Legalities surrounding employee background checks may tighten
By John Hyde
Provinces call for stricter protections to personal data
By John Hyde
Hiring a new employee without doing some background research on the candidate would be unthinkable for most employers. The internet is the single-most accessible source of publicly available information about anyone or anything.
At the same time, the amount of sensitive, private, and personal information that can be uncovered about a person with a few keystrokes is staggering. And in the age of social media, the amount of personal information available online is ever-increasing.
The conventional wisdom today is to assume that any prospective employer will know all publicly available information about a job applicant. Certainly, this practice is invasive, but is it legal?
In Ontario, the surprising answer is yes — in most cases, all bets are off when it comes to the collection of personal information.
In other provinces like Alberta and B.C., privacy protection (for job applicants and more) has been described as “toothless,” because organizations face little to no risk of financial repercussions.
The Wild West of employee background checks may soon change, however, as provinces begin calling for stricter protections to personal data.
Legal risks of ‘over-inclusive’ background checks
Employers who cast a wide net when fishing through employee background checks risk dredging up information that is better left unseen. This is largely due to human rights legislation, which applies all across Canada, and prohibits discrimination based on protected grounds including race, sex, gender identity, age, family status, disability, criminal background, and a long list of other potential enumerated grounds.
A hiring decision can be subject to challenge by an unsuccessful applicant if any of these protected grounds even appear to have influenced a hiring decision.
To add to the difficulty for employers, once a hiring decision appears to be discriminatory, the employer bears the onus to prove that it was not. For instance, an employer may face an uphill battle if it decided not to hire an applicant after seeing her pregnancy announcement on Instagram – even if that applicant was declined for completely unrelated reasons.
The best approach for employers is to reserve background checks only to applicants who are being given serious consideration for a position.
Legal protections against employee background checks
Specific restrictions on employee background checks vary from province to province in Canada. In most provinces, there are currently no privacy laws limiting the right of employers to conduct a free-range internet search on a prospective employee.
In Alberta, B.C. and Quebec, on the other hand, employee background checks are subject to provincial privacy legislation.
In these provinces, in the absence of consent, employers are only permitted to conduct employee background checks to verify information, or to collect information that is “reasonably required” or “necessary” for the purposes of the employee screening process.
Certain rules also require employers to keep records of the personal information they have collected; and failing to keep those records can be deemed a violation.
Therefore, even information that is collected inadvertently can run afoul of provincial privacy legislation in Alberta, B.C. and Quebec.
Tightening the rules on background checks
Weighing against these special rules in Alberta, B.C. and Quebec is enforcement — specifically, inconsistent enforcement. As it stands right now, even the provinces with the most stringent protections for personal information do very little in terms of enforcement.
In B.C., for instance, organizations who willfully violate personal information legislation usually do not face any monetary fines, leading many to criticize these protections. Most corporations will not be deterred from violating privacy legislation if there are no financial consequences.
This may soon change with the development of increasingly invasive technologies like artificial intelligence, facial recognition and so-called “big data.”
Legislators in both Ontario and B.C. have recently held public consultations targeted at strengthening and updating privacy protection in those jurisdictions.
The contemporary model for the protection of privacy online is the General Data Protection Regulation (GDPR) in Europe.
Unlike Canadian privacy legislation which focuses on consent, GDPR recognizes that most people will simply scroll and click “I accept” without reading the fine print when applying for a job.
This type of consent to the collection and use of personal information is, generally, no longer valid in the European Union.
John Hyde is the managing partner at Hyde HR Law in Toronto. He advises management on all aspects of employment and labour law, including representation before administrative tribunals, collective agreement negotiation, arbitrations, wrongful dismissal defence and human rights.