Interview with Kris Klein

April 2007

Interviewee: Kris Klein, Litigation Counsel, Office of the Privacy Commissioner of Canada

Mr. Klein is a co-author of ‘Privacy in Employment: Control of Personal Information in the Workplace' published by Thomson Carswell.

Note: Thomson Carswell is offering a 20% discount on their privacy publications for subscribers to Nymity News. Learn more

Subject: Privacy issues related to hiring employees in Canada

Klein:  Let me first say that I’m answering these questions while working for the Privacy Commissioner of Canada.  I’ve discussed the nature of the conversations with my office and I’ve been given the go ahead to answer the questions, but the reader should know that these are my own answers and they are given in the context of what I know as a lawyer who works in the privacy area and as someone who has done research and written a bit on the issues of privacy in the employment context.  Nothing I say here should be taken as legal advice from the Privacy Commissioner’s office and caution should be taken into reading my own comments as being the Privacy Commissioner’s.

As another opening comment, I want to emphasize that privacy in the employment context in Canada is further complicated because of the differing jurisdictions that govern in the area.   Even at the federal level there are two statutes that apply in different situations so nothing I say now can be interpreted as being applicable to every situation that might arise. Moreover, nothing I say here should be interpreted as though I am advocating that the Privacy Commissioner of Canada should have the final say on privacy in the employment context in ALL of Canada.  Clearly, each legislative body has their own fields of responsibility in the area and other authorities have oversight as well.

Nymity:  What personal information is generally collected during a hiring process?

Klein:  Different employers collect different types of information depending on what job they are filling.  For example, when looking to hire a police officer, a host of psychological information is requested.  On the other hand, it would be inappropriate for an employer to ask for that type of information of someone applying to be a retail store clerk.  What it comes down to is the need for the employer to figure out, in advance, what types of information are required

What is clear, however, is that what is collected is personal information.  It is definitely information about an individual and therefore privacy issues must be addressed.

Nymity:  What are the privacy concerns related to interviewing candidates for employment?

Klein:  As with the example above, probably the number one privacy concern is asking questions that will elicit personal information that is unnecessary.  For example, it is likely inappropriate to ask a prospective employee if they have children whereas asking whether or not they are able to travel (if traveling is a necessary component of the job) might be reasonable.

Nymity:  What are the privacy issues related to conducting background checks?

Klein:  When conducting a background check, it must be limited to the collection of information necessary to help make the decision of whether or not to hire an individual.  Under PIPEDA, you also need the consent of the individual whom you are looking at and you should inform them of the type of information you intend on gathering during a background check.  That being said, in some cases a background check will be something that is perfectly reasonable in the circumstances and the prospective employee will likely be seen to have implicitly consented to one.   For example, if a prospective employee is applying to work as a security agent at an airport, it is abundantly reasonable for the employer to conduct a background check and it would be difficult to find that the employee has not implicitly consented to the check by virtue of applying for the position.

Nymity:  What are the privacy issues related to conducting reference calls about prospective employees?

Klein:  Again, consent and proper notice to the individual that this information will be collected from a reference.  Also, the prospective employer should be aware that when discussing a prospective employee with a reference, there is ample opportunity to disclose information about the prospective employee to the reference.  Everyone should be aware of this and the prospective employee should be given the opportunity to tell the prospective employer what, if any, areas of personal information should not be discussed with the reference.  For example, if a prospective employee is interviewing for a job after recovering from a serious illness for that past year and wants to use a reference from a couple of years ago, the prospective employee should feel free to ask the employer not to mention to the reference the fact that the prospective employee has been ill (assuming, of course, that the fact that the person has been ill has already been voluntarily disclosed by the employee to the prospective employer).

The prospective employer should also guard against putting the person giving the reference in a situation where they are required to disclose unnecessary personal information.  For example, if I’m giving a reference for Terry, I shouldn’t be asked by a prospective employer of Terry’s if he is a good softball player – unless, of course, Terry’s prospective employer is a professional softball team.

