Employee Privacy Rights Canada: What Employers Can and Cannot Monitor in 2026

Employee privacy is one of the most contested areas of Canadian privacy law. As remote work expands and surveillance technology becomes more sophisticated, employers must navigate an increasingly complex legal landscape.

The Legal Framework for Employee Privacy in Canada

Federal Level: PIPEDA

PIPEDA applies to employee personal information in federally regulated workplaces (banks, telecommunications, airlines, interprovincial transport). For provincially regulated employers, PIPEDA only applies to commercial activities involving personal information.

Key Principle: Employers must demonstrate that monitoring is reasonable and proportionate to a legitimate business need.

Provincial Employment Privacy Laws

Several provinces have enacted specific employment privacy legislation:

Province	Law	Key Provisions
Alberta	PIPA	Applies to all private sector employees
British Columbia	PIPA	Comprehensive employee privacy protections
Quebec	Law 25 / Civil Code	Strictest employee monitoring restrictions
Ontario	ESA amendments (2022)	Electronic monitoring policy required for 25+ employees

---

What Employers CAN Monitor

1. Company Email and Systems

• Legal Basis: Employers generally own workplace systems
• Requirements: Must have clear acceptable use policies
• Limitation: Cannot intercept personal emails even on company systems without notice

2. Internet Usage on Company Networks

• Legal Basis: Network security and productivity management
• Requirements: Written policy disclosed to employees
• Best Practice: Block prohibited sites rather than secretly monitoring

3. GPS Tracking of Company Vehicles

• Legal Basis: Fleet management, safety, and accountability
• Requirements: Must inform drivers; cannot track outside work hours
• Case Law: Eastmond v. Canadian Pacific Railway (2004)

4. Video Surveillance in Workplace

• Legal Basis: Security and safety
• Requirements:
  • Signs clearly posted
  • No cameras in private areas (bathrooms, change rooms)
  • Footage retained only as long as necessary
  • Written policy in place

5. Time and Attendance Tracking

• Legal Basis: Payroll and scheduling management
• Requirements: Proportionate methods; biometric data requires consent

---

What Employers CANNOT Monitor

1. Personal Devices Without Consent

• Cannot install monitoring software on personal phones/laptops
• BYOD policies must clearly define scope of employer access

2. Off-Duty Conduct (Generally)

• Cannot monitor employees' social media outside work hours
• Exceptions: Posts that directly harm employer reputation or breach confidentiality
• Must demonstrate direct connection to employment

3. Private Communications

• Cannot read personal emails or messages
• Cannot listen to personal phone calls
• Cannot access personal cloud storage

4. Health Information Without Consent

• Cannot require genetic testing
• Cannot access medical records without written consent
• Limited to information directly relevant to job duties
• Disability accommodation requests should be handled through HR, not surveillance

5. Union Activity

• Cannot surveil union organizing activities
• Cannot monitor union communications
• Protected under Canada Labour Code and provincial labour laws

---

Ontario's Electronic Monitoring Policy Requirements

Under section 41.1.1 of the Employment Standards Act, 2000, an Ontario employer that employs 25 or more employees on January 1 of any year must have a written electronic monitoring policy in place before March 1 of that year. The policy must state whether the employer electronically monitors employees and, if so:

1. Description of monitoring - How the employer electronically monitors employees
2. Circumstances - The circumstances in which monitoring occurs
3. Purposes - The purposes for which information obtained through monitoring may be used
4. Date of preparation - When the policy was prepared
5. Date of changes - When any changes were made

Deadline: A copy must be provided to employees within 30 days of the date the policy is required to be in place (or within 30 days of changes), and to new employees within 30 days of the day they become employees (or of the date the policy is required, whichever is later).

Penalty for Non-Compliance: Contravening the ESA is an offence under section 132 of the Act.

---

Quebec's Stricter Requirements Under Law 25

Quebec imposes the most restrictive employee monitoring rules in Canada:

Mandatory Requirements:

• Privacy Impact Assessment before implementing any new monitoring technology
• Data minimization - collect only the information necessary for the purposes determined before collection
• Prompt notification to the CAI (and affected employees) if a confidentiality incident involving employee data presents a risk of serious injury

High-Risk Practices to Avoid:

• Keystroke logging without documented business justification
• Screen capture at regular intervals without employee knowledge
• Continuous webcam monitoring during remote work
• Location tracking outside working hours

---

Remote Work Monitoring: Best Practices

Legal Framework for Remote Monitoring

The shift to remote work has created new privacy challenges:

What's Permissible:

• Login/logout time tracking
• VPN connection monitoring
• Project management tool usage metrics
• Scheduled video check-ins (with advance notice)

What's Problematic:

• Always-on webcam requirements
• Random screenshot capture without notice
• Keystroke logging on personal devices
• Mouse movement tracking as productivity measure

Creating a Compliant Remote Work Monitoring Policy

Step 1: Identify Legitimate Business Purpose Document specific business reasons for each monitoring measure.

