Alberta Privacy Commissioner Rules Against Keystroke Logging

The Alberta Privacy Commissioner has ruled that a library which had installed keystroke logging software on an employee's computer without his knowledge should not have done so. The library argued that the information collected was necessary to monitor the productivity of the employee but the Commissioner found that the library could have used less intrusive means to monitor the employee's work and had made no effort to do so. When the employee discovered the practice, he lodged a complaint with the Privacy Commissioner and removed the software from his computer. No one other than the employee ever viewed the logs produced. The complainant was the only employee monitored in this fashion and had been given permission to use his computer for personal banking on non-working time. The information from this permitted personal use was included in the keystroke logging data. The Commissioner held that there could be circumstances in which information gained by an employer by the use of keystroke logging software would be "necessary for the purpose of effective employee management" (as permitted by section 33(c) of the Alberta Freedom of Information and Protection of Privacy Act). However, the Commissioner went on to find that this could only be "necessary" when less intrusive methods were unavailable and when the employee was notified of the use of the software. For an article in The Globe and Mail, see: http://tinyurl.com/dmhf9 For the full text of the Alberta Privacy Commissioner's decision, visit: http://www.oipc.ab.ca/ims/client/upload/F2005-003.pdf Summary by: Nyall Engfield