6 minute read 12 Jul. 2022
Ontario takes a stance on employee monitoring

Ontario takes a stance on employee monitoring

Authors
Roobi Alam

EY Canada Privacy Leader

Roobi is a privacy professional who is determined to help organizations and individuals realize why privacy is power.

Carlos Perez Chalico

EY Canada Private Cybersecurity and Privacy Leader

I have over 23 years of experience in cybersecurity, IT risk management and privacy matters. In my free time, I read, write, go route-cycling and volunteer.

6 minute read 12 Jul. 2022

With the rapidly changing privacy landscape in Ontario, and an increasingly flexible business models it will be imperative to keep employee rights at the forefront and secure good electronic employee monitoring practices.

Bill 88, Working for Workers Act, 2022

In 2021, the Province of Ontario appointed an expert committee to address labour disruptions stemming from the pandemic. The committee’s recommendations resulted in Bill 88 – one component of the Working for Workers Act – rolled out in April of this year.

With privacy in mind, Bill 88 requires employers with more than 25 people to have a written policy in place by October 2022 disclosing electronic employee monitoring (EEM) under the Employment Standards Act (ESA).

“With more people in Ontario than ever before working from home, families deserve to know if, how and why their employers are monitoring their devices so they can protect their privacy,” stated Monte McNaughton, Minister of Labour, Training and Skills Development. He further mentioned that businesses have an increasing number of methods to monitor where employees are and what they are doing — from video and audio surveillance and network and email monitoring, to key card and biometric terminal and GPS tracking, to keystroke logging and remote configuration on device cameras. Whether it is GPS tracking of a delivery driver, a construction worker using a company phone or an office worker logging in from home, the legislation recognizes the need for individuals to know whether — and how — they are being tracked. 

The potential impact of EEM on privacy in Canada

While several provinces, including British Columbia, Alberta and Québec, have established laws requiring companies to inform employees of EEM measures, the recent changes in Ontario will demand greater transparency around EEM and set an important precedent for other provinces interpreting their own privacy legislation.

The commitment to privacy and cultivating trust and transparency is clear, but implementing the requirements behind Bill 88 may be less so. With the onus of defining and communicating EEM being placed on employers in Ontario, the ambiguity around EEM disclosure poses new and potentially ongoing challenges as requirements evolve.

“We’ve been working with clients to map assets and processes, conduct impact assessments and review and help design new EEM policies and practices,” explains Roobi Alam, EY Canada Privacy Leader. “But the privacy landscape is changing so rapidly in Ontario. It will be critical that organizations big and small both understand the requirements and be ready to adapt to legislative changes as they happen to remain compliant.”  

Preparing for Bill 88 

Starting October 11, 2022, and renewed annually on January 1, organizations are asked to have a dated EEM policy in place advising employees how and under what circumstances the employer may electronically monitor their activities and the purpose of such monitoring. A written copy, and any changes, are to be provided to existing employees 30 days in advance of policy implementation, and new employees must be given a copy of the policy in their first 30 days of employment.

The written policy on EEM must contain information regarding:

  1. Whether the employer is electronically monitoring employees, and if so:   

    ·       A description of how and in what circumstances the employer may electronically monitor employees 

    ·       The purposes for which information obtained through electronic monitoring may be used by the employer

  2. The date the policy was prepared and the date any changes were made to the policy

  3. Such other information as may be prescribed: 

    ·     For instance, the Lieutenant Governor in Council may issue transitional regulation that requires additional information considered necessary in connection with the implementation of amendments

So, where to start? Companies that rely on employees who work from digital platforms – in industries like consumer services, construction, real estate and transportation, for example – or those considering remote or hybrid working models will need to pay close attention to Bill 88.

In addition to defining the rules around EEM activities, operational frameworks will be important for actioning policies. The following three-step process can help organizations build out an effective framework while helping them align their policies with their core values in support of strategic goals:

The future of EEM

As we move forward with post-pandemic realities, it is becoming clear that remote working business models are forcing employers to adapt to an increasingly decentralized and flexible work environment. More than ever, the workplace will require measurable data, whether keeping tabs on productivity, maintaining cybersecurity or responding to employees’ resource needs. It will be imperative to keep employee rights at the forefront and secure good EEM practices.

“Effective compliance preparation for Bill 88 will be more than a one-time-checkbox exercise,” Alam explains. “Drafting a corporate policy on EEM that is fair and functional will be key, and organizations will need to remain vigilant, resilient and responsive as case law evolves.”

Bill 88 will be a positive step forward in addressing the trust deficit that the Government of Ontario is attempting to address, and their message is clear: transparency will be key to making that happen.

Summary

A decentralized workplace means employers need to focus on securing good electronic employee monitoring (EEM) practices. It includes assessing and documenting current practices, discovering organizational needs and developing a new EEM policy with a compliance framework.

About this article

Authors
Roobi Alam

EY Canada Privacy Leader

Roobi is a privacy professional who is determined to help organizations and individuals realize why privacy is power.

Carlos Perez Chalico

EY Canada Private Cybersecurity and Privacy Leader

I have over 23 years of experience in cybersecurity, IT risk management and privacy matters. In my free time, I read, write, go route-cycling and volunteer.