Collecting employee data

Keyboard stroke and internet monitoring, video surveillance and examining social media postings. These are just a few ways in which employers might legally monitor employees and job candidates, all of which are used.

Collecting employee data
Illustration: Isabelle Cardinal

Keyboard stroke and internet monitoring, video surveillance and examining social media postings. These are just a few ways in which employers might legally monitor employees and job candidates, all of which are used.

At present, employee monitoring is permissible in Canada if it is conducted in conformity with Canadian privacy statutes. But as privacy and data protection concerns gain increasing prominence in the workplace, are employees’ data and privacy rights being adequately protected, and are employers aware of employee rights and their own obligations?

“We have the ability to collect, use and store more information than we ever did before,” says Suzanne Kennedy, an associate counsel in Harris & Company LLP in Vancouver, who practises in access and privacy law.

“Technology allows us to store vast amounts of information,” she says, but “that also creates risk. In the event of a privacy breach, if you’ve hung on to all your email for the past 20 years, you’re so much more exposed.” Although technology allows us to do much more than we could in the past, “we have to be conscious of the risks” inherent in it, she says.

“Workplace privacy is a complicated issue,” as there are two sets of legitimate rights and interests at play, says Ashley Brown, a partner in Filion Wakely Thorup Angeletti LLP in Toronto, who practises labour and employment law. One the one hand, employees have a right to know how their information is being used and collected, and on the other, employers have the right to gain necessary information to properly manage their business operations. But those rights don’t have to conflict.

Technology such as video surveillance, which is often used in workplaces across Canada, can be mutually beneficial for employees and employers to safeguard work premises and employee safety, Brown says. And GPS monitoring on work vehicles can provide helpful information in locating employees in emergencies.

“There’s not always a conflict,” she says. “It can be a mutual benefit.”

Where surveillance is covert in areas of the workplace where employees would have a reasonable expectation of privacy, such as washrooms or changerooms, they would have recourse under provincial legislation. Although Ontario has no privacy legislation for provincially regulated, private sector employers, the creation of a new tort, “intrusion upon seclusion,” from an Ontario Court of Appeal decision in Jones v. Tsige in January 2012, “would provide protection to any citizen in Ontario, including in the workplace context.”

The Personal Information Protection and Electronic Documents Act, or PIPEDA, is federal legislation enacted in 2000 to protect personal data privacy. It governs how private sector organizations collect, use and disclose personal information in the course of their business, but it applies to employees’ personal information only in federally regulated organizations such as airports and airlines, banks and telecommunications.

British Columbia, Alberta and Quebec have enacted privacy legislation for provincially regulated, private sector employers. British Columbia and Alberta each has a Personal Information Protection Act, which is underpinned by the principles of PIPEDA but applies  to provincially regulated organizations.

British Columbia’s PIPA came into effect in January 2004 and is modelled on PIPEDA’s 10 fair information principles, says Kennedy: accountability; identifying purposes; consent; limiting collection; limiting use, disclosure and retention; accuracy; safeguards; openness; individual access; and challenging compliance.

“For workplaces, we limit to collecting what’s reasonably necessary under the circumstances. Employers must justify why they need that information,” she says, adding that “these are common principles throughout Canada.”

Alberta’s PIPA, along with other privacy legislation, “achieves the right balance, erring on the right side of personal information protection and allowing for use of information without consent in express circumstances,” says Timothy Mitchell, a labour and employment lawyer at McLennan Ross LLP in Calgary. Even in express circumstances, “those exceptions are prefaced in terms of whether the deviation considered reasonableness,” he says. “The reasonableness test underpins all the legislation; it balances the rights of employer and employees.”

In Ontario, Bill 14, the Personal Information Protection Act was introduced and passed second reading in 2018, but it died on the order paper with the change in government. With more Conservative governments across Canada, which are employer-protective, it is unlikely that more restrictions will be placed on employers through provincial privacy workplace legislation, says Stuart Rudner, principal of Rudner Law in Markham, Ont., who practises on both the employer and employee side.

We may hear about the massive data breaches, he says, but not the less significant ones, including those of small employers who have “incredible amounts of personal information on their employees.”

“We fall back on common law,” says Rudner. Now that the tort of intrusion upon seclusion exists, an employee might sue for breach of privacy if their private information is disclosed. Yet that doesn’t eliminate the need for provincial legislation, says Rudner, although “it’s unlikely we’ll see that in Ontario in the next three to four years.”

But even without provincial legislation in place, employees are not without recourse, both in the context of civil suits and labour arbitration, says Brown. “Adjudicators have held employers accountable where they’ve acted unreasonably or unethically. So, it’s not a free-for-all, even without that provincial legislation in place.”

