The Personal Information Protection and Electronic Documents Act (“PIPEDA”) is the federal privacy law for private-sector organizations. The Act sets out the ground rules for how companies must handle personal information in the course of their business operations, including human resources.
Subsection 5(3) of PIPEDA reads, “An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.”
The section governs how businesses and employers can collect, use and/or disclose their customers’ and employees’, and prospective employees’, personal information. In order to comply with s. 5(3), even with consent, an organization must show that its purposes for collecting, using or disclosing personal information are ones that a reasonable person would consider appropriate in the circumstances.[1]
An important consequence of subsection 5(3) is it prohibits requiring passwords to social media accounts of job applicants as well as employees of federal works, undertakings or businesses (federally-regulated employers such as banks, airlines, and telecommunications companies) for the purpose of employee screening.[2]
Employees and prospective employees are not often in a position of power when looking for work or negotiating the terms of their work. Employers are prohibited from taking advantage of this unequal bargaining power to require that employees, and prospective employees, grant access to their private social media accounts, which may have highly sensitive personal information that, further, is irrelevant to the employer’s business or unnecessary for the employer’s business purposes.
The Office of the Privacy Commissioner of Canada (the “Commissioner”) is mandated by Parliament to act as an ombudsman and guardian of privacy in Canada and enforces PIPEDA. The Commissioner started to apply their guide for obtaining meaningful consent on January 1, 2019.
February 13, 2019 Update – Can Your Employer Check Your Public Social Media Accounts?
The CBC has reported that 70% of employers now use social media to screen candidates before hiring.[1] Monster.com has reported that, in the US, eighty-four percent (84%) of employers recruit via social media and 43% of employers screen job candidates through social networks and search engines.[2]
The Office of the Privacy Commissioner of Canada has not opined on the soundness of employers checking employees’, and prospective employees’, social media accounts that are open and public. However, at least one provincial privacy commissioner – in Newfoundland and Labrador – is quoted as saying public social media accounts should not be checked before hiring unless the applicant provides consent as a part of their job application.[3]
Nonetheless, Ontario case law suggests that an employer is entitled to have social media policies and practices in place to, among other things, protect against reputational harm to the company that can be caused by an employee’s public social media presence.[4]
Whether or not personal information on public social media pages can be used by an employer likely depends on the use. For example, if an employer uses social media to discriminate against a prospective employee based on a protected ground, like disability or citizenship, they have run afoul, at least, of human rights legislation.
[1] CBC News, “Don’t check Facebook before hiring, says privacy commissioner” 19 January 2018, online: https://www.cbc.ca/news/canada/newfoundland-labrador/social-media-hiring-public-bodies-1.4492935 [CBC News]
[2] Isabel Thottam, “These social media mistakes can actually disqualify you from a job”, undated, online: https://www.monster.com/career-advice/article/these-social-media-mistakes-can-actually-disqualify-you-from-a-job
[3] CBC News, supra note 3.
[4] See, for example, Ontario (Ministry of Community Safety and Correctional Services) and OPSEU (Groves), Re
2016 CarswellOnt 11926 (Ontario Grievance Settlement Board); and Toronto (City) and IAFF, Local 3888 (Bowman), Re 2014 CarswellOnt 19312 (Ontario Arbitration).
[1] The Office of the Privacy Commissioner of Canada, Guidelines for obtaining meaningful consent, online: https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gl_omc_201805/#fn21
[2] The Office of the Privacy Commissioner of Canada, Guidance on inappropriate data practices, online: https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gd_53_201805/
Author - Extraordinary Damages in Canadian Employment Law
