Investigation Report 251-2025

INVESTIGATION REPORT 251-2025

Saskatchewan Power Corporation

 May 1, 2026

Summary: The Complainant, who is employed by Saskatchewan Power Corporation (SaskPower), filed a request for information that suggested a privacy concern with SaskPower. The privacy concern centered around the Crown corporation’s use of Automatic Vehicle Locator technology (AVL technology). The Complainant wanted to know: (1) if SaskPower collected, used and/or disclosed employees’ personal information through its use of the AVL technology. If the answer to that question was “yes”, then the Complainant wished to know the purpose of the collection; and (2) whether the collection, use and/disclosure was authorized by The Freedom of Information and Protection of Privacy Act (FOIP).

Dissatisfied with the SaskPower response, the Complainant contacted the Office of the Saskatchewan Information and Privacy Commissioner (OIPC). OIPC opened an investigation file and offered each party an opportunity to provide a submission.

The Commissioner found:

(1) OIPC has jurisdiction to conduct the investigation under section 33 of FOIP (privacy powers of commissioner);

(2) personal information is collected by means of the use of AVL technology, though it is unclear to what extent;

(3) SaskPower has the authority to collect employee personal information through its AVL technology for purposes such as employee safety or the management or administration of personnel under sections 25 and 26(1)(f) of FOIP; and

(4) SaskPower has not demonstrated through its policies, procedures and other materials submitted to this office, the extent of its collection of employee personal information through AVL technology, the precise purpose for which this information is collected (if it is collected), and how each purpose is authorized by FOIP.

The Commissioner recommended the following:

(1) Within 30 days of the issuance of this Investigation Report, SaskPower conduct a Privacy Impact Assessment to identify the adequacy of its safeguards and to determine whether FOIP authorizes the collection, use and/or disclosure of employee personal information through its use of AVL technology;

(2) That within 90 days of the issuance of this Investigation Report, SaskPower finalize its corporate policy with respect to the use of AVL technology and clearly state the purpose and FOIP authority for the collection, use and/or disclosure of employee personal information; and

(3) That within 90 days of the issuance of this Investigation Report, SaskPower notify the Complainant as to what personal information has been collected through the AVL technology installed on the Complainant’s vehicle, outline the purpose for the collection and FOIP authority for such.

I          BACKGROUND

 [1] On March 3, 2025, the Complainant emailed the Saskatchewan Power Corporation (SaskPower) with respect to the Crown corporation’s use of Automatic Vehicle Locator (AVL) technology. The Complainant operates a SaskPower truck in the course of carrying out their employment duties for SaskPower. The request for information is reproduced below:

I am writing to request a formal review of SaskPower’s collection, use, and disclosure of my personal information within the meaning of the Freedom of Information and Protection of Privacy Act. I request a response within 30 days.

While I request a general review of these issues, I have bolded several questions below. I am an employee of SaskPower. My employee number is [withheld].[1]

As part of my employment duties, I operate a SaskPower truck equipped with Automatic Vehicle Locator (“AVL”) technology. I understand that SaskPower can see where my truck is – and therefore, where I am – at any time. In practice, the AVL technology is used only during work hours.

To continue my employment, I was required to sign a standard form SaskPower contract entitled “Corporate Vehicle Use Agreement” (the “Agreement”). I have attached a copy of my current Agreement.

On my review, the Agreement does not indicate that the SaskPower truck is being continuously tracked on AVL. Kindly confirm whether SaskPower continuously tracks my SaskPower truck on AVL. I have not consented to the collection of my personal information. Also, the Agreement does not describe why my personal information is being collected, nor when it may be used or disclosed.

On my review, the personal information collected through AVL is not reflected in SaskPower’s current Privacy Policy.

SaskPower does not have a separate AVL policy regarding the collection of personal information from it, nor the use or disclosure of any such information. I do not know for what purpose(s) my personal information is collected.

