Checking in on employees

The legality of background screening has long been of interest for employers. Can an employer subject a prospective candidate to a background check? To what extent can an employer ask a prospective candidate for references or inquire into previous criminal convictions?

But a related question merits further attention by employers: Once an employee is already hired, can an employer continue to “check in” on him? 

With the vast amount of information available on the Internet and the increasing use of social media, employers should be aware of the legal considerations surrounding the practice of screening employees who are already on the payroll.

Screening can take many forms. Some employers may look into whether the information provided by employees is accurate, such as prior experience or education. Other employers may peruse employees’ social media presence, as on Facebook, Twitter or Instagram. 

Screening may involve an employer verifying whether an employee has recently been involved in any civil or criminal matters — accessing such information about an employee is generally a matter of court record or public record.

Other employers are legally required to screen employees because it’s a safety-sensitive sector. 

The practice of screening employees gives rise to important concerns regarding privacy as it involves the handling of personal information. The latter term is defined in privacy statutes as any information about an identifiable individual. This is a very broad definition that encompasses anything from a Facebook profile to educational credentials or court records. 

In many provinces, legislation establishes the ground rules for using and collecting personal information. The federal Personal Information Protection and Electronic Documents Act governs this practice for federally regulated employers. 

Alberta, British Columbia and Quebec have adopted substantially similar privacy legislation that applies to provincially regulated private sector employers. In other provinces, the common law determines when an employer can legally screen an employee.

All provinces have specific legislation regarding the handling, collection and use of personal information by public sector employers but this article concentrates on the requirements for employers in the private sector. 

Privacy laws establish strict boundaries as to when and how personal information can be collected, used or disclosed. Generally, prior to collecting, using or disclosing personal information, organizations must obtain the individual’s consent and notify the individual of their intentions. However, legislation provides situations where it is possible to dispense with obtaining consent. 

For example, in Alberta and B.C., a private sector employer may collect “employee personal information” without the consent of the individual where the collection is reasonable for the purposes of establishing, managing or terminating the employment relationship. “Employee personal information” does not include information that is not about an individual’s employment. 

The employer is still generally required to notify the individual it will be collecting, using or disclosing such information, as well as the purpose of the collection, use or disclosure, before it begins collecting, using or disclosing the personal information, even if it is permitted to do so without the employee’s consent. 

Employers in Alberta and B.C. may collect, without the employee’s consent, personal information that is not about an individual’s employment where this personal information is “publicly available personal information,” which is defined in the regulations as, among other things, personal information of an individual that appears in a professional or business directory or notice, in a government registry or in a printed or electronic publication that is available to the public.

In Quebec, a private sector employer may only collect personal information “for a serious and legitimate reason” and, even then, “only the information necessary for the object of the file.” 

An employer can only collect information from the person concerned, unless the latter consents to collection from third persons. 

Exceptionally, an employer may collect personal information from a third person if it is necessary to ensure the accuracy of the information and it has serious and legitimate reasons for doing so. However, where an employee has made personal information available publicly, the employer can collect and use this information as the employee no longer has any expectation of privacy in this information.

In all circumstances, even where the employer obtains the employee’s prior consent, the only information that can be collected, used or disclosed is that which a reasonable person would consider appropriate or reasonable.

Therefore, in these jurisdictions, there is nothing problematic with an employer verifying online, in publicly available forums, whether employees are discussing the employer inappropriately or whether an employee has been honest as to the reasons behind an absence. 

However, it is important to keep in mind most information employees post on their social media accounts or elsewhere on the Internet has nothing to do with work, such as marital status or pictures of their children. Wall-to-wall monitoring of employee social media can more easily lead to privacy violations.

This is especially so if the personal information is not easily accessible and requires a password. Furthermore, such a practice can also lead to human rights complaints should the employer have collected information related to prohibited grounds of discrimination and taken any decision with respect to an employee.

It is important to keep in mind privacy laws require that information that is collected be accurate before it is used to make a decision in relation to the person concerned. 

Therefore, an employer should be cautious before making a decision regarding an employee based solely on information found online. Simply because an account bears an employee’s name does not mean the content is of the employee’s doing. 

In provinces without provincial privacy law that is applicable to private sector employees, the common law may still provide some privacy rights. Before engaging in employee screening, the crucial question remains whether the employer has an interest in the activities of the employee that trumps any legitimate privacy interests the employee may have. 

On the one hand, an employer will be justified in monitoring a blog set up by an employee that belittles clients and violates a confidentiality agreement. Similarly, an employer will be justified in collecting offensive comments made by an employee about his supervisors on Twitter.

In such situations, it is difficult for an employee to make a successful argument that she had a reasonable expectation of privacy in the content of a publicly accessible blog or a Twitter page. On the other hand, it is highly unlikely an employer will be justified in monitoring an employee’s online dating profile — an employer is unlikely to have a justifiable interest in such activities.

It is also important to recall that the collection of personal information must be reasonable and reasonableness will be assessed based on the nature of the employment. Employers should also limit the amount of information collected and be cautious to not inadvertently collect personal information regarding other individuals who are not their employees.

Finally, employers should always keep in mind employees generally have a right to access the personal information that concerns them, which is collected, used or disclosed by their employer.