Canada: "Poking" Around Facebook: Employers Thinking About Requesting Employee Passwords Should Be Aware Of Canadian Privacy Laws

The emerging practice in the United States of employers asking for Facebook login details from prospective employees has prompted significant controversy. Some companies have made other requests such as asking job applicants to log in to their private profiles during interviews or become Facebook "friends" with a human resources manager. Facebook itself has posted a letter to users indicating that, in its opinion, it is a violation of Facebook's terms of use to share or solicit a Facebook password and warning employers that seeking access to Facebook accounts could result in unanticipated legal liability.

The Canadian context

While the legality of this practice remains murky south of the border, Canadian companies should recognize that legal protections for employees exist here with respect to such practices. While it is within an employer's rights to search for publicly available information online, companies should be particularly cautious about information they are collecting from social media sites because of the highly personal nature of that information and the reasonableness requirement in Canada for its collection.

Canadian statutes governing the collection and use of employee personal information cover some (but not all) employers and lack specific provisions related to social media concerns. Despite a lack of comprehensive coverage, where applicable legislation exists it requires that the collection of information about employees or potential employees be "reasonable" both in terms of what information is collected and the purposes for which it is used. In the Canadian context, unless the employer had valid motives it would appear unlikely that a request for the Facebook login information of an employee or potential employee would be found "reasonable."

Collecting employee information under federal privacy legislation

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to employers that are federal works, undertakings or businesses. Under PIPEDA, an organization may "collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances." Principle 4, which mandates that it be collected only by fair and lawful means, could also prevent the collection of certain data – such as a Facebook password – under circumstances that could be seen as unfair in the context of an established or nascent employment relationship.

Additional considerations in some provinces

Some provincial laws fill the gaps left by PIPEDA and apply directly to private sector businesses operating within those provinces. The British Columbia and Alberta personal information protection acts exempt employers from having to obtain consent to collect and use employee personal information, but simultaneously impose notification and reasonableness requirements.  

Under Quebec's privacy legislation, an employer may not refuse to hire a candidate because of his or her refusal to disclose personal information, unless such information is necessary for the conclusion or the performance of the employment contract. Also, Quebec's Charter of Human Rights and Freedoms forbids discrimination in employment practices, so employers must be aware that any information of a private or personal nature found on social media websites could lead them to discriminate, even accidentally, against their prospective employees.

Privacy is increasingly being recognized as an important value in Canadian society and despite the lack of clear statutory guidance on this issue, businesses must ensure they do not inadvertently transgress Canadian principles of privacy protection when dealing with social media issues in the employment context. It is important for any employer to seriously consider the legal implications of collecting private information about an employee or potential employee before requesting that information.

Norton Rose Group

Norton Rose Group is a leading international legal practice. We offer a full business law service to many of the world's pre-eminent financial institutions and corporations from offices in Europe, Asia, Australia, Canada, Africa, the Middle East, Latin America and Central Asia.

Knowing how our clients' businesses work and understanding what drives their industries is fundamental to us. Our lawyers share industry knowledge and sector expertise across borders, enabling us to support our clients anywhere in the world. We are strong in financial institutions; energy; infrastructure, mining and commodities; transport; technology and innovation; and pharmaceuticals and life sciences.

We have more than 2900 lawyers operating from 43 offices in Abu Dhabi, Almaty, Amsterdam, Athens, Bahrain, Bangkok, Beijing, Bogotá, Brisbane, Brussels, Calgary, Canberra, Cape Town, Caracas, Casablanca, Dubai, Durban, Frankfurt, Hamburg, Hong Kong, Johannesburg, London, Melbourne, Milan, Montréal, Moscow, Munich, Ottawa, Paris, Perth, Piraeus, Prague, Québec, Rome, Shanghai, Singapore, Sydney, Tokyo, Toronto and Warsaw; and from associate offices in Dar es Salaam, Ho Chi Minh City and Jakarta.

Norton Rose Group comprises Norton Rose LLP, Norton Rose Australia, Norton Rose Canada LLP, Norton Rose South Africa (incorporated as Deneys Reitz Inc), and their respective affiliates.

On January 1, 2012, Macleod Dixon joined Norton Rose Group adding strength and depth in Canada, Latin America and around the world. For more information please visit nortonrose.com.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.