SaskPower’s lack of a policy or procedure regarding the personal information collected through AVL appears to be a breach of s. 24.1 of FOIP. Kindly explain whether- and if so, how – SaskPower’s AVL data program complies with s. 24.1. Kindly provide me with any relevant policy or procedure regarding this data.

My understanding is that any member of SaskPower’s management team can access my personal information at anytime; there are no technical safeguards. Similarly, there is no established process to comply with before management accesses such information. My understanding is that my personal information remains freely available to members of management for at least one year after it is collected.

My understanding is that SaskPower management regularly reviews employees’ AVL data for investigative and disciplinary purposes. I do not know how frequently, if ever, my AVL data is used or disclosed by SaskPower.

Using my personal information for a purpose other than for which it was collected (i.e. investigation or discipline) appears to be a breach of s. 28 of FOIP. Kindly explain how SaskPower ensures that any use of my personal information complies with s. 28. Kindly advise when, if ever, SaskPower has “used” my personal information derived from AVL.

Kindly explain what, if any, administrative, technical, and physical safeguards exist for my personal information. Also, kindly explain for what purpose(s) the information is collected – and where those purposes are supplied – and for what purposes the information is used.

Please let me know if you require anything further to consider my request for review…

[Emphasis in original]

[2] The Complainant attached a copy of SaskPower’s Corporate Vehicle User Agreement (Agreement), signed by the Complainant on July 12, 2023.

[3] On September 9, 2025, the Complainant contacted the Office of the Saskatchewan Information and Privacy Commissioner (OIPC) for assistance. The Complainant submitted that SaskPower treated the March 3, 2025 request for information as an access request rather than a privacy concern. Once that matter was resolved, on October 14, 2025, SaskPower provided a response to the Complainant advising it required more information.

[4] On October 20, 2025, legal counsel for the Complainant provided the following clarification to SaskPower:

[The Complainant’s] concern is that SaskPower collects, uses, and discloses [the Complainant’s] AVL data (which is “personal information”) in ways which breach FOIP. Without limiting the generality of the preceding sentence:

1. SaskPower collects this personal information without [the Complainant’s] consent, and without telling [the Complainant] that it is doing so. SaskPower has not advised [the Complainant] the purpose for which it collects this personal information.
2. The collection, use, and disclosure of [the Complainant’s] AVL data is not reflected anywhere in SaskPower’s Privacy Policy. Indeed, the collection, use, and disclosure of [the Complainant’s] AVL data is not reflected – or circumscribed – in any SaskPower Policy. This breaches s. 24.1 of FOIP.
3. SaskPower uses [the Complainant’s] personal information for investigative and disciplinary purposes (or contemplation of same). This is a purpose different from that for which it is collected, contrary to s. 28 of FOIP.
4. SaskPower lacks any – alternatively, adequate – administrative, technical, and physical safeguards regarding how [the Complainant’s] information is collected, used, or disclosed.

[5] By letter dated October 31, 2025, SaskPower advised the Complainant, in part, as follows:

Upon reviewing this matter, we have determined that your Complaint has no merit on the following bases: (1) the Complaint is frivolous and vexatious; (2) the subject matter of the Complaint is subject to consideration by another review mechanism; and (3) in any event, the Complaint has no merit. Pursuant to section 50(2) of The Freedom of Information and Protection of Privacy Act, SS 1990-91, c F-22.01 (the “Act”), it is our position that a further review of your matter is not warranted.

…

Beyond the above, there is no privacy breach with respect to the use of personal information by the AVL program, as SaskPower is permitted to use personal information for the purposes of the management and administration of its personnel.

SaskPower is currently developing a new policy regarding the AVL program, as part and parcel of the AVL Grievance. It is SaskPower’s position that the outcome of the AVL Grievance will address the substance of any remaining aspect of the Complaint.

Accordingly, we have determined that your Complaint should not proceed. We would alternatively suggest that your Complaint be held in abeyance, pending potential resolution of the AVL Grievance.

