This paper aims to articulate practical guidelines, grounded in Canadian privacy law and the privacy principles developed by the Organisation for Economic Co-operation and Development (OECD), to assist employers in assessing the legal permissibility of monitoring and collecting personal information from employees’ social media pages.
To articulate guidelines for Canadian employers, the paper synthesizes information from three sources: Canadian privacy statutes; guidance documents issued by Canadian privacy commissioners; and investigations conducted by privacy commissioners into organizations that collected personal information from social media. The analysis then extends beyond the Canadian context and articulates general guidelines for employers worldwide based on the OECD privacy principles.
The analysis identifies four factors that organizations should consider to determine whether the collection of employee personal information is permissible: whether the information is related to an organizational activity; whether it is necessary for that activity; whether the purpose of the collection is reasonable; and whether valid consent has been obtained.
Employees increasingly post personal information on social media platforms, and much of this information is accessible to employers and may appear in their feeds. Employers therefore need clear guidance on the legal permissibility of collecting personal information from employees’ social media pages. Grounded in both real-world investigations by Canadian privacy commissioners and doctrinal legal analysis of Canadian privacy legislation, this paper provides practical guidelines that are straightforward to implement and explains the legal rationale behind each guideline.
