Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic
Info Employer Disclose
Workplace Privacy - What information about me can my employer disclose?
The information provided on this webpage is of a general nature and does not constitute legal advice. Moreover, it addresses only some issues in information privacy, labour and employment law. If you have questions about privacy and your workplace, you should consult a lawyer, your union representative, or the human resources department of the organization you work for. For general information on private sector data protection laws, see CIPPIC’s webpage on Privacy. CIPPIC welcomes feedback and comments on this webpage at cippic@uottawa.ca.
Under privacy legislation, your consent is required for your employer to disclose your personal information to a third party. However, there are exceptions to consent. The following are certain circumstances under which your information can be disclosed without your express consent:
• information that is requested by an adjudicative body, court or law enforcement by law or regulation;
• implied consent allows sharing personal information within the organization, and sharing information with third parties for administering health, pension, disability and other benefits and for compensation purposes;
• if an employee is managed by a third party, that third party can be privy to the employee’s personal employment information, as this type of information sharing is not considered “disclosure” under the Act (PIPEDA Case #145)
• third party insurance companies normally obtain express consent to disclose information to employers in their claim forms (PIPEDA Case #293).
• Can my employer disclose my personal information to the union?
• Can my employer disclose work performance statistics and salary information?
• Can my employer provide my personal information to a foreign government?
• Can my employer provide employment references?
Q. Can my employer disclose my personal information to the union?
Labour boards have ordered disclosure of addresses, telephone numbers and salary information of bargaining unit members based on the union’s duty of representation under labour legislation. The following are three examples of ordered disclosures.
CAW-Canada v. The Millcroft Inn Ltd.,[2000] Ont. L.R.B. Rep. July/August 665
In this seminal labour law case, the Ontario Labour Relations Board found that the union’s basic rights to establish and maintain a collective bargaining relationship are a product of legislation and are independent of employer consent.
As an agent of the employees responsible for protecting a wide range of employees legal interests, the union was entitled to take full instructions from its members in order to properly represent them. This required that the union be able to communicate effortlessly with its members and the employer was ordered to provide the union with the names and addresses of its members.
Atomic Energy of Canada Limited, [2001] CIRB no. 110
This case was decided before PIPEDA came into force, but still stands as settled law. In this case, the union learned about alleged unilateral promotions. The union requested information on the individual promotions and their corresponding salary increases. Section 50 of the Canada Labour Code requires that the employer and union bargain in good faith and make every reasonable effort to enter into a collective agreement. The Canada Industrial Relations Board reasoned that if the Canada Labour Code requires that the information be disclosed, it must be disclosed, and ordered the employer to provide the union with the requested information.
Monarch Transport Inc. and Dempsey Freight Systems Ltd., [2003] CIRB no. 249
In this case, the union alleged that the employer violated section 94(1)(a) of the Canada Labour Code by failing to provide it with an employee list, indicating correct addresses and telephone numbers for all of those employed within the bargaining unit. The employer cited its obligations under PIPEDA as the basis for refusal. The Canada Industrial Relations Board did not accept the employer’s argument and ordered it to produce the requested information to the union.
The Monarch decision sets out two basic factors which govern the disclosure of employee personal information to the union:
- the union’s interest in obtaining requested information is related to legitimate labour relations interest; and
- whether the employer’s refusal to give information to the union amounts to interference with the union’s capacity to represent employees of the bargaining unit.
In at least one instance, however, the Federal Privacy Commissioner recommended that an employer obtain written consent before disclosing a list of employees who were receiving severance packages to the union. The list contained the employees' names, identification numbers, seniority numbers, and social insurance numbers, and was sent to the union without the employees’ knowledge or consent. The employer followed the Commissioner’s recommendations, and also removed unnecessary personal information from the list. (Settled Case Summary #4 Company amends employee list it sends to union)
Q. Can my employer disclose work performance statistics and salary information?
The Federal Privacy Commissioner has determined that “work product” is not personal information and can be disclosed. Work product is distinguished from personal “professional information” in that it is a service or product generated in the course of employment (PIPEDA Case #153).
