Employment Applicant Privacy: Overview Of An Employer's Privacy Obligations During The Recruitment Process In Quebec

Recruitment is a crucial step for the growth and development of any organization and often requires employers to collect, evaluate, process, and store a wide range of information about candidates, including their personal information.

In Quebec, the Commission d'accès à l'information du Québec ("CAI") issued guidance reminding organizations that they must be mindful of the personal information collected and processed at each step of the recruitment process. Although applicants may voluntarily share personal information, employers are reminded not to collect and process personal information that is not essential for assessing their candidacy.

In this bulletin, we break down the CAI's guidance for employers during each stage of a typical recruitment process.

1. Overview of an Employer's Privacy Obligations

Under the Act respecting the protection of personal information in the private sector ("Quebec Privacy Act"), to the extent employers collect personal information from applicants directly or through third parties acting on their behalf (e.g., placement or staffing agencies), they remain responsible for complying with the requirements of the law and for protecting the candidate's personal information. As such, employers must:

• only collect the personal information that is necessary for the recruitment process;
• implement technical, administrative, organizational, and physical measures to protect the candidate's personal information that is in their possession (including in the possession of their service providers);
• ensure that personal information that is no longer needed is deleted or destroyed, unless retention is required by law.

The CAI cautions employers that although candidates may voluntarily agree to share their personal information, employers must satisfy the necessity condition under the Quebec Privacy Act in order to ensure that their data collection remains lawful. As such, employers are not authorized to collect personal information that is not strictly necessary for the evaluation and selection of the candidate, even if the candidate has provided consent. Said differently, the candidate's consent cannot be used as a means to "legalize" the collection of personal information that does not satisfy the necessity condition.

The above requirements continue to apply to employers even when a third party,, such as a staffing agency, recruitment firm, or placement agency, collects personal information on their behalf. Employers should therefore implement adequate policies and practices to ensure their third-party service providers also comply with the requirements of the Quebec Privacy Act.

2. What Personal Information Can Employers Collect During Each Stage of the Recruitment Process

2.1. Stage 1: Receiving Job Applications

At the initial stage of the recruitment process, employers typically require interested candidates to submit an application in response to the employer's job posting. In some cases, the application will be a form to be completed by the employee, while in other cases, candidates submit their résumé along with a cover letter containing certain information about them.

In both cases, the candidates will typically be required to provide information such as their:

• contact details (e.g., name, phone number, email address, home address);
• relevant professional experiences;
• academic background; and
• skills and interests.

Depending on the nature of the position (e.g., executive or management roles, positions regulated by law or a professional order, or roles requiring specialized skills), it is possible that employers may request additional information so they can better assess the candidate's profile.

At this stage, however, the CAI cautions employers not to request information beyond what is necessary to assess the eligibility and suitability of the candidate. For example, employers should not request reference letters at this step, as many candidate profiles may not be selected to pursue the recruitment journey. The CAI advises that it is more appropriate to ask for reference letters after the employer has already interviewed the candidate.

To further illustrate the CAI's position, here are some additional examples of what employers should avoid doing at this first stage of the recruitment process:

• requiring all applicants, regardless of the role, to complete a generic application form requesting information that may be irrelevant to their job;
• asking applicants to disclose marital status or date of birth as part of a generic form; or
• asking applicants to provide their Social Insurance Number (SIN).

2.1.1. Avoiding Discrimination

In addition to the privacy concerns regarding the collection and processing of this type of information, asking candidates to provide certain types of personal information in a job application that could relate to any of the grounds protected under the Quebec Charter of Human Rights and Freedoms (the "Charter") (e.g., age, marital status, religion, sexual orientation, citizenship, or pregnancy plans) can also open the door to discrimination complaints if a candidate is refused employment after they had provided this information.

Best practice at the job application stage would certainly be to limit the information requested from applicants to what is necessary to assess their suitability for the role.

2.2. Stage 2: Evaluating Candidate Profiles

The second stage of recruitment generally consists of assessing the profiles of those who have submitted their employment applications. Typically, the candidates that are found to be eligible and qualified will eventually be invited to an interview.

2.2.1. Candidate Identification

At this stage, it is reasonable for employers to verify the identity of the candidate who will be invited for an interview by asking to view government-issued identification. However, employers should not make a copy, take photographs, note down information from the document, or otherwise retain any of the viewed identification information.

2.2.2. Avoiding Discrimination

In the same vein as for the job application, during the interview, employers should avoidasking questions that could reveal personal information linked to grounds protected under the Quebec Charter. Exceptions exist only where such information is demonstrably necessary for the role or is otherwise permitted by law. For example, an employer should not ask a 25-year-old warehouse candidate about their plans to have children or ask a software developer applicant to disclose their religion or ethnicity.

2.2.3. Psychometric and Personality Tests

Employers may, in rare cases, wish to use psychometric or personality tests. However, the CAI emphasizes that such tests should be reserved for "specific situations" where they are strictly necessary to evaluate skills or traits directly relevant to a particular role. Employers must ensure that these tests are scientifically valid, applied using objective criteria, and are interpreted cautiously (particularly given the limitations of algorithm-driven tools). Even when tests are administered by third-party providers, employers remain responsible for compliance with the Quebec Privacy Act.

For example, for a customer service representative role, an employer may administer a validated test measuring conflict resolution skills. However, it would be inappropriate to use broad personality profiling tests unrelated to the role's core functions or responsibilities. As another example, an employer may wish to administer a leadership assessment test for a management role aimed at evaluating the candidate's ability to supervise a team and make sound decisions under stress. Employers should take good care in crafting their tests to strictly evaluate competencies that are fundamental for the role and based on objective criteria.

