Fixing employee monitoring the practical way, and protecting that fix legally

The situation

The number on the table when Takeshi first called us was roughly $10M, the agreed price for a corporate parent to divest one of its smaller divisions, based in Midland, to two buyers, Sakura and Sofia, who planned to run it as an independent company outside the parent's structure going forward. That figure had been negotiated months earlier and both sides believed it was close to final, with only routine closing steps left to complete. What put it at risk, discovered midway through the buyers' due diligence, was a monitoring system installed on the division's computers and internal messaging platform that logged employee activity in far more detail than any employee had ever been told about.

The system had been rolled out two years earlier by the parent company's IT department, as a general practice applied across several divisions at once, ostensibly for security and productivity purposes, with the rollout treated internally as a routine technical update rather than something requiring individual review at each division. Nobody at the division level had specifically reviewed whether staff had been properly notified or had given any form of consent to that level of monitoring. When Sakura and Sofia's diligence team asked for the division's privacy policies and employee notices, the gap became obvious: the monitoring existed, in detail, but the disclosure to employees explaining it did not.

This mattered to the buyers for a very concrete reason, not an abstract one. They were about to become the employer of every person working in that division, inheriting the employment relationships as they stood, and they would be inheriting whatever legal exposure came from having monitored those employees without adequate disclosure, even though the monitoring itself predated their involvement entirely. If any employee later complained, or if the practice came to light in a way that damaged the new company's reputation with its own staff on day one of independent operation, Sakura and Sofia would be dealing with the fallout of a decision neither of them had ever made or even known about until diligence surfaced it.

Takeshi's instinct, and it turned out to be the right one, was that the actual fix here was not going to come from a lawyer redrafting a clause after the fact. It was going to come from the parent company's human resources team properly informing employees and putting real, meaningful consent in place before closing, in language employees could actually understand. Our role was to make sure that operational fix was done correctly, documented properly, and structured in a way that actually protected the deal once it was made, rather than simply hoping it would be enough.

The legal question

The legal question was narrower than it first appeared, and it is worth being precise about what it was and was not. It was not whether the parent company had committed some dramatic, headline-grade privacy violation; monitoring employee activity on company systems is a common practice across many industries and is not automatically unlawful on its own. The question was whether employees had been given adequate notice of the monitoring and, where required, whether appropriate consent had been obtained, and what obligation existed to close that gap before responsibility for those employees transferred to a new employer under an entirely new ownership structure.

Under Ontario's privacy and employment framework, an employer generally needs to be transparent with employees about workplace monitoring, particularly monitoring that goes beyond what a reasonable employee would expect based on the nature of their role. Silent, undisclosed monitoring creates real legal risk, both from a privacy standpoint and because it can undermine the trust that underlies the employment relationship itself, trust that a new owner taking over the division would need intact from day one. The absence of disclosure here was not a minor technicality that could be papered over; it was the actual substantive gap that needed closing before anyone signed anything final.

The second legal question was about timing and allocation, which is often where deals like this actually get resolved. The monitoring had happened under the parent company's ownership, before the sale, over a period of roughly two years. The consequences of it, if any ever crystallized into an actual complaint or claim, would land on Sakura and Sofia as the new employer after closing, even though they had played no role in the decision to implement it. That mismatch, between who created the exposure and who would inherit it, is exactly the kind of issue a purchase agreement's representations, warranties, and indemnity provisions exist to address directly.

What made this case unusual was that the actual remedy for the underlying problem was not a legal document at all. Proper notice to employees, and where appropriate their consent going forward, had to come from the parent company informing its own staff honestly and directly, something only human resources could really do credibly, since a legal notice alone would have read as defensive rather than genuine. The legal work was to ensure that operational fix happened before closing, to document precisely that it had happened, and to allocate responsibility fairly for the period before it did, so neither side was left guessing about who bore the risk of the two-year gap.

What we did

1. Confirmed the exact scope of the monitoring program with the parent company's IT department, establishing precisely what data had been collected, for how long, and which specific employees within the division were affected, because the remedy and the disclosure both depend entirely on knowing the real scope rather than proceeding on an assumption about it that could later prove wrong and undermine the credibility of the entire fix.
2. Recommended the fix be led by human resources rather than drafted purely as a legal notice, since credible, honest communication to employees about monitoring they did not know about needed to come from the people who actually managed the employment relationship day to day, not from a legal disclaimer buried in a document nobody would actually read or trust, and certainly not from an outside firm employees had never heard of.
3. Reviewed and revised the employee notice human resources prepared, making sure it accurately described the monitoring in plain language, obtained appropriate going-forward consent, and did not understate the practice in a way that could itself become a separate problem later if employees felt misled a second time by a notice that minimized what had actually happened. We pushed back twice on early drafts that used vague, softened language, since a notice that undersold the monitoring would have solved nothing.
4. Negotiated a price adjustment with Sakura and Sofia's counsel to reflect the risk that had existed during the undisclosed period, since the operational fix addressed the future going forward but could not retroactively erase the fact that monitoring had occurred without any notice for roughly two years already, a fact the operational fix could not undo no matter how well it was executed going forward.
5. Drafted a specific representation confirming the corrected notice and consent process was complete before closing, giving the buyers a concrete, verifiable fact to rely on and to check against actual documentation, rather than a general promise that things had simply been handled somewhere along the way. If the representation later proved false, Sakura and Sofia would have a direct claim rather than an argument about what had merely been implied.
6. Added an indemnity covering any claim arising specifically from the pre-disclosure monitoring period, so that if an employee did later raise a complaint about the two years before the fix took effect, responsibility for that period stayed squarely with the parent company rather than transferring silently onto the new owners who had no involvement in the original decision to install the system.
7. Coordinated the timing so the corrected employee notice went out before the closing date, not after it, since a fix merely promised for after closing would have left a real window where Sakura and Sofia already owned the division while employees still had no accurate information about what had already happened to their own data, an outcome that would have undercut the entire point of fixing it at all.

The outcome

The deal closed, but not at the original figure. Sakura and Sofia's counsel negotiated the roughly $10M price down by an amount reflecting the risk carried by two years of undisclosed monitoring, a concession the parent company accepted rather than risk the deal collapsing entirely or facing a harder fight later over an open-ended indemnity it could not fully quantify in advance. That price reduction was a real cost to Takeshi's company, and it is worth being direct about that: this was not a case where the problem simply disappeared once addressed, and no amount of careful drafting could make it disappear entirely.

What the company did get, in exchange for accepting that reduced price, was a bounded and contained resolution rather than an unresolved liability carried indefinitely into the new ownership structure. The indemnity for the pre-disclosure period gave Sakura and Sofia real, specific protection without requiring them to accept a vague promise about future good behaviour, and the corrected employee notice, issued before closing rather than left for later, meant the division's staff received accurate information about monitoring practices before their employment transferred to a new employer rather than finding out after the fact from someone else.

Takeshi's own view afterward was that the human resources team's willingness to communicate honestly with employees, even though it meant admitting a gap that had existed for two years without anyone catching it, did more to protect the deal than any single clause in the purchase agreement could have on its own. The legal work mattered, but it mattered because it protected and documented a fix that came from elsewhere in the organization. The sale closed at a lower number than originally agreed, employees got accurate notice they should have had from the start of the monitoring program, and the exposure that could have followed the division indefinitely into its new life was closed off at a defined point rather than left open for someone to discover later.

What you can learn from this