[6] On November 13, 2025, OIPC asked the Complainant to confirm whether a grievance had been filed, and a review process was engaged pursuant to the provisions in The Saskatchewan Employment Act (SEA).[2] On November 21, 2025, the Complainant’s legal counsel clarified that the Complainant was not a party to the Collective Agreement and that the relevant parties to the grievance were the Union and the Employer. The Complainant’s position was that their inherent rights under The Freedom of Information and Protection of Privacy Act (FOIP)[3] could not be extinguished simply because of the existence of another entity’s legal right pursuant to another piece of legislation [SEA].”

[7] By email dated December 10, 2025, OIPC advised SaskPower that the Complainant’s request for more information from SaskPower with respect to the AVL technology was not frivolous or vexatious. OIPC further advised that the possibility of a union grievance was immaterial to the Complainant’s right to pursue an allegation of a privacy breach with respect to their personal information.

[8] On December 18, 2025, OIPC provided notice of investigation to SaskPower and the Complainant. The purpose of the investigation would be to determine: (1) if SaskPower collected, used and/or disclosed the Complainant’s personal information, and for what purpose; and (2) if the collection, use and/or disclosure was authorized by FOIP. Both parties were invited to provide submissions.

[9] On January 29, 2026, SaskPower provided OIPC with an in-person demonstration of its AVL technology system and a draft of a proposed AVL policy. On February 17, 2025, SaskPower provided a submission along with a copy of is Corporate Vehicle Policy and its Code of Conduct materials. The Complainant did not provide a submission.

II         DISCUSSION OF THE ISSUES

1.          Jurisdiction

[10]  SaskPower qualifies as a “government institution” under section 2(1)(d)(ii) of FOIP. OIPC has jurisdiction to undertake this investigation under Part IV, section 33 of FOIP.

2.          The Collection, Use and/or Disclosure of the Complainant’s Personal Information

[11] The two central questions of this investigation are: (1) Did SaskPower’s AVL technology program collect, use and/or disclose the Complainant’s personal information, and for what purpose; and (2) Is the collection, use and/or disclosure authorized by FOIP?

[12] In its submission to this office, SaskPower did not directly address whether the AVL technology system collects, uses and/or discloses the Complainant’s personal information and for what purposes. Instead, the response guaranteed that the corporate Code of Conduct protects the personal information of its employees and limits the use of employee personal information in the following way:

It is not clear from the complaint which portions of this section are of concern to the complainant. SaskPower’s Code of Conduct (attached) contains provisions at pages 8 and 9 that govern how SaskPower protects the personal information of its employees and limits the use to purposes related to the carrying out of SaskPower’s business of operating the electrical utility for the Province of Saskatchewan.

[13] To address the Complainant’s questions or concerns, in this Investigation Report we will first describe AVL technology.[4] We will then address the question of collection, use and/or disclosure of personal information within the AVL technology framework.

(a)   AVL Technology and Its Use

[14] SaskPower currently employs AVL technology in 1,323 of its 2,400 fleet vehicles.[5] The previous technology employed by SaskPower only tracked location and was decommissioned on February 26, 2026. The conversion to the new technology was official as of January 1, 2026, but certain vehicles began using the new technology two years prior to that. AVL technology does not specifically track the identity of those who drive a SaskPower vehicle. Each SaskPower vehicle has a number associated with each vehicle. SaskPower may cross-reference the driver by means of vehicle assignment and vehicle number. AVL technology allows for the asset monitoring of vehicles including updates on the maintenance or health status of a vehicle.

[15] Governments and companies commonly use this new technology, and it has been found to be helpful for a litany of reasons. The reasons include, among other things, improving preventive maintenance on vehicles, and the managing of costs because the technology tracks idling and associated fuel costs.

