Who is covered
In British Columbia, Alberta, and Quebec, provincial private-sector laws (PIPA and Law 25) apply to how employers handle personal employee information.
In other provinces, employee information is often considered outside PIPEDA's commercial activity definition, but employees of federally regulated businesses (banks, airlines, telecoms, interprovincial trucking) are covered by PIPEDA.
Public-sector employees are covered by the federal Privacy Act or the applicable provincial access-and-privacy legislation.
Workplace monitoring
Canadian law generally allows employer monitoring only when:
- The employer has a clearly identified, reasonable purpose (security, productivity, regulatory compliance).
- Employees are told in advance how monitoring occurs.
- Monitoring is proportionate and not more intrusive than necessary.
- Information collected is used only for the stated purpose.
Ontario's Bill 88 (Electronic Monitoring Policies)
Since 2022, Ontario employers with 25 or more employees must have a written policy describing any electronic monitoring of employees.
The policy does not limit what the employer can do, but it must be transparent about the monitoring, its purpose, and the circumstances.
Biometric time-clocks and access control
Fingerprint scanners, facial-recognition time-clocks, and other biometric systems require heightened scrutiny because biometric information is sensitive.
Commissioners in BC and Alberta have found that biometric time-clocks are not reasonable if a less intrusive alternative (card, PIN, password) would serve the same purpose.
Medical information and return-to-work
Employers can ask about work-related limitations (what you can and cannot do) but are generally not entitled to diagnosis, symptoms, or treatment details. Medical notes should contain only what is needed to support accommodations or leave.