In contrast, individual sales, call volume, and other employee statistics have been to be found personal information about an employee’work performance (PIPEDA Cases #153 and #220). Despite finding that workplace performance statistics constitute personal information, the Federal Privacy Commissioner has found that:
• collecting and disclosing individual workplace statistics is reasonable to monitor workplace performance (PIPEDA Case #220);
• informing employees of the practice of collecting and disclosing workplace performance statistics is sufficient for implied consent (PIPEDA Case #220); and
• certain business practices may imply employee consent if the information is reasonably expected to be shared within the organization (PIPEDA Case #87).
Q. Can my employer disclose my personal information to a foreign government?
Some employers choose to contract out the processing of employee personal information for compensation or benefits packages to companies that operate outside of Canada. In such instances, any personal information held by a service provider in another country is subject to data protection laws in that jurisdiction and may be accessed under that country’s laws.
In terms of personal information held in Canada, the Federal Privacy Commissioner and the B.C. Supreme Court confirmed that foreign laws and court orders cannot compel service providers to disclose employee personal information.
In 2004, a B.C. public sector union complained to the province’s Privacy Commissioner that government outsourcing of health insurance data processing made British Columbians’ personal information vulnerable to the search and seizure provisions of the USA PATRIOT Act.
The B.C. union’s complaint raised concerns that personal information transferred to Canadian affiliates of U.S. companies would be within reach of the PATRIOT Act. The union feared that third-party service providers operating in Canada could be compelled to disclose personal information in their custody and control vis à vis their American parent corporation. The union lost the case because it could not show that contracting out to service providers within the province violated government employees’ privacy under B.C.’s privacy legislation at that time, or the Canadian Charter of Rights and Freedoms.
Subsequent to the court ruling, the B.C. government decided to amend its privacy legislation to require B.C. organizations to contract with companies that agree to maintain custody and control of personal information within the province. PIPEDA, the federal private sector privacy legislation that B.C. modeled its provincial private sector statute on, contains no provisions that restrict employers to only contract within Canada
PIPEDA does, however, require employers to use “contractual or other means” to ensure that third-party service providers provide protection of personal information that is comparable to protection under Canadian law. PIPEDA also provides Canadian employees with “whistle blowing” protections if they notify the Commissioner that a U.S. affiliate is seeking to obtain information held in Canada to comply with a U.S. court or government order.
Foreign governments can legally request access to personal information through a mutual legal assistance treaty (MLAT). MLATs are cooperative agreements where federal government and law enforcement agencies obtain information held by organizations operating in Canada and provide that information to foreign governments or international institutions. MLATs pre-date and are independent from the USA PATRIOT Act. For more information on this issue, see the B.C. Privacy Commissioner’s comments on Privacy and the USA Patriot Act Implications for British Columbia Public Sector Outsourcing and the Mutual Legal Assistance in Criminal Matters Act, 1985, c. 30 (4th Supp.) M-13.6
Can my employer provide employment references?
The Federal Court of Canada has ruled that providing a poor reference (MacNeil v. Canada [2002] F.C.J. No. 363; 2002 FCT 277, Docket T-1092-95) and noting criminal charges on an employee’s record is not a privacy breach under the federal Privacy Act.
When an employer is contacted to provide a reference for a current or former employee, both public and private sector privacy legislation require that the employer obtain employee consent before disclosing personal information. Although not required by law, it would be considered prudent for non-regulated employers to follow this practice as well. Employer references should not contain information that is not true. This means that employers are not obliged to provide a positive reference if that reference would be untrue.
Section 4 of PIPEDA provides that the Act applies to personal information of employees of federally regulated organizations. However, it is unclear whether the definition of “employee” includes external applicants in job competitions and their resumés, job applications, and interview documentation. In any case, it would be good practice for an employer to treat this type of information as if it were personal information under privacy legislation. Some provincial privacy acts, such as Alberta’s PIPA have express provisions that apply to resumés and job applications.
Back to Workplace Privacy main page
This page last updated: October 1st, 2007
This webpage was researched and drafted by Louisa Garib, LL.M., and edited by CIPPIC 2007 summer intern Janet Lo.
