{"id":27777,"date":"2015-08-18T22:11:55","date_gmt":"2015-08-19T02:11:55","guid":{"rendered":"http:\/\/www.iposgoode.ca\/?p=27777"},"modified":"2015-08-18T22:11:55","modified_gmt":"2015-08-19T02:11:55","slug":"how-to-discipline-cyber-snooping-employees","status":"publish","type":"post","link":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2015\/08\/18\/how-to-discipline-cyber-snooping-employees\/","title":{"rendered":"How to Discipline Cyber-Snooping Employees"},"content":{"rendered":"

The re-posting of this article <\/a>is part of a cross-posting agreement with CyberLex<\/a>.<\/em><\/p>\n

In a digitized world, it can be all too easy for unauthorized employees to access confidential information in the workplace, as recent breaches<\/a> at the Saskatchewan Cancer Agency and some Ontario hospitals<\/a> have shown. Employers should be prepared to take appropriate disciplinary action against employees who snoop into personal information. In some instances, termination of employment may be appropriate. To minimize liability for wrongful dismissal claims, employers should take careful steps to prevent snooping in the first place and be ready to investigate and discipline employees appropriately if an incident occurs.<\/p>\n

<\/p>\n

Privacy Commissioner: Consider Firing Employees with Prying Eyes<\/strong><\/p>\n

Employers will welcome the comments of Saskatchewan Privacy Commissioner Ron Kruzeniski, who recently took a strong stance<\/a> against snooping workers, after two employees at the Saskatchewan Cancer Agency were disciplined for prying into the health records of 48 people. Health information should only be accessed by staff caring for patients, and even then, only on a need-to-know basis. The agency learned of the breaches in May and conducted an investigation. The employees were asked why they had looked at the records, but no explanations were forthcoming.<\/p>\n

\u201cIn extreme cases, I think the firing option should be considered\u201d when an employee pokes their nose where it doesn\u2019t belong, Kruzeniski said. He noted, however, that the \u201ccircumstances of each case are also very relevant\u201d. For example, unintentional access may occur when names are mis-typed.<\/p>\n

 <\/p>\n

An Ounce of Prevention<\/strong><\/p>\n

Cyber-snooping should be taken seriously, and termination of employment may indeed be appropriate in serious cases. To minimize liability for wrongful dismissal claims, employers should take careful steps to prevent snooping in the first place and be ready to investigate and discipline employees appropriately if an incident occurs. By making it clear that snooping will not be tolerated, an employer may both decrease the incidence of snooping and strengthen their case for appropriate employee discipline if the rules are broken.<\/p>\n

Consider taking the following steps:<\/p>\n

    \n
  1. Set the boundaries.<\/strong> Create workplace policies and rules that clearly explain the circumstances in which private or sensitive information may be accessed, and by which employees. Provide training, including refreshers at appropriate intervals, to ensure that employees know how to follow the rules.<\/li>\n
  2. Build practical barriers.<\/strong> Don\u2019t make it easy to access private records: consider deploying password protection, minimal access or a system that records each time sensitive data is accessed and by whom \u2013 or a combination of all three.<\/li>\n
  3. Explain the consequences.<\/strong> Courts will be less likely to deem discipline, including termination of employment, to be excessive if employees are clearly put on notice of potential consequences before they decide to snoop. Policies should include a clear statement of the disciplinary action that will be taken against rule-breakers.<\/li>\n
  4. Get it in writing.<\/strong> If the policy is properly incorporated into the employment agreement, it may be possible to discipline or terminate an employee for breaching the policy.<\/li>\n
  5. Stick to your guns.<\/strong> Turning a blind eye to \u201cminor\u201d snooping may be fatal to an employer\u2019s case for discipline, especially termination for just cause, if behaviour escalates. Be sure to apply policies consistently and fairly.<\/li>\n
  6. Investigate fairly.<\/strong> Jumping to conclusions will increase potential liability for wrongful dismissal, defamation and other potential claims. Ensure that employees have an opportunity to explain their actions.<\/li>\n
  7. Discipline proportionately.<\/strong> Termination of employment may be appropriate in certain circumstances but should not be done precipitously. Employers may also consider ending employment of non-union employees without cause (as long as the termination is not connected to a ground protected under human rights legislation) by providing notice or pay in lieu of notice as required under the terms of employment.<\/li>\n<\/ol>\n

    Snooping can occur for reasons ranging from the sinister to the mundane, including garden-variety curiosity or boredom. Regardless of the employee\u2019s motivation, employers should be ready to deal with snoops fairly and decisively. This is particularly true now, as recent amendments to Canada\u2019s privacy legislation (which we wrote about here<\/a>) have introduced a requirement to document breaches of security safeguards, mandatory notification of breaches and the potential for significant fines.<\/p>\n

    \u00a9 McCarthy T\u00e9trault LLP<\/p>\n

    Laura DeVries<\/a> is an associate in the Labour & Employment Group at McCarthy T\u00e9trault in Vancouver.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

