Workplace privacy issues are emerging as key issues for employers with Canadian-based workplaces. The Government of Canada and the Provinces of British Columbia, Alberta and Québec have adopted privacy legislation based on 10 key privacy principles. They are:
- identification of purposes for collecting confidential information;
- limitation of collection;
- limitation of use, disclosure and retention;
- security safeguards;
- individual access; and
- challenging compliance.
While privacy legislation applies to all business operations, many employers have found the application of privacy laws to human resources matters to be particularly challenging because of the extensive collection of personal information required by human resources departments.
Generally speaking, employers in British Columbia, Alberta, Québec and in the federal jurisdiction must:
- conduct a privacy impact assessment;
- appoint a privacy officer.
An employer must only collect, use and disclose personal information about an employee (or prospective employee) if it is reasonable to do so.
Information about an employee that is unnecessary or not relevant to the employment relationship is likely unreasonable.
In most cases, personal information must be collected, used or disclosed only with the consent of the employee. In some jurisdictions, consent may be implied, depending on the nature of the information and how it is collected. Employers collect information in a number of ways: résumés, reference checks, job applications, benefit enrolment forms, discipline notes, evaluations, payroll data, sick notes and insurance forms, to name only a few! An employee, for the most part, is entitled to review information collected by the employer and challenge its accuracy. The employer must safeguard all personal information. Privacy laws require that adequate security measures be in place.
In Alberta, there is a mandatory obligation to report if personal information has been inadvertently disclosed and there is a reason to believe there may be harm to the employee (for example, a laptop containing human resources information being lost or stolen, which would lead to identity theft of employees).
Many jurisdictions, Ontario being the major exception, have privacy commissions. Employees who cannot access their personal information with the employer may lodge formal complaints. Also, if an employee believes there has been an unreasonable collection, use or disclosure of their personal information, they may lodge a complaint. Other aspects of workplace privacy in Canada are emerging with regard to technologies (such as video surveillance, voice mail recording and office computers) and the wide usage of social media.
Canadian courts have generally used the expectation of privacy doctrine to determine whether an employer may search an employee’s personal files on a company computer. If there is no expectation of privacy, then it is less likely that an employee can complain.