• "Poking" Around Facebook: Employers Thinking About Requesting Employee Passwords Should Be Aware of Canadian Privacy Laws
  • May 9, 2012 | Authors: Arnaud Gingras-Tremblay; Pierre-Étienne Morand; Pamela Sidey
  • Law Firms: Norton Rose Canada LLP - Quebec Office ; Norton Rose Canada LLP - Toronto Office
  • The emerging practice in the United States of employers asking for Facebook login details from prospective employees has prompted significant controversy. Some companies have made other requests such as asking job applicants to log in to their private profiles during interviews or become Facebook “friends” with a human resources manager. Facebook itself has posted a letter to users indicating that, in its opinion, it is a violation of Facebook’s terms of use to share or solicit a Facebook password and warning employers that seeking access to Facebook accounts could result in unanticipated legal liability.

    The Canadian context
    While the legality of this practice remains murky south of the border, Canadian companies should recognize that legal protections for employees exist here with respect to such practices. While it is within an employer’s rights to search for publicly available information online, companies should be particularly cautious about information they are collecting from social media sites because of the highly personal nature of that information and the reasonableness requirement in Canada for its collection.

    Canadian statutes governing the collection and use of employee personal information cover some (but not all) employers and lack specific provisions related to social media concerns. Despite a lack of comprehensive coverage, where applicable legislation exists it requires that the collection of information about employees or potential employees be “reasonable” both in terms of what information is collected and the purposes for which it is used. In the Canadian context, unless the employer had valid motives it would appear unlikely that a request for the Facebook login information of an employee or potential employee would be found “reasonable.”

    Collecting employee information under federal privacy legislation
    The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to employers that are federal works, undertakings or businesses. Under PIPEDA, an organization may “collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.” Principle 4, which mandates that it be collected only by fair and lawful means, could also prevent the collection of certain data - such as a Facebook password - under circumstances that could be seen as unfair in the context of an established or nascent employment relationship.

    Additional considerations in some provinces
    Some provincial laws fill the gaps left by PIPEDA and apply directly to private sector businesses operating within those provinces. The British Columbia and Alberta personal information protection acts exempt employers from having to obtain consent to collect and use employee personal information, but simultaneously impose notification and reasonableness requirements. 

    Under Quebec’s privacy legislation, an employer may not refuse to hire a candidate because of his or her refusal to disclose personal information, unless such information is necessary for the conclusion or the performance of the employment contract. Also, Quebec’s Charter of Human Rights and Freedoms forbids discrimination in employment practices, so employers must be aware that any information of a private or personal nature found on social media websites could lead them to discriminate, even accidentally, against their prospective employees.

    Privacy is increasingly being recognized as an important value in Canadian society and despite the lack of clear statutory guidance on this issue, businesses must ensure they do not inadvertently transgress Canadian principles of privacy protection when dealing with social media issues in the employment context. It is important for any employer to seriously consider the legal implications of collecting private information about an employee or potential employee before requesting that information.