Governance

October 6, 2023 Published by London and Area Chapter - By Laura Gurr

Safeguarding Privacy: Protecting the Privacy of Board Members and Individual Employees

From the CCI Review 2023/2024-1 August 2023 issue of the CCI London Chapter

Understandably, the safeguarding of personal information has become a paramount concern. The inadvertent or intentional exposure of personal contact information of volunteer board members and employees raises critical issues and can have serious consequences. Board and managers should be aware of the ramifications of such unauthorized disclosures, the relevance of privacy laws, and the importance of implementing protective measures to prevent unauthorized disclosures.

Board members, property managers, and individual employees are instrumental in shaping the communities they serve. However, their personal information is increasingly vulnerable to unauthorized access. Whether shared inadvertently through communication channels, association platforms, or official documents, sensitive data can inadvertently be disclosed. Personal information can also be disclosed without authorization. Concerns have been raised that individual directors are being contacted by companies soliciting work from the condominium corporation, without directors having permitted the disclosure of their personal information. Such breaches not only breach an individual’s expectation of privacy and may also compromise the safety and security of these individuals.

Legal Landscape: PIPEDA in Focus

The Personal Information Protection and Electronic Documents Act (PIPEDA) remains the cornerstone of privacy regulation in Canada. Although primarily applicable to commercial entities, it extends its protective reach to condominium management companies handling personal information of both board members and employees. These companies bear the responsibility of obtaining informed consent before collecting, using, or disclosing such personal information.

The ramifications of non-compliance with PIPEDA include regulatory consequences, reputational damage and potential lawsuits. With this in mind, condominium management companies should consider establishing comprehensive privacy policies, conducting regular privacy assessments, and implementing stringent measures that curtail unauthorized access to personal data.

Heightening the Stakes: Legal Liabilities and Reputational Perils

Privacy breaches carry weighty consequences beyond regulatory fines. Management companies or condominium corporations may face civil litigation initiated by affected board members or employees who allege violations of their privacy rights. Beyond legal repercussions, the loss of trust within the condominium community and the broader housing sector remains a significant concern stemming from privacy breaches.

Unauthorized disclosures of personal contact information of directors or employees for the purposes of commercial communications may also lead to communication sent to those individuals in breach of Canada’s anti-spam legislation. The Canada Anti- Spam Legislation (CASL) governs certain types of communication, including emails and text messages. This legislation requires implied or explicit agreement prior to sending any form of commercial electronic communication. Violations of CASL can trigger substantial financial penalties, underscoring the need for stringent compliance.

Forging Ahead: Bolstering Privacy and Ensuring Adherence

Given the multifaceted implications, management companies should proactively address the safeguarding of personal information for both board members and employees. The following steps are essential considerations:

1. Educate and Train: Regularly educate board members, management staff, and employees about privacy rights, consent, and the importance of data protection.
2. Consent and Transparency: Obtain clear and informed consent before collecting or sharing personal information. Maintain transparency about how data is handled and used.
3. Data Security Measures: Implement stringent data security measures, such as encryption, access controls, and secure communication platforms.
4. Privacy Policies: Develop comprehensive privacy policies that outline how personal information is collected, managed, disclosed, and protected.
5. CASL Compliance: When communicating electronically with individuals, ensure proper consent has been provided and clear opt-out mechanisms are in place.
6. Regular Reviews: Conduct periodic reviews to assess the effectiveness of privacy measures and address any vulnerabilities promptly.

In conclusion, the inadvertent or deliberate disclosure of personal information of volunteer condominium board members and employees resonates as an urgent concern, particularly if the information that is disclosed is a home address or contact information, including cell phones and private email address. By taking reasonable and practical steps to protect the privacy of individuals, management companies can fulfill their ethical obligations, minimize legal exposure, and cultivate a climate of trust within the housing sector.

Laura Gurr, JD, LCCI is a partner with Cohen Highley LLP in London, Ont. Cohen Highley has offices in London, Kitchener, Chatham, Sarnia, Stratford and Strathroy.

Laura provides risk management and regulatory compliance advice to condominium corporations, property management companies and nonprofit housing providers.

She regularly writes and speaks about legal issues affecting the industry.

Laura has been on the CCI London Board of Directors since 2016. She brought her expertise, enthusiasm and an intense willingness to share in her contributions as a writer, presenter and instructor.

Laura was awarded her Leader of the Canadian Condominium Institute, (LCCI) designation by CCI-N in November 2022.