Nymity:  Are there any issues with unsuccessful candidates making access request to understand why they were not selected for employment?

Klein:  Because one of the pillars of privacy protection is adequate access to one’s own personal information, prospective employers must realize that they may very well have to disclose everything collected on a prospective employee.  This shouldn’t, in any way, discourage prospective employers from collecting all information necessary to make the right hiring decision.  It’s only meant to be a reminder that ALL information – including opinions about prospective employees – may be accessed so it is best to pay strict attention to the points I made above about collecting ONLY that information necessary to make the decision.

Knowing that a prospective employee also has access to their personal information should serve to help organizations remember to take the added step necessary to ensure that they are collecting accurate personal information.

Nymity:  Is drug testing a privacy matter related to the hiring process?

Klein:  Drug testing is an issue that implicates human rights issues, privacy issues and labour issues.

There is some jurisprudence that has already established guidelines about the appropriateness of drug testing from a human rights perspective and we are currently starting to see Commissioners and labour arbitrators dealing with it from a privacy perspective.

I think it is safe to say that before an employer uses drug testing as a screening tool in the hiring process they will have to demonstrate with pretty solid evidence that this privacy-invasive measure is necessary and that there exist no less-privacy-invasive options to screen people.

Nymity:  What are the privacy issues related to collecting and retaining resumes?

Klein:  I think that it is generally understood that when a prospective employee sends an organization a resume, the organization will likely retain the resume for some period of time.  Indefinite retention makes little sense from both a privacy and business point of view, so I don’t think it’s an issue that comes up too often.  That being said, organizations should put some thought into why they retain resumes and then figure out what length of time would serve that purpose.  Notice to prospective employees should then be readily available about the retention policy.

Nymity:  What are the concerns related to retaining information about individuals obtained during the hiring process if these individuals are not selected for employment?

Klein:  Once a decision is made about a prospective employee, the information collected for the purpose of making that decision is no longer useful (unless  the employee was hired and some basic tombstone data can be transferred, with consent and notice, to the HR division of the organization).  So, only a reasonable retention period should be chosen that takes into account, for example, someone’s access rights to their own information or an impending need to continue hiring people and the pool of candidates from whom information was already collected could be considered.

Nymity:  With respect to federal works, undertakings or businesses, what forms of consent are generally required during the hiring process?

Klein:  In my experience, most types of information are collected during the hiring process with implicit consent or consent based on notice.  That is because most often, the purpose of the collection is obvious (i.e., we need your name and Social Insurance Number in order to be able to pay you), and by readily supplying the information, the employee is implicitly consenting.

Support for this position is found in the Federal Court of Appeal decision in the “e-speak” matter.  In that case, the employer collected a voice print from its employees and the Court found that those employees who had provided a voice sample were seen to have consented to the collection.

Nymity:  How does the absence of consent for the management of the employment relationship impact organizations in British Columbia and Alberta during the hiring process?

Klein:  I cannot speak for the experience of organizations in those provinces, however, what should be emphasized here is that PIPEDA’s requirement for consent when collecting, using or disclosing personal information in the employment context is not an unworkable standard.  In fact, the Federal Court of Appeal recently affirmed in the “e-Speak” decision that consent is required and is obtainable from employees.

Nymity: For an organization that is not a federal works, but subject to PIPEDA, would information collected during the hiring process be subject to PIPEDA being information identifiable to an individual?

Klein:  Employee matters other than for federal work, undertaking or business fall under provincial jurisdiction. For PIPEDA to apply it would have to be viewed as a commercial activity outside of the employee umbrella.

Nymity:  In closing, what are the top five employee privacy issues?

I’ll give you three:

• Surveillance:  Employers should ask the question: “Just because we have the ability, should we?”
• Striking the right balance:  Employees are human beings with rights while employers need to be able to ensure a productive workforce.  Without the right balance, neither will exist for each others mutual benefit.
• Respect:  Employers must respect the dignity that should be afforded to every employee while employees must respect the employer’s need to stay in business and keep a workforce.