Employment relationships typically begin prior to the date the individual is hired – they often begin when the employee sends a resume in for the purpose of being considered for a job. In BC, employee personal information includes information about an individual collected, used or disclosed to establish the employment relationship, so even when you are still a candidate for employment, the employer has a duty to protect the privacy of your personal information.

The Information and Privacy Commissioner of BC has issued a set of Frequently Asked Questions on privacy rights during the hiring process.

What Happens to My Resume or Application?

If the employer has not advertised for a position or asked for your resume, it is not required to keep a copy of your resume or application on file. If it does not want to keep the resume or application on file, it has to take care to dispose of it carefully to protect the personal information it contains, either by shredding paper or deleting electronic copies.

If the employer decides to keep the resume or application for future use, it must protect the personal information and must respond to your request for access to the information and must tell you how it has been used and disclosed.

If it uses your resume or application to make a decision about you (including a decision to hire or not hire you) it must keep it for a year to allow you to have access to it if you request access.

What Kind of Information Do I Have to Give to the Employer Before I’m Hired?

Generally, an employer will be entitled to require information about your qualifications, education, experience, knowledge, skills and abilities. In BC, the employer may collect personal information that is necessary for the purpose of establishing an employment relationship, and does not need your consent to do so, although it must give you notice of the purpose for the collection and any use or disclosure of the information. Notice is generally given in a job application form, or by referring you to a privacy policy. The purposes must be reasonable and reasonably related to assessing you as a job candidate and establishing the employment relationship.

If the employer needs the information for some other purpose, it must tell you why, what the purposes are and get your consent. You have the right to refuse.

No employer is allowed to get your Social Insurance Number before it has made the decision to hire you and offered you the job, because the SIN is legally required by an employer only for limited purposes. So you are entitled to refuse to give your SIN until you have been hired.

If your employer is an organization in BC and wishes to use your SIN to confirm your eligibility to work in Canada, it should limit itself to collecting the first three numbers of your SIN (because those numbers indicate eligibility to work). If it can confirm your eligibility by some other less-privacy intrusive means, it should do so.

What About Reference Checks?

By listing the names of people on your resume as references, you are giving your consent, both to the employer and to the people listed, to talk about you. To make sure the people on your list understand that you have consented to them giving a reference about you, you should tell them yourself rather than rely on the employer to tell them.

Your potential employer may also want to speak with individuals whom you have not specifically listed as references (for example, a former employer).  They may do so, but must give you notice first. The individuals contacted should obtain your consent prior to disclosing information about you.

Your Right to Access the Information About You Given by Your References

The information given about you by your references and others is your personal information, but your right to get access to it could be limited in certain circumstances.

If the comments given by references were intended to be confidential, you might be refused access to them, but we have not had a case that has confirmed the issue. Until this question is settled, it is perfectly legitimate to take the position that you have a right of access to comments about you given by a reference and you can request that information.

You cannot get access to your personal information under PIPA if it would reveal the identity of an individual who provided personal information about you, and that person does not consent to being identified.

Under both PIPA and PIPEDA, you are not allowed to get access to your personal information if disclosing it to you would reveal personal information about another individual.

Under PIPEDA – which applies to certain types of employers – a third party’s opinion about you is your personal information which you may be entitled to access, unless there is a legal exception to your right of access.