    The re-posting of this article is part of a cross-posting agreement with CyberLex. In a digitized world, it can be all too easy for unauthorized employees to access confidential information in the workplace, as recent breaches at the Saskatchewan Cancer Agency and some Ontario hospitals have shown. Employers should be prepared to take appropriate disciplinary […]<\/p>\n","protected":false},"author":2140,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","footnotes":""},"categories":[3,2635,110],"tags":[2649,2612,18,2650,2651],"class_list":["post-27777","post","type-post","status-publish","format-standard","hentry","category-blogs","category-cybersecurity","category-privacy","tag-cyber-snooping","tag-cyberlex","tag-cybersecurity","tag-employment","tag-laura-devries"],"yoast_head":"\nHow to Discipline Cyber-Snooping Employees - IPOsgoode<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2015\/08\/18\/how-to-discipline-cyber-snooping-employees\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Discipline Cyber-Snooping Employees - IPOsgoode\" \/>\n<meta property=\"og:description\" content=\"The re-posting of this article is part of a cross-posting agreement with CyberLex. In a digitized world, it can be all too easy for unauthorized employees to access confidential information in the workplace, as recent breaches at the Saskatchewan Cancer Agency and some Ontario hospitals have shown. Employers should be prepared to take appropriate disciplinary […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2015\/08\/18\/how-to-discipline-cyber-snooping-employees\/\" \/>\n<meta property=\"og:site_name\" content=\"IPOsgoode\" \/>\n<meta property=\"article:published_time\" content=\"2015-08-19T02:11:55+00:00\" \/>\n<meta name=\"author\" content=\"ccraig\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ccraig\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2015\\\/08\\\/18\\\/how-to-discipline-cyber-snooping-employees\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2015\\\/08\\\/18\\\/how-to-discipline-cyber-snooping-employees\\\/\"},\"author\":{\"name\":\"ccraig\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/#\\\/schema\\\/person\\\/09b0ef7189d5a2bd6fef2472e5ea5b94\"},\"headline\":\"How to Discipline Cyber-Snooping Employees\",\"datePublished\":\"2015-08-19T02:11:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2015\\\/08\\\/18\\\/how-to-discipline-cyber-snooping-employees\\\/\"},\"wordCount\":714,\"commentCount\":0,\"keywords\":[\"cyber-snooping\",\"CyberLex\",\"cybersecurity\",\"employment\",\"Laura DeVries\"],\"articleSection\":[\"Blogs\",\"Cybersecurity\",\"Privacy\"],\"inLanguage\":\"en-CA\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2015\\\/08\\\/18\\\/how-to-discipline-cyber-snooping-employees\\\/\",\"url\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2015\\\/08\\\/18\\\/how-to-discipline-cyber-snooping-employees\\\/\",\"name\":\"How to Discipline Cyber-Snooping Employees - IPOsgoode\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/#website\"},\"datePublished\":\"2015-08-19T02:11:55+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/#\\\/schema\\\/person\\\/09b0ef7189d5a2bd6fef2472e5ea5b94\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2015\\\/08\\\/18\\\/how-to-discipline-cyber-snooping-employees\\\/#breadcrumb\"},\"inLanguage\":\"en-CA\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2015\\\/08\\\/18\\\/how-to-discipline-cyber-snooping-employees\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2015\\\/08\\\/18\\\/how-to-discipline-cyber-snooping-employees\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Discipline Cyber-Snooping Employees\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/#website\",\"url\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/\",\"name\":\"IPOsgoode\",\"description\":\"An Authoritive Leader in IP\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-CA\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/#\\\/schema\\\/person\\\/09b0ef7189d5a2bd6fef2472e5ea5b94\",\"name\":\"ccraig\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-CA\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4d6461ef50f637a66f0e694df440ca5896971e12de84d604936521b184fec22a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4d6461ef50f637a66f0e694df440ca5896971e12de84d604936521b184fec22a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4d6461ef50f637a66f0e694df440ca5896971e12de84d604936521b184fec22a?s=96&d=mm&r=g\",\"caption\":\"ccraig\"},\"url\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/author\\\/ccraig\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Discipline Cyber-Snooping Employees - IPOsgoode","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2015\/08\/18\/how-to-discipline-cyber-snooping-employees\/","og_locale":"en_US","og_type":"article","og_title":"How to Discipline Cyber-Snooping Employees - IPOsgoode","og_description":"The re-posting of this article is part of a cross-posting agreement with CyberLex. In a digitized world, it can be all too easy for unauthorized employees to access confidential information in the workplace, as recent breaches at the Saskatchewan Cancer Agency and some Ontario hospitals have shown. Employers should be prepared to take appropriate disciplinary […]","og_url":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2015\/08\/18\/how-to-discipline-cyber-snooping-employees\/","og_site_name":"IPOsgoode","article_published_time":"2015-08-19T02:11:55+00:00","author":"ccraig","twitter_card":"summary_large_image","twitter_misc":{"Written