Special thanks to our articling student Rana Aly for contributing to this update.
Employers monitoring their employees in the workplace should be cognizant of their obligations under employment and data privacy laws. This article provides a primer on legal requirements for employee monitoring in Canada and contrasts employer compliance requirements in the provinces of Ontario, British Columbia, Alberta, Quebec, and Nova Scotia.
Employers must balance operational needs, such as safety, security, and productivity, with any privacy rights of their employees. Generally, monitoring should be reasonable, proportionate, and tied to a legitimate business purpose. Organizations must comply with applicable federal or provincial privacy laws, which can include safeguarding any employee personal information collected, obtaining employee consent in certain circumstances, and providing notice to employees of monitoring practices.
PIPEDA and Employee Monitoring
For federally regulated private-sector employers—such as banks, airlines, and telecommunications companies— employee monitoring is generally governed by the Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA only applies to employee personal information in federally regulated workplaces; otherwise, it governs commercial and customer personal information across Canada.
Provinces that have enacted private‑sector privacy legislation deemed “substantially similar” to PIPEDA are exempt from PIPEDA’s collection, use, and disclosure provisions under section 26(2)(b). Presently, only British Columbia, Alberta, and Québec have privacy legislation that is substantially similar to PIPEDA.
In provinces which do not have substantially similar private‑sector privacy legislation, such as Ontario and Nova Scotia, PIPEDA does not apply to provincially regulated employers’ handling of employee personal information. In those provinces, employee privacy protections arise through a more fragmented framework that may include employment standards legislation, privacy torts under the common law, employment contracts, workplace policies, and collective agreements. While PIPEDA does not govern employee personal information for provincially regulated employers in such provinces, it continues to apply to commercial or customer personal information across all private‑sector organizations engaged in commercial activities.
Legal Framework Across Provinces
Ontario:
Ontario does not have stand-alone privacy legislation. In Ontario, the relevant privacy law framework with respect to employee privacy and electronic monitoring is certain provisions of the Employment Standards Act, 2000 and the common law.
Ontario is the only province where employers are statutorily required to have a written policy on the electronic monitoring of employees in place. Employers with 25 or more employees in Ontario must have a policy disclosing whether they electronically monitor their employees. The policy must include a description of how and in what circumstances the employer may electronically monitor employees, the purposes for which the information obtained through electronic monitoring may be used, the date the policy was prepared, and the date any changes were made to the policy.
Electronic monitoring goes beyond simply tracking websites or messages shared between coworkers on company platforms. It may also include tracking employee badge data and connections to workplace Wi-Fi. Employers who have mandated a return to the office in Ontario should ensure that such monitoring practices, often relied upon to ensure work-from-office policy compliance, are described in the company’s electronic monitoring policy.
It is important to note that this requirement does not create new privacy rights – only that the employer state in the policy what their electronic monitoring practices are.
For federally regulated employers in Ontario, PIPEDA governs the collection, use, or disclosure of personal information, including both customer and employee personal information. As there is no substantially similar legislation for provincially regulated private-sector employers, the common law is the legal framework applicable to them.
British Columbia:
In British Columbia, employee monitoring is governed by two provincial statutes: the British Columbia Personal Information Protection Act (British Columbia PIPA) for private-sector employers, and the Freedom of Information and Protection of Privacy Act (FIPPA) for public-sector employers. Under FIPPA, public bodies do not need employee consent to collect personal information if the collection is necessary and directly connected to a program or activity of the public body. However, public-sector employers must provide notice when collecting information indirectly, particularly for managing or ending an employment relationship.
For private-sector employers, the British Columbia PIPA generally requires consent to collect personal information. An exception applies to the collection of employee personal information for the purposes of establishing, managing or terminating an employment relationship. In such cases, employers may collect employee personal information without the employee’s consent.
For example, as a private-sector employer in British Columbia, you generally may track employee badge data without the employee’s consent, if the purpose for collecting that information is to ensure compliance with a mandatory return-to-office policies. However, public-sector employers must be more cautious. In Corporation of the District of West Vancouver v ATU, Local 134, 2024 CanLII 124405 (BC LA), an arbitrator found that an employer intruded on a Union President’s privacy rights by questioning him on an unlisted YouTube video he spoke in, which was only meant to be viewed and accessed by union members.1 The arbitrator held that the employer was not authorized under FIPPA to collect and retain the YouTube video, and awarded $30,000 in damages against the employer. This decision highlights that public sector employers in British Columbia generally cannot treat semi-private online content as open for monitoring unless there is a clear and legitimate justification.
