right, in accordance with the law, to fair and reasonable conditions of employment which have proper regard for his health, safety and physical well-being'' (emphasis added).
Mathematical Representation Technology usually does not raise any human rights concerns since no images of employees' fingerprints are stored. Furthermore, its underlying purpose is legitimate and work-related as it is generally implemented by employers wishing to increase the cost-efficiency and the accuracy of their working time attendance recording systems.
As of today, the only decision in Quebec that has addressed the implementation of biometric systems on the workplace is an arbitral award rendered in 2001.1 In this deism, the arbitrator held that a biometric identification system based on Mathematical Representation Technology implemented for work time and attendance purposes did not infringe employees' rights to the respect of their privacy, integrity or to just and fair conditions of employment. This award was rendered before the entry into force of the Act and is not binding upon Quebec common law courts or the Quebec Tribunal on Human Rights (''Tribunal des droits de la personne'').
Since the entry into force of the Act, employers must disclose beforehand to the Quebec Commission on Information Access (''Commission d'accès à l'information'') (the ''Commission'') the creation of a database of biometric characteristics or measurements. Any database that was implemented before the entry into force of the Act also had to be disclosed to the Commission.
The Commission is empowered to make orders determining how such databases are to be established, used, consulted, released and retained, and how measurements or characteristics recorded for personal identification purposes are to be archived or destroyed. It may also suspend or prohibit the establishment or order the destruction of such a database if it is not in compliance with its orders or otherwise constitutes an invasion of privacy.
Biometric identification systems based on Mathematical Representation Technology are usually acceptable to the Commission if they are in compliance with all the legal requirements of the Act and of the Act Respecting the Protection of Personal Information in the Private Sector which are summarized in its guidelines entitled Biometrics in Québec: Application Principles. Making an Informed Choice. These legal requirements are:
- Employers should consider alternatives to biometric identification systems;
- In the private sector, the information collected must be necessary (that is, indispensable) for the achievement of the purposes for which the employer wishes to implement biometric identification systems;
- Biometric data may not be collected without the knowledge of the employees;
- The express consent of employees is required to have their identity verified or confirmed through biometric identification systems. The consent must pertain only to the collection of biometric data and must be in writing, given freely in an informed manner, specific, and limited in time. Each employee must consent and may, as he or she sees fit, withhold his or her consent. A model of a consent form for employees was prepared by the Commission and is available on its website;
- Numerous precautions must be taken in the collection, storage, retention and use of biometric data. According to the Commission, all biometric and associated data must be encrypted;
- No other information revealed by the characteristics or measurements recorded may be used as a basis for a decision concerning employees or for any other purpose whatsoever;
- Biometric data is confidential and cannot be disclosed without the consent of the employee. The information revealed by biometric data may only be revealed to the employee at his or her request;
- Biometric data and any notations relating thereto must be destroyed as soon as the purpose of the verification or confirmation of identity has been met or the reason for the verification or confirmation no longer exists. Any retention of said data that does not comply with these requirements is illegal; and
- Employees have a right of access and correction with respect to their biometric information. Biometric information collected by employers must therefore be stored in such a way to be intelligibly communicated to any employee wishing to exercise his or her right of access and correction.
Conclusion
The convenience of biometric identification systems may appear unquestionable for employers, but that does not prove that they are absolutely necessary or legally permitted in Québec. Employers wishing to implement such systems must first assess any available alternatives, even if they are more costly or difficult to set up. Furthermore, the consent of each employee who will be subject to the system must be obtained. Employees may withhold their consent without providing any justification whatsoever. Information sessions should be given to employees in order to inform them about the ins and outs of the biometric identification system that is contemplated to be established on the workplace. In any event, as soon as an employer wishes to implement a biometric identification system, legal counsel should be consulted in order to assess human rights issues that may be raised and to ensure that all the necessary legal requirements, including reporting obligations to the Commission, are fully complied with.
Footnote
1 Syndicat des travailleurs de Mométal (C.S.N.) c. Mométal inc., [2001] R.J.D.T. 1967, D.T.E. 2001T-919.
The foregoing provides only an overview. Readers are cautioned against making any decisions based on this material alone. Rather, a qualified lawyer should be consulted.
© Copyright 2012 McMillan LLP
