Privacy Limits on Employee Background Checks in Ontario
Ontario Privacy Law Overview
Despite growing concerns about privacy protection, the Ontario government has generally taken a limited approach to employee privacy legislation. While the Personal Information Protection and Electronic Documents Act (PIPEDA) governs personal information held by provincially-regulated private sector organizations when it is collected, used or disclosed in the course of commercial activities, it does not apply to employee information. Currently in Ontario, only employee information collected in connection with a federal work, undertaking or business is regulated under PIPEDA. There are some common law torts which may provide employees with a right to make claims in relation some breaches of privacy that occur in the course of employment.
In October 2020, the Ontario government completed public consultation on new privacy legislation. The proposals being explored through this consultation aimed to address the gaps in existing legislation and put in place comprehensive, up-to-date and robust rules that protect privacy rights, and increase confidence in digital services. One of the gaps that could be addressed relates to employee information held by provincially regulated organizations. It is also worth noting that in November 2020, the Canadian government announced a potentially significant overhaul of PIPEDA.
Some of the most sensitive employee information an employer could hold relates to background checks. As a result, many employers in Ontario have questions regarding the proper practices to follow respecting background checks. It is not uncommon for employers to ask for background checks during the hiring process and, in certain sectors, a regular background check is a requirement. This is frequently the case where the employee works with a vulnerable population.
Information Disclosed in Background Checks
In 2018, the Police Record Checks Reform Act (PRCRA) came into force in Ontario. The PRCRA governs the kind of check that can be performed for screening purposes by employers. In Ontario, there are three different kinds of police record checks that can be requested:
- Criminal Records Checks;
- Criminal Record and Judicial Matters Checks; and,
- Vulnerable Sector Checks
The type of information that can be disclosed under each check varies, but there are certain features in common for all of the checks that can be performed under the PRCRA.
- Consent: Consent must be provided by the person who is being asked to provide a background check, and that person must receive the results of their record before they can be asked to share the results with a potential or current employer. The one exception to this rule is if the person who is subject to the background check self-discloses.
- Prohibited Information: Certain information cannot be disclosed under the PRCRA, including whether the person was a victim or a crime or witness to a crime, or if they had a non-criminal (i.e., did not lead to charges) contact with police while they were suffering from a mental health crisis.
- Youth Records: If youth records are released to an individual, they are released as a separate record and should not be shared with anybody else, including a potential employer.
There are checks performed by employers in certain sectors that have been exempted from the PRCRA entirely, or from certain sections. These exemptions are listed in full in O Reg 347/18, and impact screening for certain roles and purposes in the education, early years education, child care, justice sectors, and in relation to certain roles within the Ontario Public Service.
These exceptions are important for all employers and employees to be aware of, as they do not necessarily affect only those who work directly in the relevant sectors. Even if the work an employer does is adjacent to vulnerable populations, all of the employer’s employees may be screened and sensitive information could be disclosed.
In most cases, Section 9 of the PRCRA prevents the disclosure of information in response to a request for a police check unless the information is authorized to be disclosed in accordance with the Schedule. However, in O Reg 347/18, sections 19(1)(c) and (d) state:
- (1) A police record check provider is exempt from section 9 of the Act with respect to a police record check if it is for the purposes of […]
(c) screening a person to determine if the person is suitable to be awarded a contract to provide goods or services in a school or to determine the suitability of any of the prospective contractor’s employees for providing goods or services under the contract in a school;
(d) screening a person who has been awarded a contract to provide goods or services in a school, or an employee of the contractor who provides goods or services in a school, in order to determine the suitability of the contractor or employee continuing to provide goods or services in a school […]
This regulation would affect, for example, a repair company that earns a contract to do repairs at a school. The school may request police record checks from the employees of the company and sensitive information may be disclosed that would not otherwise be disclosed in the usual course of business for the company.
Obligations under Human Rights Legislation
In addition to the requirements under the PRCRA, employers should be aware of the prohibition against discrimination in employment on the basis of an individual’s “record of offences” under the Ontario Human Rights Code, which includes a conviction for:
- An offence in respect of which a pardon has been granted under the Criminal Records Act and has not been revoked; or
- An offence in respect of any provincial enactment.
An employer may defend against a discrimination claim based on the ground of record of offences is if the employer can demonstrate that its actions were reasonable and bona fide because of the nature of the employment. Should a job applicant bring a discrimination claim based on the information that was disclosed as part of a background check, the burden will be on the employer to show that its actions were not taken for any improper purposes.
There is no doubt that even with the restrictions contained within the PRCRA, the risk is high that a background check will result in the disclosure of sensitive personal information to the employer. PIPEDA does not currently apply to the employee information that provincially regulated employers hold as a result of these checks, but it seems that Ontario may be moving towards putting legislation in place that could close this gap. We recommend that employers create safeguards for this information and regularly update applicable workplace policies and procedures to ensure compliance.
If you have any questions regarding this post, please reach out to any member of our Labour & Employment or Cyber/Data team. We thank Kate Martini for her research and contributions to this article.
Human Rights Code, RSO 1990 c H 19 at s. 10(1).
Ibid at s. 24(1)(b).