[16] SaskPower provided a demonstration of its AVL technology to this office which proved that there are economic and legal aspects associated with this technology that may be of great assistance. SaskPower can monitor and track its fleet vehicles and learn things an employer has every right to know, such as: where a company vehicle moves in real time[6]; where a company vehicle moved throughout the entire day[7]; the amount of mileage put on a company vehicle in any given day; the amount of fuel consumed per day; whether a seatbelt was used; and if a vehicle moved over the legal speed limit.

[17] SaskPower only runs data reports on exceptions. This means any activity that is outside the norm or company policy. For example, AVL technology provides for a “seatbelt use report” that identifies those who do not observe the current safety standards associated with the laws of Saskatchewan. AVL technology also provides data on those drivers who do not observe the driving speed limits as set by the province.

[18] SaskPower added that central administrators of the technology have super-user access, while other employees may have access limited to the “need to know’ associated to their employment duties.[8]

[19] Finally, SaskPower demonstrated that there is an audit function that allows administrators to see who has accessed what data. Audit logs are available in the case of the need to review in circumstances where there may be an allegation of “snooping” or other kinds of privacy breaches. Retention and destruction of records is tied to the life of the vehicle, data is destroyed six years after a vehicle is out of service.[9]

(b)   Personal Information

[20] SaskPower chose not to reveal precisely what or whether it has collected any of the Complainant’s personal information through the use of AVL technology in its corporate vehicle. Without a doubt, the demonstration assisted greatly in our ability to understand the nature and scope of vehicle data that can be collected by means of AVL technology. In turning to the issue of whether personal information may be collected through the use of this advanced technology, it is crucial to analyse the personal dimension of the data. That is, what may a corporation learn about a driver or their behaviour as the result of analyzing AVL technology data.

[21] Section 29(1) of FOIP applies to “personal information” as defined by the non-exhaustive list in section 24(1) of FOIP. Personal information is information about an identifiable individual, that is personal in nature. Identifiable individual means a person who can reasonably be identified through the disclosure of the information. The information must be reasonably capable of identifying someone: (1) either directly; or (2) because it allows for an accurate inference to be made because of the context of the information. “Personal in nature” means the information reveals something personal about the individual.[10]

[22] Several access and privacy commissioners across Canada have considered tracking systems and whether the collected information can constitute personal information if there is a personal dimension to the nature of the information. The Office of the Information and Privacy Commissioner of Alberta (AB OIPC), explained the meaning of “personal dimension”:[11]

[para 18] Past orders of this office have held that information about the representative of an organization will be personal information if it has a personal dimension, such as when the information is about the representative acting as an individual citizen or has personal consequences for the representative in that capacity. In Edmonton (City) v Alberta (Information and Privacy Commissioner), 2016 ABCA 110 (CanLII), the Alberta Court of Appeal considered this approach, under both the FOIP Act, and PIPA, to be reasonable. The court said:

In general terms, there is some universality to the conclusion in Leon’s Furniture that personal information has to be essentially “about a person”, and not “about an object”, even though most objects or properties have some relationship with persons. As the adjudicator recognized, this concept underlies the definitions in both the FOIPP Act and the Personal Information Protection Act. It was, however, reasonable for the adjudicator to observe that the line between the two is imprecise. Where the information related to property, but also had a “personal dimension”, it might sometimes properly be characterized as “personal information”. In this case, the essence of the request was for complaints and opinions expressed about Ms. McCloskey. The adjudicator’s conclusion (at paras. 49-51) that this type of request was “personal”, relating directly as it did to the conduct of the citizen, was one that was available on the facts and the law.

[para 19] Applying this principle to the complaint, the data that would be collected by the GPS tracker is not merely information about a vehicle and its location, but about the individual operating the vehicle. I draw support for this finding from the purpose of the Organization’s collection: to promote personal safety. The Organization’s collection of vehicle data is meant to promote the safety of citizens, to characterize the Organization’s purposes in the terms used by the Alberta Court of Appeal. Given that the data that would be collected would enable the Organization to determine the physical location of the contractor, as an individual, which could be expected to have personal consequences for the contractors as individuals — as the Complainants argue — I conclude that the data that would be collected has a personal dimension.