It's worth noting that under the Quebec Privacy Act, an employer who collects personal information from a candidate using technology that includes functions allowing the candidate to be profiled must first inform the candidate of the use of such technology and of the means used to activate the profiling function. The notion of "profiling" is defined as the "collection and use of personal information to assess certain characteristics of a natural person, in particular for the purpose of analyzing that person's work performance, economic situation, health, personal preferences, interests or behaviour."

2.2.4. Artificial intelligence Systems

The CAI has also issued guidance on the use of artificial intelligence systems ("AI Systems") in recruitment, such as for screening employment applications, ranking candidates, or assessing (or even making) hiring decisions.

As mentioned above, employers who collect personal information using technology that includes functions allowing the candidate to be profiled must inform the candidate of the use of such technology and of the means available to the candidate to activate the profiling function. Furthermore, to the extent the employer will use AI Systems to render decisions based exclusively on the automatic processing of the candidate's personal information, they must comply with additional notification obligations set out under the Quebec Privacy Act.

The CAI points out that employers must respect the principle of necessity at all times, be vigilant about algorithmic bias, and ensure that their personnel are adequately trained to understand the AI System's limitations. Employers are also required to perform a privacy impact assessment before launching a new AI System to ensure that their use is compliant with the law.

The CAI also warns that the use of AI Systems in certain situations can be highly intrusive, such as detecting emotions or assessing an individual's psychology while performing a video interview. In most cases, they consider that such practices will be considered inappropriate and will likely fail to comply with the Quebec Privacy Act requirements. More specifically, using AI Systems to analyze facial expressions, tone of voice, or body language during video interviews to assess emotional or psychological states is considered by the CAI to be an inappropriate use of such AI Systems.

2.3. Stage 3: Validating Candidate's Skills and Competencies

At this stage, employers will generally seek to validate the selected candidate's skills and competencies. The CAI recommends presenting a conditional offer of employment before seeking references, accessing external records, or requesting written consent for background checks. Employers should limit their data collection strictly to information necessary for the validation of the candidate's skills and competencies. Here are a few recommendations that are provided:

• Candidate References: Employers should obtain the candidate's consent before contacting previous employers.
• Social Media Profiles: Employers are cautioned against using information on a person's social media profile or account, as the information available in such sources may not be relevant for the employer's specific recruitment purposes or may not be accurate or up to date.
• Credit Report Verifications: Credit checks, reputation assessments, or similar reports require explicit consent and must be limited to what is necessary for the position offered. The CAI discourages organizations from using such reports to assess a person's honesty or character and recommends organizations use a less privacy-intrusive method to this effect.
• Medical Information: Medical information should be obtained strictly to the extent it is necessary for the position offered. The information may be collected via questionnaire or through medical testing. However, the CAI cautions employers that the collection of medical information must not be systematic, intrusive, or overly broad. Under the Quebec Privacy Act, medical information is generally considered sensitive information, and employers must ensure that only personnel who have a need-to-know are able to access the candidate's medical information. Considering the highly confidential nature of a candidate's medical information, employers are encouraged to retain such information in a file separate from the candidate's employment file.
• Criminal Background Checks: Criminal background checks must be directly tied to a requirement for the position offered and conducted with the candidate's prior consent. Furthermore, employers must not keep records of offences unrelated to the position or pardoned convictions. The CAI reminds employers that they must be capable of demonstrating that any criminal background check information collected was for a serious and legitimate purpose.

2.4. Stage 4: Hiring a Candidate

At the final stage, when an employment contract is signed and the employment relationship begins, employers may collect additional personal information necessary for the candidate's onboarding and for legal compliance purposes. For instance, the employer may ask for the following information from the candidate, namely:

• date of birth (e.g., the collection of this information is necessary to assess eligibility for certain health or retirement benefits);
• Social Insurance Number (e.g., the collection of this information is necessary to comply with tax laws);
• banking information (e.g., the collection of this information is necessary to process employee payroll);
• emergency contact information (e.g., the collection of this information may be appropriate to ensure the employer may reach the candidate's emergency contact in the event of an emergency); and
• employee photo (e.g., the collection of this information may be appropriate for identification or security purposes).

Where employers intend to collect biometric information, they must ensure strict compliance with the Quebec Privacy Act and potentially the Act to establish a legal framework for information technology ("Quebec IT Act"), given the highly sensitive nature of such data and specific protections and requirements set out in the Quebec IT Act.

3. Takeaways

Respecting the Quebec Privacy Act in the recruitment context is not just a legal obligation, it's a matter of an employer building trust with a prospective employee and preserving its reputation more broadly. While applicants are often eager to share personal information in the hopes of securing a role, employers must remember that this willingness does not replace their duty to collect only what is strictly necessary, to safeguard that information diligently, and to use it responsibly. Moreover, the less an employer collects unnecessary personal information about a candidate, the less likely they are to inadvertently discriminate against them. Employers should not assume that obtaining an applicant's consent allows them to collect personal information more broadly and still remain fully compliant with the Quebec Privacy Act. By embedding privacy principles into every stage of recruitment, organizations not only comply with the law but also demonstrate respect for candidates, strengthen their reputation, and foster a culture of accountability that benefits both the employer and the individuals seeking to join their team.

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2025