Under private sector privacy laws, information can only be collected, used or disclosed by an employer with the consent of the employee, unless there is an exemption.
Employers must ask themselves, before any information can be collected, used or disclosed without consent, “does this information fall into the category of personal information?” and if the answer is yes, the next question will be “is there an exception or exemption that allows or requires me to collect, use or disclose the information without the consent of the employee?”
Obviously, an employer has to obtain and use certain personal information from an employee in order to hire and pay that person. For that reason, there is an exemption in the law that permits such collection, use and disclosure of information for purposes of establishing, managing or terminating the employer-employee relationship. There is a further exemption for the contact particulars of an employee, but only the business contact
information. It is not ok, for example, for an employer to give out an employee’s home address, e-mail or phone number unless the employee has specifically consented. A third exemption is for personal information that is the “work product” of the employee.
It should be made clear that just because the employer has consent to collect information, it does not automatically follow that there is also consent to use or disclose the information, unless consent to such use or disclosure can be implied. For example, the employer will be obligated to disclose to Canada Revenue Agency that the employee is now on payroll, and may do so without express consent from the employee.
The issue of the disclosure of work product sometimes arises where reports are written by employees as part of the job. Such reports might contain negative comments about others, for example, and the writers might not want to be “caught in the middle.” The Privacy Commissioner has dealt with this by saying that such reports may be disclosed with the writer’s name, because the reports, although written by them, are not about them.
The prohibition against using or disclosing employee’s personal information extends to other employees, so it is vital that employers keep employee files locked up and accessible only to those staff members with a need for access to establish, manage or terminate the employer-employee relationship.
Even something as simple as telling one employee that another employee had no more paid vacation time remaining for the year, can put an employer off-side.
Tags: Article; Employment; Maria T. Holman