[Emphasis added]

[23] The Office of the Information and Privacy Commissioner of British Columbia (BC OIPC) similarly considered that information collected through GPS tracking systems can constitute personal information because the data collected can be directly attributed to a particular individual, “either alone or when combined with other sources of information” and is “collected and used for a purpose related to that individual.”[12]

[24] In paragraph [16] of this Investigation Report we have listed various types of data that may be collected with respect to SaskPower vehicles by means of AVL technology. If one combines this data with other available sources of data or information, such as vehicle assignment records, SaskPower may make significant conclusions with respect to individual driver behaviour. Such a list may include:

[25] In theory, it is what the AVL technology data reveals about a driver, or their patterns of behaviour, that gives the data a personal dimension such that this information may be considered personal information. Over a period of time, this personal information may be used within the human resources context and may constitute employee history which brings this analysis under the jurisdiction of FOIP.[13]

[26] Sections 24(1)(b) and (k)(i) of FOIP are engaged:

24(1) Subject to subsections (1.1) and (2), “personal information” means personal information about an identifiable individual that is recorded in any form, and includes:

…

(b) information that relates to …employment history of the individual …in which the individual has been involved;

…

(k) the name of the individual where:

(i) it appears with other personal information that relates to the individual; or

[27] Personal information is clearly involved but the analysis must try to clarify the extent of the involvement.

(c)   SaskPower Authority to Collect/Use Personal Information by mean of AVL Technology

[28] The Complainant is concerned about the collection and use of their personal information via AVL technology. Sections 25, 26 and 28 of FOIP are engaged. These sections provide a frame of reference for this section of the analysis:

Purpose of information

25 No government institution shall collect personal information unless the information is collected for a purpose that relates to an existing or proposed program or activity of the government institution.

Manner of collection

26(1) A government institution shall, where reasonably practicable, collect personal information directly from the individual to whom it relates, except where:

…

(f) the information is collected for the purpose of:

(i) management;

(ii) audit; or

(iii) administration of personnel;

of the Government of Saskatchewan or one or more government institutions;

Use of personal information

28 No government institution shall use personal information under its control without the consent, given in the prescribed manner, of the individual to whom the information relates, except:

(a) for the purpose for which the information was obtained or compiled, or for a use that is consistent with that purpose; or

(b) for a purpose for which the information may be disclosed to the government institution pursuant to subsection 29(2).

[29] SaskPower submitted that to the extent that there is employee personal information collected and used by the AVL system, the authority to do so is supported by section 29(2)(l) of FOIP:

29(2) Subject to any other Act or regulation, personal information in the possession or under the control of a government institution may be disclosed:

…

(l)for the purpose of:

(i) management;

(ii) audit; or

(iii) administration of personnel;

of the Government of Saskatchewan or one or more government institutions;

[30] OIPC has previously adopted the following definitions: [14]

• Collection means to bring together, assemble, accumulate or obtain personal information from any source by any means.

• Purpose means the purpose for which personal information was obtained or compiled, the object to be attained or the thing intended to be done, e.g., the administration of a program, the provision of a service or other activity. The purpose of a collection means the reason(s) the personal information is needed and the use(s) that the government institution will make of the personal information.

• Relates to should be given a plain but expansive meaning. The phrase should be read in its grammatical and ordinary sense. There is no need to incorporate complex requirements (such as “substantial connection”) for its application, which would be inconsistent with the plain unambiguous meaning of the words of the statute. “Relating to” requires a purpose with some connection to an existing or proposed program or activity of the government institution.

• Existing means that the program or activity must be in place at the time the personal information is collected.

• Proposed means something offered for consideration or acceptance; a suggestion. To put forward an idea or plan for consideration. In this context, it means the personal information was collected for a purpose relating to a program that is at the stage of being proposed but not yet existing.

