Are there any exceptions to employee privacy rights in relation to their health information if it is related to a current health crisis such as the COVID-19 pandemic?
Question: Are there any exceptions to employee privacy rights in relation to their health information if it is related to a current health crisis such as the COVID-19 pandemic?
Answer: Employers may be considering new screening measures to ensure a safe working environment during the COVID-19 pandemic. These measures may include collecting employees’ personal health information via questionnaires, temperature testing and/or self-disclosure of COVID-19 symptoms or potential exposures.
Privacy laws continue to apply during the pandemic, and employers need to ensure they do not collect more employee health information than is permitted by law. Privacy laws generally allow an employer to collect, use and/or disclose personal information if it is reasonably necessary to manage the employment relationship and identify safety risks in the workplace. The information employers may collect, use and/or disclose may vary depending on jurisdiction, sector and the practical requirements of their workplace.
In addition, most privacy legislation allows employers to collect, use and disclose personal information where it is required by law. In British Columbia, employers may be required to provide information to WorkSafeBC about an employee who contracted COVID-19 due to a work-related exposure.
During the pandemic, it may be reasonable and necessary for employers to request more employee health information than usual. The Office of the Privacy Commissioner of Canada has published “A Framework for the Government of Canada to Assess Privacy-Impactful Initiatives in Response to COVID-19,” which outlines basic principles of privacy law and provides some key takeaways that are helpful to Canadian employers. Employers should identify the legal authority for their collection, use and disclosure of personal information. This involves reviewing the applicable privacy legislation in your jurisdiction.
The Framework also states that employers should only collect what is necessary and proportionate to their needs during this pandemic and ensure that information is only used or disclosed for the purpose for which it was collected. In practical terms, this means employers should operate on a need-to-know basis. For instance, you may need to know if an employee has travelled recently, but it is unlikely that you need to know for how long, why or where they travelled. Employers should consider the purpose for which they are collecting employee health information and disclose only what is necessary to achieve this goal both within and outside their organization. Additionally, employers should consider how long they need to keep this information and whether it can be anonymized.
What is reasonable to request will be different in every workplace. Consider, for example, the size of your workplace. It may be less reasonable for an employer with a small staff that is easy to monitor to request employee health information to identify safety risks than it would be for an employer with a large unsupervised staff complement. There may be less of a need for information if the safety risks are lower, such as for employees who work outdoors, work alone or can easily socially distance.
Employers should have policies in place that comply with occupational health and safety laws in their jurisdiction and inform employees of what personal information is being collected and for what purpose. From a legal point of view, these policies may help employers meet legal requirements to notify employees about the collection, use and/or disclosure of their personal health information and the purposes for which they are doing so. Employers should check the notice requirements in applicable privacy legislation in their jurisdiction and sector to ensure they have met these duties. From a practical point of view, for policies to have a meaningful impact, employees must have read and understood them. These policies can provide employees with confidence that their employers are taking all necessary precautions to ensure a safe working environment and encourage employees to support these efforts.
Colin Gibson is a partner with Harris and Company in Vancouver. He can be reached at (604) 891-2212 or [email protected].
