A transportation worker returned to work after a serious illness. Because the position was considered safety-sensitive, he had to take a complete medical exam and was pronounced fit. A year later, the company demanded medical information showing that he wasn’t at risk of sudden incapacity. The worker had his doctor fill out two forms but the company also wanted test results and later contacted the doctor directly. The worker, who hadn’t signed a consent form, sued the company for violating his privacy. The Privacy Commissioner found the company guilty of violating PIPEDA. Although the company was entitled to ask the worker to provide the information, it had no right to speak directly to the doctor without the worker’s okay, the Commissioner said.

[PIPEDA Case Summary #287,C.P.C.S.F. No. 1]