• Program means formally recognized activities or functions designed to deliver specific services that are related to a specific subject matter or topic. Programs do not refer to computer programs.

•  Activity is an individual action designed to assist in carrying out an operating program. For example, skills training to assist a social assistance recipient to return to the workforce is one facet of the overall program. Driver training is required to determine eligibility as part of a licensing program.

• Use indicates the internal utilization of personal information by a government institution and includes the sharing of the personal information in such a way that it remains under the control of the government institution.

[31]  The collection of employee personal information must relate to an existing or proposed program or activity in order to comply with the requirements of section 25 of FOIP. SaskPower explained that the purpose of the collection of information through its AVL technology is primarily related to safety. This submission is supported by the fact that SaskPower only resorts to the AVL technology data reports in cases of exception:

The AVL system is used as a tool to manage workflows and assist in ensuring the safety of our field employees, many of whom work alone. Knowing the physical location of the vehicle greatly reduces the response time if a remote worker has a safety incident or a delayed check-in.

[32] The purposes for the collection as outlined by SaskPower is legitimate and consistent with the requirement to indirectly collect personal information as afforded by section 26(1)(f) of FOIP. Still, it is incumbent upon SaskPower to ensure that it has communicated this to its employees. Each type of data collection, the purpose and the FOIP authority must be clearly stated in the SaskPower polices and procedures.

[33] For example, the SaskPower Corporate Vehicle Policy does not speak directly to the collection of employee personal information by means of AVL technology. While this document is silent on the collection of personal information, it is careful to outline specific limitations on the use of a company vehicle. It is important that this document be amended to clearly state what kind of information may be collected for the purposes of reviewing employee use of vehicles.

[34] Similarly, the SaskPower Code of Conduct (Code) omits mention of the collection of employee personal information through AVL technology. The Code contains essential provisions related to confidentiality of personal information and the prohibition of the use of this information save for on a “need to know” basis within the company. Still, the Code should communicate that the data obtained by means of AVL technology is subject to the prohibition against “snooping” and/or privacy breaches and may only be accessed on a “need to know” basis.

[35] SaskPower provided this office with a draft copy of a proposed Automatic Vehicle Location (AVL) Policy (AVL Policy). At the time of this Investigation Report, this policy is not in force. We have provided what we hope is helpful feedback to SaskPower and we see the provision of this document for our review as a clear act of good corporate citizenship on its part. Because the draft policy is not finalized, we reserve the right to comment further in this Investigation Report.

[36] We have concluded that SaskPower has the authority to collect employee personal information by means of AVL technology for its identified purposes under sections such as 26(1) and 29(2)(l) of FOIP. This being the case, employee consent is not required as long as the employees are fully informed. At the very minimum, any corporate policies or documents should provide notice to employees of what pieces of personal information are being collected, for what specific purposes and in what circumstances.

[37] Without clearly identifying all the data elements collected and for what purposes, SaskPower has not properly established its authority to collect under FOIP.

[38] Section 24.1 of FOIP requires that SaskPower establish policies and procedures to maintain administrative, technical and physical safeguards as follows:[15]

Duty of government institution to protect

24.1 Subject to the regulations, a government institution shall establish policies and procedures to maintain administrative, technical and physical safeguards that:

(a) protect the integrity, accuracy and confidentiality of the personal information in its possession or under its control;

(b) protect against any reasonably anticipated:

(i) threat or hazard to the security or integrity of the personal information in its possession or under its control;

(ii) loss of the personal information in its possession or under its control; or

(iii) unauthorized access to or use, disclosure or modification of the personal information in its possession or under its control; and

(c) otherwise ensure compliance with this Act by its employees.

