HRM3103: Module 8 Notes
Module 8: Privacy Legislation
In this module, we will examine both legislative and common law principles that apply to privacy
issues in employment.
MODULE 8 OBJECTIVES
Upon completion of this module, you will be able to:
1. Describe the key provisions in PIPEDA and the penalties for non-compliance.
2. Apply PIPEDA appropriately to scenarios and case studies.
To do in Module 8
1. Read the Module 8 notes (below).
2. Read the textbook, Chapter 10.
3. Complete Unit 8: Privacy Legislation in the workbook.
4. Continue working on Individual Assignment 1.
Legislation affecting privacy
There are two pieces of legislation affecting privacy in Ontario. The Freedom of Information and
Protection of Privacy Act (FIPPA) which covers the Ontario public sector, and the Personal
Information Protection and Electronic Documents Act (PIPEDA), which covers the Federal private
sector. Currently, there is NO privacy legislation in force that covers directly on Ontario’s private
sector workplaces, although other legislation affects these workplaces indirectly.
APPLICATION OF PIPEDA
PIPEDA applies to all federally regulated organizations and controls how they collect, use,
disclose, and retain personal information concerning their employees, customers, patients, and
suppliers. It also applies to all personal information collected, used, and disclosed in provincially
regulated organizations in the course of commercial activity, though not personal information
used in the course of employment. Personal information includes information about an
identifiable individual but does not include either anonymous information or information that can
be found on a business card.
PIPEDA’S TEN PRINCIPLES
PIPEDA operates on the basis of ten basic principles:
1. Be accountable.
2. Identify the purpose of collection.
3. Get consent for the collection.
4. Limit collection to the purpose required.
5. Limit the use, disclosure and retention of the collection.
6. Be accurate.
7. Provide safeguards.
8. Be open.
9. Give individual access.
10. Provide recourse.
Employee surveillance in the private
sector
In a unionized workplace in Ontario, acollective agreement may restrict the use of video
surveillance or other forms of employee monitoring. Even in the absence of specific restrictions in
the collective agreement, however, arbitrators will generally recognize a right to workplace
privacy. Generally, employers can conduct surveillance only if disclosed to unionized employees.
In an non-union environment, there are few legal restrictions on employee surveillance. An
arbitrator may apply the reasonableness standard to any situation:
o Was it reasonable to conduct the surveillance?
o Was the surveillance conducted in a reasonable manner?
o Were there other alternatives available to the employer?
MONITORING EMPLOYEE ACTIVITIES
Employers should have an email and internet use policy that sets out in detail the uses that are
and are not permitted so that restrictions are clear to employees. If a computer is company
property, then the employer is permitted to monitor activities on that property and courts have
generally been willing to admit email evidence.
Penalties for non-compliance
PIPEDA legislation provides for two avenues to resolve cases which violate the Act.
1. Individuals have the explicit right to sue the employer for damages for breach of privacy.
This right is available to anyone whose privacy rights have been offended.
2. The Privacy Commissioner can proceed with a prosecution against the employer and/or
officers, directors, or employees if they intentionally violated the Act’s provisions, leading
to potential fines of $10,000 for individuals and $100,000 for employers.