Employee Privacy in Ontario: What Employers Can and Cannot Do

Many Ontario employers assume the same privacy rules that protect customer data also protect employee data. That assumption is wrong more often than you would think, and getting it wrong can leave a business exposed in a way it never anticipated.

Employee privacy in Ontario is governed by a patchwork of federal law, provincial employment standards, and general legal principles rather than one single statute. This article maps out what actually applies to a typical Ontario workplace, and where the real gaps sit.

The Patchwork: Why There Is No Single "Employee Privacy Act"

Ontario has no general private-sector privacy statute of its own. PIPEDA, the federal privacy law, fills that gap for most commercial activity — but PIPEDA's specific employee-information provisions apply fully only to federally regulated employers, such as banks, airlines, and telecommunications companies. For most Ontario businesses, which are provincially regulated, employee records used strictly for employment purposes fall into a genuine legal gap: no dedicated statute governs them the way PIPEDA governs customer data. That does not mean employers have unlimited freedom. General legal principles, employment contracts, human rights law, and — for unionized workplaces — arbitral standards still shape what is reasonable.

What Employers Can Generally Collect

• Information reasonably needed to administer the employment relationship: contact details, banking information for payroll, emergency contacts, and information needed to comply with statutory obligations such as tax and WSIB reporting.
• Information relevant to performance and conduct, collected and used for a legitimate business purpose.
• Health-related information limited to what is genuinely needed to manage an accommodation or a leave — not a diagnosis, in most cases.

Where Employers Need to Be Careful

• Background and credit checks. These should be tied to a genuine job requirement and supported by informed consent.
• Monitoring devices, email, and internet use. Employees generally have a reduced, not zero, expectation of privacy on employer-owned systems, and a written policy that is actually communicated matters a great deal here.
• Social media. Reviewing a candidate's or employee's public posts raises fewer issues than accessing private accounts or requiring passwords, which is far riskier ground.
• Medical and disability information. Treat it as highly sensitive, and limit access strictly to the people who need it to manage the accommodation.

What Consent Does — and Does Not Do — for an Employer

Employee consent to data collection is not the same as customer consent. Courts and privacy regulators are wary of consent given inside an inherently unequal employment relationship, especially where refusing could jeopardize someone's job. Consent helps, but it is not a blank cheque: collection still has to be reasonable, and unnecessary or excessive collection remains a problem even with a signed consent form on file.

Building a Defensible Privacy Practice

• [ ] Collect only what you actually need for a specific, identifiable purpose.
• [ ] Put your monitoring and data-handling practices into a written policy that employees actually receive.
• [ ] Limit access to sensitive records — health, discipline, background checks — to people who need it.
• [ ] Have a retention and destruction practice; do not keep old employee files indefinitely "just in case."
• [ ] Review any new monitoring tool or HR software for what data it collects before you roll it out, not after.

Frequently asked questions