Early in the pandemic, several employers were caught secretly watching unsuspecting employees working from home through their computer’s camera. Although these employers did this covert surveillance to ensure their employees were working, the surveillance was problematic, both from an employment perspective and from a privacy perspective, especially as some employees were required to work in their bedrooms or other private places. Members of the public were outraged and demanded transparency.
The Ontario government acted and recently passed Bill 88: Working for Workers Act, 2022 requiring employers to have an electronic monitoring policy outlining how they are electronically monitoring their employees. The purpose of the electronic monitoring policy is transparency. In a press release, the Ontario government noted that employees “deserve to know if and how [they] are being monitored”, and that the Bill is aimed at protecting workers’ privacy “by requiring employers to be transparent on how employees’ use of computers, cell phones, GPS systems and other electronic devices are being tracked”.
Therefore, starting on October 11, 2022, most Ontario-regulated employers with 25 or more employee as of January 1, 2022 must have a written policy in place with respect to electronic monitoring. In the future, all Ontario-regulated employers with 25 or more employees on January 1st of any year must, before March 1st of that year, have a written electronic monitoring policy in place.
What does the electronic monitoring policy require?
How do you dot your i’s and cross your t’s in privacy compliance? An electronic monitoring policy is similar to a website privacy policy, although it requires less detail. For example, website privacy policies generally require an explanation of the personal information being collected, how it is being collected, why it is being collected, how it will be protected, how and with whom it will be shared, and when it will be disposed of. There are other requirements as well, including disclosure to the public of contact information for the data protection officer (also known as a privacy officer or chief privacy officer).
In contrast, the electronic monitoring policy is simpler and need only contain the following:
- whether the employer electronically monitors employees and if so,
- a description of how and when the employer electronically monitors employees, and
- the purposes for which information obtained through electronic monitoring may be used by the employer;
- the date the policy was prepared and the date any changes were made to the policy; and
- any other information the Ontario government prescribes.*
Employers are also required to:
- provide a copy of the policy to:
- all new hires within 30 days of the employee becoming an employee of the employer;
- all employees within 30 days of the policy being prepared;
- all employees within 30 days of the policy being revised/changed; and,
- all assignment employees assigned to perform work for the employer (by a temporary help agency) within 24 hours of the start of the assignment or within 30 days after the employer is required to have the policy in place.
- retain a copy of policy for three years after it, or any version of it, ceases to be in effect.
Importantly, Bill 88 does not limit or affect an employer’s ability to monitor or use the information obtained through electronic monitoring of its employees. For more information on what types of employee monitoring are permissible under the law, please see Jennifer Herpers’ previous blog post: Electronic employee monitoring: Can you do it and what are the limits?
If an employee or assignment employee is not provided with a copy of the electronic monitoring policy as outlined above, the employee may file a complaint with the Ministry of Labour. However, the legislation does not permit, and the Ministry will not investigate, a complaint alleging a contravention of any other part of the electronic monitoring provisions.
Key considerations to keep in mind when drafting your electronic monitoring policy
- Since “electronic monitoring” is not defined in Bill 88, best practice is to cast a wide net and be more inclusive than exclusive when determining what to include.
- The law does not require that employees be able to opt out of being monitored, nor does the law require the employee’s consent.
- If your organization implements new forms of monitoring, the policy will need to be amended.
- Electronic monitoring could include:
- Computer monitoring including log-in times, log-in locations, internet usage, emails, productivity monitoring; keystrokes, idle time, etc.;
- GPS tracking in vehicles;
- Cell phone location/call logs;
- Key card access; and
- Video cameras at entrances and exits.
- In determining whether your organization has met the 25-employee threshold, you count the number of employees employed by the organization on January 1st (including any employees on a leave of absence):
- All Ontario employees, whether full-time, part-time, temporary or casual, and including those on a leave of absence.
- All employees of related organizations if the organizations are considered related under s. 4 of the Act.
We can help draft your electronic monitoring policy
We can help draft your electronic monitoring policy and other privacy-related policies and agreements. For example, if you collect personal information from your consumer clients, you need to ensure you have a Privacy Policy (usually shared on your website). If you engage in mass marketing promotions, you also need to ensure you are compliant with anti-spam legislation.
In addition, preserving the personal information you collect—whether about your employees or your customers or clients—is important, and you should ensure you have technical and organizational measures in place to protect that information. We can help you draft those measures. Some of those measures may include sanctioning employees who violate privacy laws or even include drafting and signing personal information protection agreements (also referred to as data protection agreements) with other companies that process the personal information you provide them. Such agreements provide you more control over how those other companies protect and process that information.
If you have questions about or need assistance with drafting employee policies, including your electronic monitoring policy, please reach out to any member of Siskinds’ Labour & Employment Law Group.
If you have questions about or need assistance with drafting privacy and cybersecurity-related policies or agreements, including website privacy policies or data protections agreements, please reach out to any member of Siskinds’ Business Law Group.
You can also reach out to the authors: Jennifer Herpers, an Ontario lawyer specializing in labour and employment law, at jennifer.herpers@siskinds.com, or Savvas Daginis, an Ontario, Illinois, and DC lawyer specializing in technology and privacy law, at savvas.daginis@siskinds.com.
*As of September 20, 2022, no such information has been prescribed.