Alberta:
In Alberta, the Alberta Personal Information Protection Act (Alberta PIPA) governs employee monitoring and the collection, use, and disclosure of personal employee information. Under the Alberta PIPA, employers generally must obtain an employee’s consent before collecting their personal information. However, consent may not be required for the collection and use of personal employee information if:
- the collection or use is solely for the purpose of establishing, managing or terminating an employment relationship or managing a post‑employment relationship;
- it is reasonable to collect or use the information for the particular purpose for which it is being collected or used, and
- in the case of an individual who is a current employee of the organization, the organization has, before collecting or using the information, provided the individual with reasonable notification that personal employee information about the individual is going to be collected or used and of the purposes for which the information is going to be collected or used.
Thus, to avoid the requirement to obtain employee consent, private-sector employers in Alberta should ensure that their relevant workplace policies contain statements notifying existing employees of any electronic monitoring practices and the purpose for which personal employee information is going to be collected or used under their policies.
In Nal Resources Management Ltd (Re), 2019 CanLII 64575 (AB OIPC), the Alberta Office of the Information and Privacy Commissioner held that GPS data collected from vehicles used by contractors constituted personal employee information under the Alberta PIPA.2 The Commissioner found that the company was authorized to collect and use the information without consent under PIPA. GPS tracking by the company was found to be reasonable and implemented to manage the working relationship between the company and its contractors and meet the company’s occupational health and safety obligations.
For clarity, while Alberta has substantially similar private‑sector privacy legislation, the collection, use, or disclosure of personal information by federally regulated employers is still governed by PIPEDA, not Alberta PIPA.
Quebec:
Québec’s Act Respecting the Protection of Personal Information in the Private Sector, modernized by Law 25, applies to all private-sector employers in Quebec.
Monitoring must have a legitimate purpose—such as safety or investigating misconduct—and be proportionate and minimally intrusive. Employers are also required to inform employees about the type, purpose, and timing of monitoring and obtain employee consent to all monitoring. Non-compliance may result in complaints to the Commission d’accès à l’information (CAI), which is Quebec’s privacy and access to information regulator.
In Commission d’accès à l’information du Québec, Décision Crane Supply, 20 mai 2025, 1031833, the CAI found that an employer had an excessive in-vehicle video surveillance system in company-owned vehicles. 3 This decision reinforces the principle of proportionality and the need to consider less intrusive alternatives with data collection in Quebec.
Nova Scotia:
In Nova Scotia, the legal framework differs between the public and private sectors.
For public‑sector employers, the Freedom of Information and Protection of Privacy Act (FOIPOP) governs the collection, use, disclosure, retention, and protection of personal information by public bodies. Under FOIPOP, a public body:
- may collect personal information only where the information relates directly to and is necessary for an operating program or activity of the public body;
- must collect personal information directly from the individual unless an exception applies; and
- may use personal information only for the purpose for which it was collected or a use consistent with that purpose.
The FOIPOP does not apply to provincially regulated private‑sector employers, and Nova Scotia does not have privacy legislation governing the collection, use, or disclosure of personal information by such employers. Instead, employee monitoring for provincially regulated private‑sector employers is governed by the common law.
Key Takeaways for Employers
While monitoring employees in the workplace is generally permissible, employers should ensure that they are complying with their requirements under applicable privacy laws, which vary by province and employer headcount. As a best practice, an employer’s monitoring practices should be described and captured in some capacity in its relevant workplace policies. This includes a description of how and in what circumstances the employer is monitoring its employees and the purposes for which the information obtained from monitoring may be used.
Depending on the province and circumstances surrounding employee monitoring, you may not be required to obtain employee consent. We recommend reaching out to counsel if you are unsure about your privacy law obligations, as infringements, even unintentional, can come with costly legal consequences.
1 Corporation of the District of West Vancouver v ATU, Local 134, 2024 CanLII 124405 (BC LA), online: CanLII <https://www.canlii.org/en/bc/bcla/doc/2024/2024canlii124405/2024canlii124405.html?>.
2 Nal Resources Management Ltd (Re), 2019 CanLII 64575 (AB OIPC), online: CanLII <https://canlii.ca/t/j1h0s>.
3 Commission d’accès à l’information du Québec, Décision Crane Supply, 20 mai 2025, 1031833, en ligne : CAI <https://www.cai.gouv.qc.ca/uploads/pdfs/decisions-en-surveillance/1031833-S_decision-cai-13859380-canada-inc-2025-05-20.pdf?v=1764364187>.