In 2016, the Office of the Information and Privacy Commission of Alberta (the “OIPC”) released a landmark decision, making it clear that ignorance and outdated technology cannot be used to justify a failure to protect a trans or non-binary individual’s personal information. Although this case occurred several years ago (and under Alberta’s privacy legislation), its principles are still relevant and instructive to organizations and employers today. Individuals who identify as trans and non-binary are marginalized and experience discrimination at high rates. Further, gender identity and gender expression are now expressly protected grounds in numerous human rights codes, including in British Columbia, Alberta and Québec. As a result, it is incumbent upon organizations and employers to ensure that they guard against the disclosure of sensitive and private employee information, as failure to do so could constitute a violation under both privacy and human rights legislation.

Edmonton Public School District No 7 (Re), 2016 CanLII 82100 (AB OIPC)

The Complainant, a female trans student, attended a school run by the Edmonton Public School District (the “School District”). Before starting school, the Complainant and her parents met with school officials to ensure that her male birth name and sex at birth would be kept private. They specifically informed the school officials that the staff could know that she was transgender—but not the student body. The school officials agreed, and assured the Complainant and her parents that appropriate accommodations would be made.

However, despite the school officials’ assurances, the Complainant’s male birth name (which was still her legal name at the time) remained in the computer program frequently used by teachers—particularly supply teachers. Consequently, supply teachers, covering for the Complainant’s regular teachers, displayed and called out her legal name on numerous occasions. During one incident, a supply teacher loudly discussed with the Complainant the process to getting her name changed. The Complainant, feeling disheartened and frustrated, discussed these incidents with school officials, who were apologetic.

The Complainant filed a complaint with the OIPC, alleging that the School District’s conduct violated Alberta’s Freedom of Information and Protection of Privacy Act. The Adjudicator found that the School District had breached the Act, and did not have proper arrangements to prevent the unauthorized disclosure of the Complainant’s personal information.

The Adjudicator found that by disclosing her legal name, the School District had disclosed her name and sex and, further, as her legal name was gender specific, had also disclosed that her gender identity was different from her sex at birth. Even though the School District had made accommodations to prevent disclosing the Complainant’s personal information, its failure was an unreasonable invasion of her privacy because she had specifically requested that the information not be disclosed.

Takeaway for Employers

Although Edmonton Public School Board was decided under Alberta’s privacy legislation, a similar outcome would likely result in British Columbia under the Personal Information Protection Act and in Québec under applicable privacy laws. Therefore, organizations and employers should revisit their policies, practices, and communications to ensure that they adequately adhere to privacy and human rights legislation. Such measures can include: reviewing hiring, performance evaluation, and documentation methods; auditing personal information collection, use, storage and access; updating employee-training resources; and developing guidelines to support employees who are transitioning in the workplace, such as procedures to respect an individual’s chosen pronoun.