A look at the implications of privacy legislation when it comes to disclosing information about violent individuals
Health and safety legislation in some provinces requires employers to disclose information about potentially violent individuals whom employees may encounter at work. In some jurisdictions, this applies only to information about non-workers while, in others, it applies both to co-workers and non-workers.
There has been concern privacy legislation might prohibit the disclosure of this information unless an employer has an individual’s consent. Confusing the situation is the fact all jurisdictions have privacy legislation but in some circumstances it applies to employment relationships and in others it does not.
It all depends on whether an employer is provincially or federally regulated, what province an employer is operating in and whether an employer is in the public or private sector. For federally regulated employers, the Personal Information Protection and Electronic Documents Act (PIPEDA) covers both employee and non-employee (commercial) information.
In the employment sphere, PIPEDA applies to all federal works, undertakings or businesses (FWUBs). According to the Office of the Privacy Commissioner of Canada, all employers in the Northwest Territories, Nunavut and the Yukon are considered FWUBs and, therefore, PIPEDA applies in those jurisdictions.
For provincially regulated businesses in all jurisdictions but Alberta, British Columbia and Quebec, PIPEDA applies, but not in relation to employee information. It may apply, however, to information about workers who are not employees, such as contractors and possibly job applicants. PIPEDA applies to commercial information in all provinces that have not enacted substantially similar legislation. However, it only applies to the employment relationship in the federal sector.
Alberta and B.C. both have a Personal Information Protection Act (PIPA) that applies instead of PIPEDA. While slightly different, these PIPAs apply to information about employees and non-employees. The PIPAs are substantially similar to PIPEDA but, unlike PIPEDA, in some circumstances they allow employers to use or disclose “employee personal information” without first obtaining employee consent, provided the worker is given notice of such use or disclosure.
In Quebec, the Act respecting the protection of personal information in the private sector applies instead of PIPEDA. As in B.C. and Alberta, this provincial legislation covers both employment and non-employment information. Also in Quebec, both public and private sector privacy legislation provides that personal information can be communicated to others without that person’s consent in order to prevent an act of violence (including suicide) if there is an imminent danger of death or serious injury to a person or identifiable group of people.
Public sector employers are all subject to privacy legislation in their respective jurisdictions. Federally regulated public sector employers are subject to the federal privacy act and each province and territory has its own public sector privacy legislation (including jurisdictions such as Ontario, which does not have its own private sector privacy legislation).
Even though privacy legislation prohibits the unauthorized disclosure of personal information in general, there are exceptions to this rule. One exception is for disclosure that is required or authorized by another statute or regulation. It may also be allowable under the common law or by a collective agreement. There are other exceptions such as disclosure in compliance with a subpoena or warrant, to co-operate with an investigation by law enforcement officials, in an emergency and for research purposes.
Five general patterns
With respect to the interaction between the duty to disclose information about a violent individual and privacy legislation, the following five general patterns appear in the different jurisdictions:
A jurisdiction’s health and safety legislation requires disclosure and the applicable privacy legislation states disclosure is allowed if it is required or authorized by some other law. In this case, the disclosure is probably required.
In Ontario, for example, Bill 168 requires disclosure of information relating to individuals with a history of violence. While this appears to offend PIPEDA as it relates to information, for example, about a customer (but not an employee), the disclosure is required by law, so PIPEDA allows it. In B.C, although health and safety legislation only refers to violent acts by non-workers (such as customers, suppliers or members of the public), disclosure in those cases is allowed under PIPA because health and safety legislation requires it.
Case law confirms disclosure required by other legislation does not violate privacy legislation in contexts such as securities law, condominium law, bankruptcy and workers’ compensation. With respect to workers’ compensation, in PIPEDA Case Summary No. 191, 2003 CarswellNat 5901 (Privacy Commissioner of Canada), a federally regulated employer disclosed information to a provincial workers’ compensation board without an employee’s consent. However, disclosure was made pursuant to the company’s obligation to respond to inquiries authorized under the Workers’ Compensation Act and, therefore, did not contravene PIPEDA. Presumably, therefore, this principle would also apply to health and safety legislation.
A jurisdiction’s health and safety legislation requires disclosure and there is no privacy legislation that covers the situation. In this case, disclosure is probably required. This is the situation in Ontario, Manitoba and Saskatchewan as it relates to personal information about employees with a history of violence.
Health and safety legislation requires disclosure unless otherwise prohibited by law. This is a confusing and potentially circular situation. For example, PIPEDA allows disclosure if another law requires it but health and safety legislation in Nova Scotia only requires disclosure if it is not prohibited by another law. This is also the case in Prince Edward Island and Saskatchewan, in some circumstances.
A jurisdiction’s health and safety legislation does not require disclosure and privacy legislation prohibits it. Since there is no statute authorizing it, disclosure is probably prohibited. This is the situation in Alberta and the federal sector, although Alberta employers can disclose employees’ information in some situations if they give notice.
Although it is probably best not to include such a policy in these jurisdictions, common sense should prevail and it may be necessary to warn employees about the identity of a person with a history of violence in a situation of extreme or imminent danger. This is similar to the exception specifically included in the Quebec legislation, as noted above.
Health and safety legislation does not require disclosure and no privacy legislation applies. In this case, disclosure appears to be optional since it is neither prohibited nor required (see the table for further details).
Jurisdictional table
The situation in each jurisdiction as it applies to employees and non-workers in the private sector is summarized in the table. The situation with regard to other workers who are not employees in the strict sense of the word is more of a grey area. It is also noteworthy, with the possible exception of the third scenario above, that there is no privacy legislation that forbids the disclosure of information required by health and safety legislation.
This table is not intended to be comprehensive — there may be other principles that override these conclusions. As discussed above, privacy legislation generally contains a list of circumstances under which disclosure can be made without consent, and particular circumstances could allow disclosure of a history of violence under one of these other headings.
In addition, an employer may decide an individual’s history of violence poses a danger that overrides privacy rights, no matter what is written in the applicable privacy legislation. Communicating such information in a one-off situation, however, is a bit different from including a policy on this in an employee handbook. It is also worth remembering that in some situations in Alberta and B.C., employers can disclose employee information provided they give notice beforehand.
Brian Kreissl is the managing editor of Consult Carswell, a Canadian HR work solution that delivers best practices, legal compliance, news, articles and a suite of ready-to-use tools in one easy-to-use online service. For more information, visit www.consultcarswell.com. Andrew Treash is a product writer in HR compliance at Carswell.
Jurisdictional differences Disclosure of information on individuals with a history of violence in the private sector Jurisdiction Is disclosure of violent employees’ information required? Is there privacy legislation governing employee information? Is disclosure of violent non-workers’ information required? Federal No Yes No Alberta No Yes No British Columbia No Yes Yes Manitoba Yes No Yes New Brunswick No No No Newfoundland and Labrador No No Yes Northwest Territories No Yes No Nova Scotia Yes No Yes Nunavut No Yes No Ontario Yes No Yes Prince Edward Island No No Yes Quebec Optional, threat must be “imminent” Yes Optional, threat must be “imminent” Saskatchewan Yes No Yes Yukon No Yes No
