Elizabeth Denham</caption>
B.C.'s privacy commissioner plans to look at how far an employer can poke into the online activities of its workers after the mayor of Saanich complained he was being spied on by bureaucrats in the district.
B.C. Information Privacy Commissioner Elizabeth Denham has launched an investigation into the District of Saanich's use of electronic surveillance software to monitor employees after Mayor Richard Atwell said last week that it had installed spyware on his computer. Saanich police investigated and concluded there was no wrongdoing. The district said the software was standard and installed on the recommendation of a cybersecurity audit.
"My office has been closely following recent events in the District of Saanich," Ms. Denham said in a news release. "In light of many outstanding questions and concerns, I have decided to act on my own motion and initiate an investigation."
Ms. Denham said she wants to determine if use of the software falls within the Freedom of Information and Protection of Privacy Act. Investigators will examine the software's operational settings such as methods of data capture and the type of information being collected.
Saanich council said in a statement the software used in the Saanich Municipal Hall computers is called Spector 360. The program's website lists features such as the ability to collect and analyze a user's e-mail, chat, website, application and online activity. It can capture keystrokes, online searches and hundreds of screenshots every hour.
"I would call that spyware," said Avner Levin, director of the Privacy Institute at Ryerson University in Toronto. "I think that's excessive. I don't understand why they would install such a package in their employee's machines."
Many systems in the modern workplace log what employees do, mostly for information security and to protect the integrity of the system, Dr. Levin said. But he considers two features of the Spector 360 software to be very intrusive and unnecessary: keystroke monitoring and screenshot capturing.
"Employees are allowed to have some kind of personal space even if they're working. Not everything you're doing is considered to be purely corporate," he said. "You're not stripped bare and naked just because you're working."
Intensive monitoring is only justifiable by law with a reasonable suspicion of wrongdoing, Dr. Levin said. He and Ms. Denham noted intrusive software should be used only when wrongdoing is suspected. Even if an employee is aware of being monitored, there should be limits to what data can be collected, both said.
Ms. Denham said her office has never investigated a case where covert surveillance was justifiable under privacy law.
The statement from Saanich council explained that during a regular review of information management and infrastructure, the firm Wordsworth & Associates was hired to conduct a security assessment of information technology. Based on the recommendations of the IT security consulting firm, council had Spector 360 installed in some office computers, including Mr. Atwell's.
Council's statement said employees must sign a form to access the corporate network that says the district may access, inspect, read, copy and store data without notice if it is deemed appropriate.
The mayor's form was not returned, but he was given access to the network, the release said.
Mr. Atwell says he does not feel safe working at his office. He has also filed a complaint with the Police Complaints Commmissioner alleging police harassment after he said he was repeatedly pulled over in his vehicle without cause.