[39] The purpose of establishing administrative, technical and physical safeguards supports a government institution’s “duty to protect” personal information, especially that of its employees. Inadequate policies and procedures, and other materials such as consent documents or notices, can lead to privacy breaches. This occurs most frequently when personal information is collected, used and/or disclosed without proper FOIP authority.[16]

[40] When further developing its AVL Policy and other materials, SaskPower may be guided by decisions from other jurisdictions when addressing how it collects employee personal information and for what purposes. One such resource is a summary by the Privacy Commissioner of Canada (PCC), Use of personal information collected by Global Positioning System considered, 2006 (PIPEDA Case Summary 351). [17] PCC has summarized considerations made with reference to vehicle Global Positioning System (GPS) tracking based on several complaints received from employees of a telecommunications company. In PIPEDA Case Summary 351, PCC considered various purposes for the collection of employee personal information including managing workforce productivity, safety and development, and asset protection and management. To assess the appropriateness of using GPS to meet those purposes, the Assistant Commissioner considered the following questions, which are helpful to SaskPower as it further develops its AVL Policy and other materials:

• Is the measure demonstrably necessary to meet a specific need?
• Is it likely to be effective in meeting that need?
• Is the loss of privacy proportional to the benefit gained?
• Is there a less privacy-invasive way of achieving the same end?

[41] The closing comments of PIPEDA Case Summary 351 clearly illuminated the need for organizations to balance the needs of an organization with the rights of an employee to privacy:

With respect to limiting the collection and use of information, the Assistant Commissioner noted that, generally speaking, “function creep” is not acceptable. In other words, the purposes and uses of a particular technology should be precisely specified, and that technology should be restricted to its intended purposes.

She stated that, organizations, in their quest to be proactive, often resort to technology in anticipation of problems or as a means of maintaining competitiveness. In addition to the problems that arise from function creep, the individual’s rights are slowly eroded by the cumulative effects of measures intended to meet the bottom line. She cautioned all organizations subject to the Act that the effects on the dignity of employees of all of the measures in place – taken as a whole, not just as one measure alone – must be considered in balancing the rights of the individual to privacy and the needs of organizations to collect, use or disclose personal information for appropriate purposes. She was pleased that the company at the centre of these complaints had taken steps to recognize the dignity of its employees by instituting the policy on the use of GPS with respect to employee management. Such a measure, she noted, helps maintain that balance in the workplace.

[Emphasis added]

[42] Further guidance can be found in BC OIPC Order P12-01.[18] In that Order, the corporation Schindler Elevator Corporation (Schindler) collected and used data elements such as vehicle engine stop/start times, speeding, braking and acceleration for employee management and safety purposes. Schindler argued it had a duty to protect others on the road from its employees who may not drive safely and to raise awareness amongst employees about safe driving.

[43] BC OIPC differentiated between work product, or information collected as part of employment or business responsibilities, from personal information collected through the GPS for things like performance management. BC OIPC found that location data discloses where an employee is at any given time and could be used by Schindler to monitor “time theft”, or when an employee uses work time for personal purposes or otherwise misrepresents their time. This type of collection is legitimate, but the employee has a right to know.

[44] Policies or procedures to be developed with respect to AVL technology should also reference the “need to know” and “data minimization” principles underlying sections 28 and 29 of FOIP. We have previously addressed the “need to know” principle. “Data minimization” means the collection, use and/or disclosure of the least amount of employee personal information required for a purpose.[19] Appropriate notification of these two purposes with specific reference to AVL technology support the role-based access SaskPower already has in place. It also serves to inform employees of SaskPower’s authority to collect, use and/or disclose each type of employee personal information.

[45] Prior to implementing any new project, program or process that has a bearing on personal information and to ensure compliance with FOIP, it is best practice for a government institution to first conduct a Privacy Impact Assessment (PIA).[20] A PIA is a living document that may be used to measure gaps in administrative, technical or physical safeguards. This includes the need to inform employees of the purpose for collecting personal information as mandated pursuant to section 26(2) of FOIP.[21] SaskPower may find it helpful to conduct a PIA to clearly identify the adequacy of its safeguards and to clearly ascertain the FOIP authority in this case. This office would be pleased to assist in any way that would be helpful.[22] Through a consultation, OIPC cannot design, approve or endorse any policy, procedure or other material, but we are always happy to provide helpful feedback to governmental and municipal stakeholders.

