Previous Page (Back to Workplace Privacy main page)
Q. Why does my employer need to collect my personal information?
An employer may need to collect your personal information for a variety of purposes in order to manage the employment relationship. Some examples of purposes of collection are to:
• administer payroll and benefit plans;
• comply with tax and employment standards law requirements for record keeping and reporting;
• uphold statutory health and safety record keeping and reporting requirements;
• investigate workplace accidents and injury claims - possibly recording off-duty conduct;
• abide by human rights laws that may require employers to collect workplace statistics, prevent harassment or discrimination and stop the dissemination of hateful or obscene materials;
• gather evidence in employee discipline or discharge cases;
• investigate workplace harassment complaints or customer complaints;
• prevent theft or vandalism;
• protect trade secrets and other proprietary information;
• reduce risks of copyright infringement or defamation by employees through email and internet use;
• comply with warrants or other official requests from law enforcement;
• respond to court or regulatory body orders for a proceeding (e.g. a subpoena or production order);
• perform a credit or security check when hiring individuals for security sensitive positions;
• perform drug testing on individuals in safety sensitive positions, discipline cases or insurance matters;
• manage the virtual workplace for off-site employees working from home; and
• monitor productivity or customer interactions for “quality control.
Whether or not an employer has the right to collect your personal information for any of these purposes will depend on the statute that applies to your workplace, whether you are a unionized worker (and therefore what labour arbitrators have said about a given type of collection and its purposes), and the factual circumstances of each case.
The appropriateness of the collection will rest on:
• whether or not consent was obtained;
• the intrusiveness of the collection; and
• the purpose of collection.
The answer will ultimately depend on an overall balance between the employer’s legitimate business interests to manage the workplace and the employee’s privacy interests.
Q. What information about me can my employer gather?
Employees should be aware that technology has given employers a powerful ability to collect information from employees in several different ways. Some example of data collection are:
• background credit checks and criminal records;
• resumes, cover letters and job applications;
• video surveillance of work premises and off-duty conduct;
• Global Positioning Systems for couriers, delivery and transport workers;
• telephone monitoring;
• keystroke logging
• monitoring internet activities
• “smart” ID cards that track work attendance, access to the workplace, resources, and drug and dental plans;
• biometrics(fingerprint, handprint, voice and eye scanning to verify employee identity for security purposes);
• drug and alcohol tests; and
• workplace investigations.
Whether any particular method of collection is permissible depends on whether:
a) the employee was aware of the monitoring;
b) whether consent was obtained;
c) the intrusiveness of the collection;
d) the appropriate balance between employer and employee interests; and
e) the facts of the situation.
See additional information on how your employer can gather information about you.
Q. What information about me can my employer disclose?
Under federal privacy legislation, your consent is required for your employer to disclose your personal information to a third party. However, there are exceptions to consent. The following are certain circumstances under which your information can be disclosed without your express consent:
• information that is requested by an adjudicative body, court or law enforcement by law or regulation;
• implied consent allows sharing personal information within the organization and sharing information with third parties for administering health, pension, disability and other benefits and for compensation purposes;
• if an employee is managed by a third party, that third party can be privy to the employee’s personal employment information, as this type of information sharing is not considered “disclosure” under the Act (PIPEDA Case #145);
• third party insurance companies normally obtain express consent to disclose information to employers in their claim forms (PIPEDA Case #293).
See additional information on what your employer can disclose about you.
Q. Can I see what personal information my employer has about me?
Both federal and provincial privacy legislation provide employees with access rights to their personal information. Employees can access their personal information to ensure accuracy and completeness.
Access requests must be made by an employee in writing. The employer must respond to the request within various time limits, according to the governing Act. If the employer refuses access based on a statutory exemption, the employee must then be informed in writing. The employer must also provide the employee contact information for the federal or provincial privacy commissioner should the employee decide to appeal the employer’s refusal.
The Federal Privacy Commissioner has made the following rulings about what constitutes employee personal information and access rights to that information:
• an employee’s personal opinions expressed in the course of employment are not personal information (PIPEDA Case #15);
• opinions expressed by management and colleagues about another employee are the employee’s personal information (see the L’Ecuyer case below);
• even during litigation, employees still have access to their own personal information (PIPEDA Cases #285 and #87);
• arguably, unsolicited resumes are protected under PIPEDA, but there have been no findings from the Federal Commissioner on this issue; and
an employer can withhold an employee’s personal information if that information is protected by solicitor-client privilege and if it has already been generated in the course of a formal dispute resolution process such as a grievance process (PIPEDA Case # 330).
The Courts have ruled that employees may request access to disciplinary documentation and complaints made against them by others in L’Ecuyer v. Aéroports de Montréal;Upheld on appeal – [2004] F.C.A. 237.
In L’Ecuyer, an employee was denied access to complaints made against her and her disciplinary letters. The refusal letter was copied to two union representatives and the employer’s Labour Relations Coordinator. The Federal Privacy Commissioner held that the disclosure of the letter to the two union representatives was a breach of her privacy rights, but the disclosure to the Labour Relations Coordinator was not a breach of her privacy rights.
The Federal Court took a different view. Due to the Coordinator’s role within the organization (he had been involved in her access application), the Court found that a reasonable person would find that the disclosure to him and the union representatives was appropriate. Justice Pinard stated at paragraph 26 that in a unionized environment, “it can reasonably be expected that correspondence between the employer and the unionized employee will also be sent to the latter’s union.
The union is the “exclusive spokesperson” or bargaining agent for its members. An employer risks being charged with conducting unfair labour practices under section 94(1) of the Canada Labour Code R.S., 1985, c. L-2), parallel provisions in provincial labour statutes, and the union security clause in the collective agreement if the employer fails to disclose correspondence with employees to the union. An employer that directly communicates with employees by disclosing personal information without going through the employee’s certified bargaining agent risks being perceived as undermining the role of the union as the exclusive spokesperson for its members.
Q. What can I do if I think my employer has violated my privacy?
If your workplace is subject to privacy legislation, you can complain to your provincial privacy commissioner or the Federal Privacy Commissioner’s office if you believe that your employer has breached your privacy under that legislation.
If you are a unionized worker and you believe that your personal information was mishandled or your privacy has been compromised, you should follow your workplace’s internal dispute resolution process and consult your union representative. If you are a unionized worker and your employer is subject to privacy legislation, you may also choose to complain to the relevant privacy commissioner’s office for an alleged breach of applicable privacy law.
Employees who are not covered by privacy legislation or a collective agreement may choose to make a claim for breach of privacy or the duty of confidentiality in the courts. It should be noted, however, that there is no general common law right to workplace privacy yet recognized in Canadian law.
See additional information on the complaint process.
Back to Workplace Privacy main page
This page last updated: October 1st, 2007
