March 3, 2004 by Israel Foulon LLP
Question: How does the federal privacy legislation affect the employer-employee relationship? I am specifically interested in how this legislation may affect an employer’s handling of employee personal information, disclosed to third-party administrators for the purposes of such things as benefits, payroll and pensions?
Jan. 1, 2004, marked the final phase in the implementation of the federal Personal Information Protection and Electronic Documents Act (PIPEDA). What impact does this legislation have on employers?
The answer is, simply, probably less impact than you have been led to believe. PIPEDA has applied to employers, who are federally regulated, since Jan. 1, 2001. If your employees are subject to the Canada Labour Code, then PIPEDA already applies to their employee personal information. With respect to federally-regulated entities (typically in the transportation, communication or banking sectors) PIPEDA applies to information generated from interactions with employees and dealings with customers.
With respect to provincially regulated businesses, PIPEDA does not apply to employee information. PIPEDA is limited to commercial activity. But it is important to note there has been some debate as to whether or not it will apply to the employment relationship in provinces, such as Ontario, that have not passed substantially similar legislation. The consensus is that until substantially similar legislation is passed in a province, PIPEDA will not apply to the handling of employees’ personal information in provincially regulated workplaces. The reasoning for this is twofold. First, it is arguable the definition of “commercial activity” is not broad enough to include the collection of personal employee information that is only incidental to whatever commercial activity an employer is engaged in, such as payroll information. Second, while the federal government has constitutional jurisdiction to pass laws that relate to trade and commerce and to matters of an inter-provincial nature, the provinces have authority over property and civil rights. Arguably, this means the federal government lacks jurisdiction to regulate privacy issues between employers and employees in a provincial workplace.
Nevertheless, employers should recognize that privacy legislation is coming to all provinces – it’s a matter of when, not if. It is also clear that PIPEDA will be the model for the provincial legislation. Therefore there is a practical benefit for employers to implement compliance measures now in an effort to anticipate the types of changes every organization will eventually have to have in place.
With respect to the question regarding the provision of employee information to third-party administrators, we suggest the following. Employers who use an external company to process payroll and benefits will arguably have to ensure the information provided to these outside providers is necessary information. Employee consent should be obtained to provide this information to these third parties.
Employers should take steps to receive assurances from third-party benefit or payroll service providers that they are complying with the requirements of PIPEDA and not, for example, using the address information they have obtained to create and sell mailing lists or target customers for other services that they, or an associated company, may provide.
Peter Israel is the senior partner in the Toronto law firm of Israel Foulon LLP – Employment and Labour Lawyers. He can be reached at 416-640-1550 or pi@qtw38575.mywhc.ca. A version of this article originally appeared in the Carswell publication, Canadian Employment Law Today