B.C. Civil Liberties Association

All employees, whether they are unionized or non-unionized, are entitled to a degree of privacy in the workplace.
However, an employee’s right to privacy is not absolute. That right is limited and balanced against the employer’s right to collect, use and disclose an employee’s personal information for purposes that a reasonable person would consider appropriate in the circumstances.  

Because circumstances and technology change, the balancing will always depend on the particular circumstances that exist at the time of the collection, use and disclosure. (1)

Privacy laws require employers to take care when engaging in activities that involve employees’ privacy and give advance notice to employees, minimize the amount of personal information collected, use the personal information for limited and specified purposes only, limit access to it, keep it secure and confidential, retain it for a limited period only, and dispose of it in a manner that protects its security and confidentiality.

There are a number of general principles that apply to employee privacy. The following are the key rules to remember:

1. In general, each of the privacy laws are designed to permit the employer to collect an employee’s personal information without having to ask for consent if the personal information is necessary in the circumstances, for the purposes of the employment relationship or for the purposes of continuing its business operations;
2. The employer can collect, use or disclose personal information for other purposes if it gets the employee’s consent;
3. Even when the employer is not required to get consent, it still must give notice to the employee of the purposes for which it collects, uses and discloses personal information;
4. The employer must always protect the information and limit internal sharing with other employees to a ‘need to know’ basis;
5. Except in a few limited circumstances, the employer must allow the employee to see the information if the employee makes a formal request for access.

These principles must always be applied by an employer in a reasonable manner. There is an overarching requirement that the purposes for the collection, use or disclosure must always be reasonable and appropriate in the circumstances.    

Figuring out what is reasonable involves looking at whether the infringement of the employee’s privacy is in proportion to the employer’s need for the personal information: the greater the impact on employee privacy, the more important the business need has to be. (2)

(2) Re Agropur, Division Natrel and Teamsters Local Union No. 647 (Slotnick), 2008 CanLii 66624 (ON L.A.). For those readers interested, this grievance arbitration decision contains discussion of competing lines of authority and references numerous other arbitration cases.