People expect to have some privacy at work. At the same time, it’s normal that working for someone will mean giving up some privacy. Employers must balance their need to know what’s going on in their workplace with a worker’s right not to be snooped on. Learn about your privacy rights at work.
Find out which law applies to your employer
In BC, there are two main privacy laws that apply to employers. It’s useful to know which one applies to your employer, because there are some differences.
To further complicate things, this law applies to your employer if you work in a federal government institution (for example, a Crown corporation or federal agency). And this law applies to your employer if you work in a federally-regulated industry. Some examples include:
The guidance we offer below focuses on your rights as a worker at a BC private organization or non-profit. To learn more about your rights as a worker with a BC government body, see this factsheet. To learn more about your rights under the federal laws, visit the federal privacy commissioner’s website.
You have privacy rights during the hiring process
– Gerard, Coquitlam
Under the law in BC, employers must keep private any personal information they collect from you during the hiring process.
Employers must protect the information in your resume
If you submit a resume to an employer and they decide to keep it, they must protect your information. The employer has a duty to tell you how they’re using your information. If they are going to share your resume with anyone, they must inform you.
If the employer doesn’t want to keep your resume, they must dispose of it carefully to protect your information. Ideally, they will shred any paper copies and delete any electronic copies.
If your employer uses your resume to make a decision about you, they must keep it on hand for at least one year. During that time they must allow you to have access to it.
Your employer can request your personal information during the hiring process
BC law gives an employer the right to collect your personal information in order to hire you. Generally, they’ll want information about your qualifications, education, experience, knowledge and skills.
Your employer is not allowed to get your Social Insurance Number before hiring you. If they ask for it during the hiring process, you can refuse.
When you list references on your resume, you’re giving your employer permission to contact them. You should first get in touch with anyone you’re listing as a reference to let them know they may be getting a call about you. Confirm that it’s okay they disclose information about you to the employer.
An employer may require a background, criminal record, or credit check
An employer has the right to ask for your consent to a background, criminal record, or credit check — but only if the information is necessary for the job.
You have the right to refuse to consent. But if you do, the employer may not offer the job or promotion.
Under the law in BC, certain types of jobs require a criminal record check. The law applies to workers who have unsupervised access to children or vulnerable adults — for example, teachers and health care workers.
At a minimum, employer privacy policies should address:
- the purposes for collection, use and disclosure of personal information
- access to and correction of personal information
- retention and disposal of personal information
- responsible use of information technology
- a process for responding to privacy complaints
A privacy management program is a tool many employers use to comply with privacy laws. It helps an employer identify weaknesses in their privacy practices and make improvements. Make sure you become familiar with your employer’s program if they use one.
If an employer asks for your health information
Under the law in BC, an employer can’t see your health information without your consent. (See our guidance on taking charge of your health information.) An employer may ask to see your health information to accommodate your needs or to protect other workers in the workplace.
Generally, an employer is limited to requesting only what’s reasonable in the circumstances. For example, it’s probably unreasonable for your employer to ask you for a doctor’s note every time you take a sick day. However, suppose you’re returning from a short-term disability leave of absence. In that instance, your employer may require a letter from a doctor saying you’re fit to return to work.
In any case, you can refuse to allow your employer to see your health information. But there may be consequences. For example, you may be held out of service, or your disability may not be accommodated.
If you work for a union, your collective agreement may give your employer different rights to your health information. For example, you may be required to see a certain doctor in some cases. If you refuse, you may be held out of service. (Check the language of your collective agreement.)
If an employer uses video surveillance
An employer may have sound reasons for installing video cameras in a workplace. It may be to keep workers safe or protect company property. But use of video surveillance by an employer must be reasonable.
Privacy commissioners have found that general video surveillance to monitor worker productivity is unreasonable. Surveillance may sometimes be allowed to address a specific safety or security issue. Advance notice of this is usually required, but not always (for instance, when it’s part of an investigation into worker misconduct, such as theft or vandalism).