Step 2: Choose Least Invasive Method If you can achieve the goal without surveillance, do so.

Step 3: Provide Clear Notice Employees must know exactly what is monitored and why.

Step 4: Obtain Consent Where Required Written consent for any monitoring beyond basic system logs.

Step 5: Regular Review Assess whether monitoring remains necessary and proportionate.

---

Biometric Data in the Workplace

Fingerprint Scanners and Facial Recognition

Biometric data receives heightened protection under Canadian privacy law:

• Quebec: Biometric information is named as an example of sensitive personal information (private sector Act, s. 12), and verifying identity using biometric characteristics requires prior disclosure to the CAI and the person's express consent (Act to establish a legal framework for information technology, s. 44)
• Alberta PIPA: Personal employee information may be collected without consent only if collected solely to establish, manage or terminate the employment relationship, reasonable for that purpose, and (for current employees) after reasonable notification (s. 15)
• PIPEDA: Must meet reasonableness test under section 5(3)

Requirements for Biometric Systems:

1. Written policy specific to biometric data
2. Clear purpose limitation
3. Secure storage with encryption
4. Defined retention period
5. Alternative non-biometric option for employees who refuse

---

Employee Rights and Remedies

Right to Access Personal Information

Employees can request access to:

• Personnel files
• Performance evaluations
• Monitoring records
• Emails about them
• Investigation files (with limitations)

Timeline: Employers must respond within 30 days under PIPEDA (s. 8(3)); provincial laws set their own timelines (for example, 45 days under Alberta PIPA s. 28).

Filing a Complaint

Employees can file complaints with:

• Federal: Office of the Privacy Commissioner of Canada
• Quebec: Commission d'accès à l'information (CAI)
• Alberta: Office of the Information and Privacy Commissioner
• BC: Office of the Information and Privacy Commissioner
• Ontario: (for public sector) Information and Privacy Commissioner

Potential Remedies:

• Orders to stop monitoring
• Compensation for damages
• Employer penalties
• Policy changes required

---

Practical Compliance Checklist for Employers

Before Implementing Monitoring:

• Document legitimate business purpose
• Conduct Privacy Impact Assessment (mandatory in Quebec)
• Draft or update monitoring policy
• Choose least invasive monitoring method
• Implement technical safeguards for collected data

During Implementation:

• Provide written notice to all employees
• Obtain consent where required (Quebec, biometrics)
• Train managers on policy compliance
• Set up secure data storage
• Establish data retention schedule

Ongoing Compliance:

• Annual policy review
• Respond to employee access requests within the applicable deadline (30 days under PIPEDA)
• Monitor for new provincial legislation
• Conduct periodic proportionality assessments
• Document all monitoring decisions

---

Industry-Specific Considerations

Financial Services

• Enhanced monitoring permitted for regulatory compliance (AML, KYC)
• Must still comply with PIPEDA and OSFI guidelines
• Document regulatory basis for each monitoring measure

Healthcare

• Additional restrictions for accessing patient data
• PHIPA and provincial health privacy laws apply
• Monitoring must not compromise patient confidentiality

Technology

• Code repository monitoring generally permitted
• Access to developer personal projects requires clear boundaries
• Open source contribution policies needed

---

Frequently Asked Questions

Q: Can my employer read my personal emails on a company computer? Generally no, but they can monitor company email accounts. Clear policies should distinguish between personal and business use.

Q: Can I be fired for refusing workplace monitoring? Depends on the jurisdiction and reasonableness of the monitoring. Unreasonable monitoring demands may constitute constructive dismissal.

Q: Does my employer need my consent to install tracking software? It depends on the jurisdiction and the technology. In Quebec, stricter rules apply (for example, a privacy impact assessment for new information systems, and express consent for biometric identity verification). In other provinces, clear notice and a legitimate purpose may suffice, but consent is best practice.

Q: Can my employer monitor my personal social media? Generally no, unless your posts directly affect your employment duties or the employer's legitimate business interests.

---

Protect Your Organization

Implementing a compliant employee monitoring program requires balancing business needs with privacy rights. Canada Compliance AI helps Canadian SMEs work through CASL, PIPEDA and Quebec Law 25: a free two-minute compliance check, readiness scores, a prioritized task plan, a 24-month breach register and an exportable audit log. See what's live and what's planned.

Related Articles:

• Privacy Officer Requirements in Canada
• Provincial Privacy Laws Comparison
• 90-Day Privacy Program Launch