The Office of the Privacy Commissioner of Canada’s guidelines on privacy at work indicate that an employer’s need for information should be balanced with an employee’s right to privacy. For personal information including pay and benefit records, personnel files, video or audio tapes and records of web browsing, electronic mail and keystrokes, the privacy commissioner outlines what is needed to establish and maintain that balance:

•    The employer should say what personal information it collects from employees, why it collects it and what it does with it.
•    Collection, use or disclosure of personal information should normally be done only with an employee’s knowledge and consent.
•    The employer should only collect personal information that’s necessary for its stated purpose and collect it by fair and lawful means.
•    The employer should normally use or disclose personal information only for the purposes for which it is collected and keep it only as long as it’s needed for those purposes, unless it has the employee’s consent to do something else with it or is legally required to use or disclose it for other purposes.
•    Employees’ personal information must be accurate, complete and up to date.
•    Employees should be able to access their personal information and be able to challenge the accuracy and completeness of it.

In Alberta, “I think there is a good body of case law flowing out of [the Office of the Privacy and Information Commissioner] regarding the application of the legislation to biometrics to video surveillance in the workplace to surreptitious monitoring of emails and the test that OPIC adheres to is this reasonableness test,” says Mitchell.

And if a new technology is created to monitor employees’ whereabouts in a building? From a privacy perspective, is the legislation robust enough to address this? Mitchell says he believes it is. “It’s quite a flexible test.”

Brave new hiring

Privacy issues can also arise before an employee is even hired. According to one U.S. survey conducted in 2017, 70 per cent of employers used social media to screen candidates before hiring, up from 60 per cent in 2016; and three in 10 employers have an employee dedicated to researching candidates’ online personae.

“Privacy commissioners across the country have commented about the practice of employers looking to social media [accounts] when they’re hiring,” says Kennedy. Concerns arising from a privacy perspective are a) does the candidate know their account is being monitored, “and have you given them notice you’re collecting,” information; b) “are you really collecting information that you need in order to make a decision about hiring?” And c) is what an employer sees even reliable?

Employers may also start to monitor social media accounts of employees for commentary, where employee misconduct is suspected, and employers could be challenged on the privacy compliance of that practice, says Kennedy. “But employers who are routinely just monitoring what employees do online all the time would certainly [run afoul] of privacy laws.”

One interesting trend (although not directly related to employee privacy) is the use of artificial intelligence to screen employees and gauge their competence for certain jobs. Last October, announced it was scraping an AI tool that had shown a bias in favour of male applicants for its software developer jobs. This would include penalizing resumés including the word “women’s” and downgrading graduates of two women’s colleges in the United States.

And Rudner sees a privacy risk in hiring using third parties; a private third-party company may tell you “who the best candidate is for a job,” he says, “but what are they doing to make sure that [candidate] data is protected?”

What employers should know

Many employers have not yet come to grips with what they can and can’t do, says Rudner. “I think there’s just so much confusion out there. Most employers have no ill intent; they’re trying to protect their businesses and assets, [and] it’s so easy to install video cameras or monitor key strokes on a computer.” But they don’t understand the limits of what they can legally do, he says.

The flip side of that is all the employee personal information, including contact details and social insurance numbers, that especially smaller employers may not be taking proper steps to protect. “That may be sitting on a hard drive somewhere.”

In short, says Rudner, employers “shouldn’t gather more information that they can justify,” for reasons of both employee privacy and data protection. “You don’t need to have dates of birth, drivers’ licence numbers stored on a hard drive,” even though it may be tempting for employers to store as much information as possible.

Workplace monitoring may be acceptable absent a collective agreement provision that prohibits it, says Brown, but it should not be overly intrusive (e.g., video cameras in private areas), and it should “serve a legitimate business purpose in order for the methodology to be deemed reasonable,” she says. “Just because [employers] can use some methods doesn’t mean they should.”

Where covert surveillance might be appropriate, through monitoring email and cellphone use, employers should give employees advance warning, Brown says. And since transparency is essential to developing a good workplace culture and bond of trust between employees and their management team, everyone should be aware of monitoring methods being employed, data being collected and how it will be used.

With the rise of technologies that are cheap and easy to use, it can be easy for “employers to just charge ahead and use them without fully appreciating” what they’re doing, says Kennedy.

“So, the challenge is to keep an eye on what they’re collecting and how it triggers the applications of these [privacy] principles.”

Recent articles & video

Law firm managers struggling to fill roles as demand for lawyers continues: recruiter report

Stikeman Elliott, McCarthy Tétrault assist in Osino’s $368 million sale to China’s Yintai

BC Supreme Court orders full compensation for victim in three-car collision

Alberta Court of Appeal upholds jurisdiction in cross-border divorce case

Federal Court denies anonymity for Uyghur applicants in permanent residence case

BC woman wins Provincial Court case against dentist for unauthorized and negligent dental work

Most Read Articles

BC lawyer ordered to pay up for attempting to use ChatGPT ‘hallucinations’ in application

Artificial intelligence hallucinations in legal research may become a thing of the past

BC Supreme Court deals with complex property and separation agreement dispute

US court says Baker & McKenzie LLP can face malpractice suit in Chicago