III       FINDINGS

[46] OIPC has jurisdiction to conduct this investigation under section 33 of FOIP.

[47] Personal information is collected by means of the use of AVL technology, though it is unclear to what extent.

[48] SaskPower has the authority to collect employee personal information through its AVL technology for purposes such as employee safety, the management or administration of personnel under sections 25 and 26(1)(f) of FOIP.

[49] SaskPower has not demonstrated through its policies, procedures and other materials submitted to this office, the extent of its collection of employee personal information through AVL technology, the precise purpose for which this information is collected (if it is collected), and how each purpose is authorized by FOIP.

IV        RECOMMENDATIONS

[50] I recommend that within 30 days of this Investigation Report being issued that SaskPower undertake a Privacy Impact Assessment to identify the adequacy of its safeguards and to determine whether FOIP authorizes the collection, use and/or disclosure of employee personal information through AVL technology.

[51] I recommend that within 90 days of the issuance of this Investigation Report, SaskPower finalize its corporate policy with respect to the use of AVL technology and clearly state the purpose and FOIP authority for the collection, use and/or disclosure of employee personal information.

[52] I recommend that within 90 days of the issuance of this Investigation Report, SaskPower notify the Complainant as to what personal information has been collected through the AVL technology installed on the Complainant’s vehicle, outline the purpose for the collection and the FOIP authority for such.

Dated at Regina, in the Province of Saskatchewan, this1st day of May, 2026.

Grace Hession David

Saskatchewan Information and Privacy Commissioner

[1] Words in square brackets are inserted by OIPC to protect the Complainant’s identity.

[2] The Saskatchewan Employment Act, SS 2013, c S-15.1, as amended.

[3] The Freedom of Information and Protection of Privacy Act, SS 1990-91, c F-22.01, as amended.

[4] The AVL or fleet technology software used is called GEOTAB.

[5] This data is current as of March 13, 2026.

[6] This data is viewed electronically on a map by limited individuals within SaskPower who have been granted access.

[7] The SaskPower Corporate Vehicle Policy allows employees who are assigned company vehicles to take the vehicles home at night with the understanding that personal use is prohibited. This allowance is for the convenience of employees who work long hours or unusual hours.

[8] SaskPower walked OIPC through the different levels of role-based access and who could view what data according to their role within the company. For example, a manager could only view the data associated with their direct reports, and they could only view limited types of data as it pertained to the employment duties in question.

[9] SaskPower stated it follows its Administrative Records Management and Operational Records Management schedules for retention and destruction of records associated with the AVL technology.

[10] OIPC Review Report 076-2025 at paragraph [39].

[11] AB OIPC Order P2019-04 (July 8, 2019) at paragraphs [18] and [19].

[12] BC OIPC Order P13-01 (August 28, 2013) at paragraphs [15] to [20].

[13] OIPC Investigation Report 283-2021 at paragraphs [8] and [9].

[14] OIPC Investigation Report 139-2023 at paragraphs [29], [32] to [37] and [44].

[15] OIPC Investigation Report 293-2024 at paragraph [45].

[16] Ibid, at paragraph [29].

[17] PCC PIPEDA Case Summary #351: Use of personal information collected by Global Positioning System considered.

[18] BC OIPC Order P12-01 at paragraphs [108] to [113].

[19] OIPC Investigation Report LA-2013-002 at paragraph [61].

[20] OIPC Resource: Privacy Impact Assessment – A Guidance Document.

[21] OIPC Investigation Report 139-2023 at paragraph [52].

[22] OIPC Consultation Request Form.