The processing of personal data may impose obligations to the individuals the data is related to, the data subjects. Some jurisdictions only recognize processing personal data as lawful if the data subject has provided express consent. Other jurisdictions require a legal obligation to process the data, and may not require consent. The processing of HR personal data has raised questions and court decisions in a few countries, and interpretations may vary based on data privacy and labor law requirements.
In British Columbia (BC) and Alberta, as well as under the Personal Information Protection and Electronic Documents Act (PIPEDA), employee personal information may be collected, used or disclosed without consent where the collection, use or disclosure is for reasonable purposes related to managing, establishing, or terminating an employment relationship with the individual. This is provided that the employee has been given prior notification as well as the reason personal information is being collected, used or disclosed. There are also additional enumerated circumstances in the legislation where consent is not required for the collection, use or disclosure of personal information in general.
Otherwise, BC, Alberta, Quebec and federal privacy legislation generally requires consent for an organization to collect, use or disclose personal information.
Express consent for the specified purpose is typically required. Implied consent is also provided for in certain circumstances in BC and Alberta, if the:
In Alberta, "deemed consent" may also be provided if the individual voluntarily provides the information for a specific purpose and it is reasonable that the person would voluntarily provide that information.
Further, in BC, consent will be deemed to have been given if the purpose for which the personal information is being collected, used or disclosed would be obvious to a reasonable person and the personal information has been voluntarily provided by the individual. There is also deemed consent in BC and Alberta for the collection, use or disclosure of personal information for the purpose of enrolling an individual in and providing coverage under an insurance, pension or benefit plan if the individual is a beneficiary or has an interest as an insured under the plan.
In Quebec, consent must be “manifest, free and enlightened, must be given for specific purposes” and is only valid until the purpose for which the data was requested is achieved. In addition, the Commission “d'accès à l'information” indicates that consent which is “manifest” cannot be “presumed.”
HR Best Practices: Federally, it is highly recommended that consent be obtained from employees in regards to the collection, use and/or disclosure of their personal information. It is also an expectation in all provinces that employers will safeguard, protect and maintain the confidentiality of their employees’ personal information.
