# 2021-174 Others

Case summary

F&R Date: 2022-02-02

The grievor grieved her supervisor sending an unencrypted email containing performance-related information to a personal email account the grievor shared with her spouse. As redress, she requested an acknowledgement that her supervisor breached several privacy and ethics policies. The Initial Authority (IA) did not consider the grievance for technical reasons.  

The grievor confirmed that she conducted Canadian Armed Forces (CAF) business from the personal email account she shared with her spouse due to CAF/Department of National Defence network limitations at the beginning of the COVID-19 related work from home order. The grievor's supervisor said she was unaware the grievor shared the account with another person.

The Committee found on a balance of probabilities that because the grievor chose to provide the personal email account she shared with her spouse to her chain of command (CoC) for work-related exchanges, it was reasonable for the grievor's supervisor to send the performance-related email to that account, given it was work-related. 

The Committee found, however that once the CAF discovered that the grievor's spouse had access to personal information in the email account the grievor used for CAF business, it should have reported the potential privacy incident to the Department of Access to Information and Privacy in accordance with Defence Administrative Order and Directive 1002-4 - Privacy Incident Management. The Committee noted that according to the IA, the potential breach of sensitive information transmission protocol was reported to the grievor's supervisor's CoC and an investigation followed.

The Committee recommended that the Final Authority (FA) not afford the grievor redress.

FA decision summary

The Director Canadian Forces Grievance Authority (DCFGA), acting as the FA, agreed with the Committee's findings and recommendation. He noted that while it was unfortunate that personal email had to be used at the beginning of the COVID-19 pandemic stay-at-home order, this was reasonable in the circumstances and the grievor's consent was sought. The grievor was aware that the email address she had provided could be used for both Comptroller business and personnel matters such as her own conduct and performance and it was reasonable for her supervisor to use it for those purposes.