If an employer uses computer monitoring software
Employers have the right to monitor the use of their computer systems. The practice may be to ensure workers are following the workplace computer policy, or to improve security.
If an employer suspects a worker is misusing the computer systems, the employer is allowed (and may have a duty) to investigate further. For example, the employer might use keystroke logging or screenshot capturing on the worker’s computer.
Before using computer monitoring software, your employer should have a computer policy in place. The policy should tell workers:
- the types of activities that are prohibited (for example, excessive use of social media websites)
- the nature of the monitoring that’s done
- how the software will be used to investigate a suspected breach of the policy
In most cases, monitoring software isn’t justified if its only purpose is to make sure workers aren’t using computers for personal use. If your employer is concerned about this, less intrusive methods should be explored.
If an employer uses GPS tracking
In Canada, more and more employers are using global positioning systems (GPS) in the management of vehicle fleets. Your employer may use GPS to track the location, mileage or speed of a company vehicle. In general, privacy laws in BC apply to personal information collected about you using a GPS.
In most cases, continuous, real-time tracking of workers outside of work hours by GPS is not permitted. The privacy commissioner in BC has decided that this is more invasive than necessary.
Step 1. Let your employer know your concern
If you think your employer is collecting or disclosing your personal information inappropriately, there are steps you can take. The first is to reach out to your employer or their privacy office (if they have one).
Put your concerns in writing. Be specific about the details to help them understand your position. Ask about the employer’s legal authority to collect or disclose your personal information.
You can use this form provided by the privacy commissioner of BC. Deliver your request directly to your employer, or to their privacy office if they have one.
Keep a copy of the letter for yourself. Make a note of when it was received. Under the law, the employer must reply to your request within 30 days of receiving it. (In some cases, they may be permitted a time extension.)
Step 2. Wait 30 days for a response
Give your employer at least 30 business days to respond. Your next step (explained below) is to complain to the privacy commissioner, who may not accept your complaint if you don’t wait at least 30 days.
Step 3. Complain to the privacy commissioner
If you don’t hear back from your employer, or you aren’t satisfied with their response, you can file a complaint with the BC privacy commissioner.
You must make your complaint in writing. You can send a letter or email, or you can use this form from the privacy commissioner’s website. Make it clear what happened and what your concerns are. Attach a copy of your letter to your employer, as well as any response.
There is no fee for filing a complaint with the privacy commissioner.
The privacy commissioner will review your complaint according to their policies and criteria and decide whether to open a complaint file. If they decline to investigate your complaint, you’ll receive a letter explaining why. If your complaint is accepted, the commissioner will investigate your complaint and make a finding.
Do I have to tell my employer about my disability?
Under Canadian law, employers have a duty to accommodate workers up to the point of undue hardship. If you have a disability, your employer must modify your workplace or job requirements to allow you to work on a level field with your colleagues — for example, by purchasing an assistance device.
Your employer has a duty to understand the level of accommodation you need. So they may ask for some general information about your medical condition. If you withhold information from your employer, you risk not being accommodated properly or at all.
Is an employer allowed to use video surveillance without telling workers?
Generally, workers should be told about video monitoring in advance and notified of where the cameras will be placed. The exception is where the surveillance is being used to investigate worker misconduct.
Employers should place signs around the workplace letting workers know about the cameras. The level of surveillance should be the bare minimum necessary to meet the employer’s business interests.
See the “Understand your legal rights” section above.
What happens to my resume if an employer decides not to hire me?
When disposing of your resume, an employer has a duty to make sure your personal information is protected. If you submitted it by email, they should delete all electronic copies. If you submitted a paper copy, they should shred the resume before throwing it away. See the “Understand your legal rights” section above.
The Office of the Information & Privacy Commissioner for BC investigates complaints against private companies and BC government bodies who misuse your personal information.
The Office of the Privacy Commissioner of Canada investigates complaints against federal government institutions and organizations in federally-regulated industries who misuse your personal information.