Employee Privacy Rights in Ontario: What Your Employer Can and Cannot Do

Privacy in the Ontario Workplace

Ontario employees have some privacy rights in the workplace, but these rights are more limited than many people assume. Employee personal information held by private sector employers in Ontario is regulated primarily by the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

Employee Monitoring: The New Rules

As of October 11, 2022, Ontario's Working for Workers Act, 2022 requires employers with 25 or more employees to have a written policy on electronic monitoring of employees. The policy must disclose whether and how the employer monitors its employees electronically, the purpose of monitoring, and how the information may be used. Employers are not required to stop monitoring — only to be transparent about it.

What Employers Can Legally Monitor

• Email sent and received through company email systems (with notice)
• Internet activity on company networks and devices (with notice)
• Time and attendance through biometric systems (with proper privacy protections)
• Video surveillance in non-private areas of the workplace (with visible notice)
• Company-owned vehicles using GPS (with notice)

What Employers Cannot Do

• Monitor personal devices not provided or owned by the employer
• Conduct monitoring in bathrooms, change rooms, or other private areas
• Use monitoring data for purposes beyond those disclosed in the monitoring policy
• Collect more information than necessary for the stated purpose

PIPEDA Obligations

Under PIPEDA, employers must: collect only the information necessary for identified purposes, obtain consent where feasible, protect the information through appropriate safeguards, and allow employees access to their own personal information. If you believe your privacy rights have been violated, file a complaint with the Office of the Privacy Commissioner of Canada.