Your privacy rights at work

In BC, there are two main privacy laws that apply to employers. It’s useful to know which one applies to your employer, because there are some differences.

One law applies to BC employers in the private sector, including non-profits. 

Another law applies to employers who are BC government bodies. 

To further complicate things, this law applies to employers in federally-regulated industries. Examples include telecommunications, aviation and banking. And this law applies to federal government employers.

The guidance we offer below focuses on your rights as a worker at a private company or non-profit in BC. 

To learn more about your rights as a worker with a BC government body, see this factsheet. To learn more about your rights under the federal laws, visit the federal privacy commissioner’s website. 

“I had a job interview a few weeks ago. I’d submitted my résumé by email, along with an online application form they had me fill out. During the interview, they referred me to their privacy policy. It explained how they were going to use and protect my information. I really appreciated their high standards around privacy.”

– Gerard, Coquitlam, BC

Under the law in BC, employers must keep private any personal information they collect from you during the hiring process.

Employers must protect the information in your résumé

If you submit a résumé to an employer and they decide to keep it, they must protect your information. The employer has a duty to tell you how they’re using your information. If they’re going to share your résumé with anyone, they must inform you. 

If the employer doesn’t want to keep your résumé, they must dispose of it carefully to protect your information. Ideally, they will shred any paper copies and delete any electronic copies. 

If your employer uses your résumé to make a decision about you, they must keep it on hand for at least one year. During that time they must allow you to have access to it. 

An employer can request your personal information during the hiring process

Under BC law, an employer can collect personal information from you that is reasonable for the purposes of hiring you. That typically includes your qualifications, education, experience, knowledge and skills. 

They don’t need your consent to collect this information. But they must notify you they’re gathering this information, and let you know how it’s being used. Usually, this notice is included in the job application. The employer may also refer you to a privacy policy. 

An employer is not allowed to get your social insurance number before hiring you. If they ask for it during the hiring process, you can refuse. As well, another law prohibits an employer from asking job applicants about their pay history. That is, they aren't allowed to ask you what you were paid in previous jobs unless that information is publicly available.

An employer may require a background, criminal record, or credit check

An employer has the right to ask for your consent to a background, criminal record, or credit check — but only if the information is necessary for the job. 

You have the right to refuse to consent. But if you do, there may be consequences. The employer may decide not to hire you (or give you that promotion). 

Under the law in BC, certain types of jobs require a criminal record check. This applies to those who work with children or vulnerable adults — for example, teachers and health care workers.

Under the law in BC, every employer must have a privacy policy. The policy must set out how the employer will meet its privacy obligations. The policy must be easily available to workers. 

At a minimum, the privacy policy should cover:

• how (and why) they collect, use, and share personal information

• how you can access your personal information, and correct mistakes

• a process for responding to privacy complaints

• responsible use of information technology

Under the law in BC, an employer can’t see your health information without your consent. (See our guidance on taking charge of your health information.) 

An employer may ask to see your health information to accommodate your needs or to protect other workers in the workplace.

Generally, an employer can request only what’s reasonable in the circumstances. For example, it’s probably unreasonable for your employer to ask you for a doctor’s note every time you take a sick day. However, suppose you’re returning from a short-term disability leave. In that instance, your employer may require a letter from a doctor saying you’re fit to return to work. 

In any case, you can refuse to allow your employer to see your health information. But there may be consequences. For example, you may be held out of service, or your disability may not be accommodated.

An employer may have sound reasons for installing video cameras in a workplace. It may be to keep workers safe or protect company property. But use of video surveillance by an employer must be reasonable. 

Privacy commissioners have found that general video surveillance to monitor worker productivity is unreasonable. Surveillance may sometimes be allowed to address a specific safety or security issue. Advance notice of this is usually required. But not always — for instance, when it’s part of an investigation into worker misconduct, such as theft or vandalism.

Employers have the right to monitor the use of their computer systems. They can do so to ensure workers are following the workplace computer policy, or to improve security. 

If an employer suspects a worker is misusing the computer systems, the employer is allowed (and may have a duty) to investigate further. For example, the employer might use keystroke logging or screenshot capturing on the worker’s computer. 

Before using computer monitoring software, your employer should have a computer policy in place. The policy should tell workers:

• the types of activities that are prohibited (for example, excessive use of social media websites)

• the nature of the monitoring that’s done

• how the software will be used to investigate a suspected breach of the policy

In most cases, monitoring software isn’t justified if its only purpose is to make sure workers aren’t using computers for personal use. If your employer is concerned about this, less intrusive methods should be explored.

In Canada, many employers are using global positioning systems (GPS) in the management of vehicle fleets. Your employer may use GPS to track the location, mileage or speed of a company vehicle. In general, privacy laws in BC apply to personal information collected about you using a GPS. 

In most cases, continuous, real-time tracking of workers outside of work hours by GPS is not permitted. The privacy commissioner in BC has decided that this is more invasive than necessary. 

If you think your employer is using your personal information inappropriately, there are steps you can take. The first is to reach out to your employer. 

Put your concerns in writing. Be specific about the details to help them understand your position. Ask about the employer’s legal authority to collect or disclose your personal information. 

You can use this form provided by the privacy commissioner of BC. Deliver your request directly to your employer, or to their privacy office if they have one. 

Keep a copy of the letter for yourself. Make a note of when it was received. Under the law, the employer must reply to your request within 30 days of receiving it. (In some cases, they may be permitted a time extension.)

Give your employer at least 30 business days to respond. Your next step (explained below) is to complain to the privacy commissioner, who may not accept your complaint if you don’t wait at least 30 days. 

If you don’t hear back from your employer, or you aren’t satisfied with their response, you can make a complaint to the BC privacy commissioner. 

You must make your complaint in writing. You can send a letter or email, or you can use this form from the privacy commissioner’s website. Make it clear what happened and what your concerns are. Attach a copy of your letter to your employer, as well as any response. 

There is no fee for making a complaint. 

The privacy commissioner will review your complaint according to their policies and criteria. They will decide whether to open a complaint file. If they decline to investigate your complaint, you’ll receive a letter explaining why. If your complaint is accepted, the commissioner will investigate your complaint and make a finding. 

Employers have the right to monitor the use of computers they supply. They can do so to ensure workers are following the workplace computer policy, or to improve security. They must notify workers of any monitoring and the purpose for which the information is collected.

But workers don’t check their privacy rights at the office door. Workers have a reasonable expectation of privacy in the workplace, even when using a computer supplied by an employer. An employer can only collect personal information that is directly related to and necessary for the protection of their computer systems. 

Under Canadian law, employers have a duty to accommodate workers up to the point of undue hardship. If you have a disability, your employer must modify your workplace or job requirements to allow you to work on a level field with your colleagues — for example, by purchasing an assistance device.

Your employer has a duty to understand the level of accommodation you need. So they may ask for some general information about your medical condition. If you withhold information from your employer, you risk not being accommodated properly or at all. 

Generally, workers should be told about video monitoring in advance and notified of where the cameras will be placed. The exception is where the surveillance is being used to investigate worker misconduct. 

Employers should place signs around the workplace letting workers know about the cameras. The level of surveillance should be the bare minimum necessary to meet the employer’s business interests. 

See the “What you should know” section above.