by":"ccraig","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2015\/08\/18\/how-to-discipline-cyber-snooping-employees\/#article","isPartOf":{"@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2015\/08\/18\/how-to-discipline-cyber-snooping-employees\/"},"author":{"name":"ccraig","@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/#\/schema\/person\/09b0ef7189d5a2bd6fef2472e5ea5b94"},"headline":"How to Discipline Cyber-Snooping Employees","datePublished":"2015-08-19T02:11:55+00:00","mainEntityOfPage":{"@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2015\/08\/18\/how-to-discipline-cyber-snooping-employees\/"},"wordCount":714,"commentCount":0,"keywords":["cyber-snooping","CyberLex","cybersecurity","employment","Laura DeVries"],"articleSection":["Blogs","Cybersecurity","Privacy"],"inLanguage":"en-CA"},{"@type":"WebPage","@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2015\/08\/18\/how-to-discipline-cyber-snooping-employees\/","url":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2015\/08\/18\/how-to-discipline-cyber-snooping-employees\/","name":"How to Discipline Cyber-Snooping Employees - IPOsgoode","isPartOf":{"@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/#website"},"datePublished":"2015-08-19T02:11:55+00:00","author":{"@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/#\/schema\/person\/09b0ef7189d5a2bd6fef2472e5ea5b94"},"breadcrumb":{"@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2015\/08\/18\/how-to-discipline-cyber-snooping-employees\/#breadcrumb"},"inLanguage":"en-CA","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2015\/08\/18\/how-to-discipline-cyber-snooping-employees\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2015\/08\/18\/how-to-discipline-cyber-snooping-employees\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/"},{"@type":"ListItem","position":2,"name":"How to Discipline Cyber-Snooping Employees"}]},{"@type":"WebSite","@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/#website","url":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/","name":"IPOsgoode","description":"An Authoritive Leader in IP","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-CA"},{"@type":"Person","@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/#\/schema\/person\/09b0ef7189d5a2bd6fef2472e5ea5b94","name":"ccraig","image":{"@type":"ImageObject","inLanguage":"en-CA","@id":"https:\/\/secure.gravatar.com\/avatar\/4d6461ef50f637a66f0e694df440ca5896971e12de84d604936521b184fec22a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4d6461ef50f637a66f0e694df440ca5896971e12de84d604936521b184fec22a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d6461ef50f637a66f0e694df440ca5896971e12de84d604936521b184fec22a?s=96&d=mm&r=g","caption":"ccraig"},"url":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/author\/ccraig\/"}]}},"taxonomy_info":{"category":[{"value":3,"label":"Blogs"},{"value":2635,"label":"Cybersecurity"},{"value":110,"label":"Privacy"}],"post_tag":[{"value":2649,"label":"cyber-snooping"},{"value":2612,"label":"CyberLex"},{"value":18,"label":"cybersecurity"},{"value":2650,"label":"employment"},{"value":2651,"label":"Laura DeVries"}]},"featured_image_src_large":false,"author_info":{"display_name":"ccraig","author_link":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/author\/ccraig\/"},"comment_info":"","category_info":[{"term_id":3,"name":"Blogs","slug":"blogs","term_group":0,"term_taxonomy_id":3,"taxonomy":"category","description":"","parent":0,"count":853,"filter":"raw","cat_ID":3,"category_count":853,"category_description":"","cat_name":"Blogs","category_nicename":"blogs","category_parent":0},{"term_id":2635,"name":"Cybersecurity","slug":"cybersecurity","term_group":0,"term_taxonomy_id":2635,"taxonomy":"category","description":"","parent":0,"count":28,"filter":"raw","cat_ID":2635,"category_count":28,"category_description":"","cat_name":"Cybersecurity","category_nicename":"cybersecurity","category_parent":0},{"term_id":110,"name":"Privacy","slug":"privacy","term_group":0,"term_taxonomy_id":110,"taxonomy":"category","description":"","parent":0,"count":311,"filter":"raw","cat_ID":110,"category_count":311,"category_description":"","cat_name":"Privacy","category_nicename":"privacy","category_parent":0}],"tag_info":[{"term_id":2649,"name":"cyber-snooping","slug":"cyber-snooping","term_group":0,"term_taxonomy_id":2649,"taxonomy":"post_tag","description":"","parent":0,"count":1,"filter":"raw"},{"term_id":2612,"name":"CyberLex","slug":"cyberlex","term_group":0,"term_taxonomy_id":2612,"taxonomy":"post_tag","description":"","parent":0,"count":4,"filter":"raw"},{"term_id":18,"name":"cybersecurity","slug":"cybersecurity","term_group":0,"term_taxonomy_id":18,"taxonomy":"post_tag","description":"","parent":0,"count":25,"filter":"raw"},{"term_id":2650,"name":"employment","slug":"employment","term_group":0,"term_taxonomy_id":2650,"taxonomy":"post_tag","description":"","parent":0,"count":2,"filter":"raw"},{"term_id":2651,"name":"Laura DeVries","slug":"laura-devries","term_group":0,"term_taxonomy_id":2651,"taxonomy":"post_tag","description":"","parent":0,"count":1,"filter":"raw"}],"_links":{"self":[{"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/posts\/27777","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/users\/2140"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/comments?post=27777"}],"version-history":[{"count":0,"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/posts\/27777\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/media?parent=27777"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/categories?post=27777"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/tags?post=27777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}