information that is not about an individual’s employment”.
63 Alberta’s PIPA relies
upon a similar definition,
64 although it was amended to clarify that employee
personal information includes information about a “potential, current or former
employee of an organization”.
65 Under these statutes, employee personal information may be collected without consent where it is “reasonable for the purposes of
establishing, managing or terminating an employment relationship between the
organization and the individual”.
66
The OPC takes the position that an employer’s collection of information about an
employee from social networking sites amounts to the collection of personal information.
67 However, as noted above, 7.3(1) of PIPEDA permits the collection, use
and disclosure of personal employee information without consent if it is “necessary
to establish, manage or terminate an employment relationship”, and the individual
has been informed “that the personal information will be or may be collected, used or
disclosed for those purposes”. Thus, with appropriate notice, an employer could
engage in social media monitoring. Because PIPEDA also applies to applicants for
employment, information about prospective employees can be collected from social
media sites—with appropriate notice. The OPC advises those employers covered by
PIPEDA to have clear policies on social media communications.
68
2.5 Data Security Breach Notification
Data security breach notification requirements were added to PIPEDA in 2015,
69
and took effect on November 1, 2018. The provisions are similar to ones added to
Alberta’s Personal Information Protection Act in 2010. Like the Alberta provisions,
PIPEDA’s data breach notification requirements set a risk-based threshold for
notification. Section 10.1 requires organizations to disclose to the Commissioner
any breach of security safeguards for personal information where “it is reasonable in
the circumstances to believe that the breach creates a real risk of significant harm to
an individual”. There is also a concurrent obligation for the organization to notify
63 PIPA (BC), s. 1. Note that some issue may exist as to whether executives can be considered
“employees” for the purposes of this legislation. See: Re: Occupational Health and Safety Agency
for Healthcare in BC, [2010] B.C.I.P.C.D. No 48, Order No P10-03.
64 PIPA (Alberta), s. 1(1)(j).
65 PIPA (Alberta), s. 1(1)(j). Note that the previous definition was interpreted to include information
about former employees. See: Re: Clean Harbors Lodging Services, [2010] AIPCD No 57, Order
No P2010-011.
66 PIPA (BC), s. 13(2)(b). A comparable provision can be found in PIPA (Alberta), s. 15(1)(a).
Specific provision around the use and disclosure of employee personal information are found in
PIPA (BC), ss. 16 and 19; PIPA (Alberta), ss. 18 and 21.
67 Privacy Commissioner of Canada (2015b) Social Networking in the Workplace.
68 Ibid.
69 Digital Privacy Act, S.C. 2015, c. 32.
Data Protection and the Internet: Canada
65
63 Alberta’s PIPA relies
upon a similar definition,
64 although it was amended to clarify that employee
personal information includes information about a “potential, current or former
employee of an organization”.
65 Under these statutes, employee personal information may be collected without consent where it is “reasonable for the purposes of
establishing, managing or terminating an employment relationship between the
organization and the individual”.
66
The OPC takes the position that an employer’s collection of information about an
employee from social networking sites amounts to the collection of personal information.
67 However, as noted above, 7.3(1) of PIPEDA permits the collection, use
and disclosure of personal employee information without consent if it is “necessary
to establish, manage or terminate an employment relationship”, and the individual
has been informed “that the personal information will be or may be collected, used or
disclosed for those purposes”. Thus, with appropriate notice, an employer could
engage in social media monitoring. Because PIPEDA also applies to applicants for
employment, information about prospective employees can be collected from social
media sites—with appropriate notice. The OPC advises those employers covered by
PIPEDA to have clear policies on social media communications.
68
2.5 Data Security Breach Notification
Data security breach notification requirements were added to PIPEDA in 2015,
69
and took effect on November 1, 2018. The provisions are similar to ones added to
Alberta’s Personal Information Protection Act in 2010. Like the Alberta provisions,
PIPEDA’s data breach notification requirements set a risk-based threshold for
notification. Section 10.1 requires organizations to disclose to the Commissioner
any breach of security safeguards for personal information where “it is reasonable in
the circumstances to believe that the breach creates a real risk of significant harm to
an individual”. There is also a concurrent obligation for the organization to notify
63 PIPA (BC), s. 1. Note that some issue may exist as to whether executives can be considered
“employees” for the purposes of this legislation. See: Re: Occupational Health and Safety Agency
for Healthcare in BC, [2010] B.C.I.P.C.D. No 48, Order No P10-03.
64 PIPA (Alberta), s. 1(1)(j).
65 PIPA (Alberta), s. 1(1)(j). Note that the previous definition was interpreted to include information
about former employees. See: Re: Clean Harbors Lodging Services, [2010] AIPCD No 57, Order
No P2010-011.
66 PIPA (BC), s. 13(2)(b). A comparable provision can be found in PIPA (Alberta), s. 15(1)(a).
Specific provision around the use and disclosure of employee personal information are found in
PIPA (BC), ss. 16 and 19; PIPA (Alberta), ss. 18 and 21.
67 Privacy Commissioner of Canada (2015b) Social Networking in the Workplace.
68 Ibid.
69 Digital Privacy Act, S.C. 2015, c. 32.
Data Protection and the Internet: Canada
65