Are you breaching your employees’ privacy expectations when you use their personal contact, health information or emergency contact information when you conduct employee wellness checks at home?
We have been taught under PIPEDA (recall the Personal Information Protection and Electronic Documents Act) that you must generally obtain an individual’s consent when you collect, use or disclose an employee’s personal information – and such personal information must only be used by an employer regulated by PIPEDA or who adopted a policy that follows PIPEDA’s principles for the purposes for which it was collected. If you are going to use it for another purpose, you must obtain consent again.
But what if you don’t have time or ability to get such additional consent given concerns for an employee’s wellness at home? Let’s hope as an employer you never have to face this conundrum – or that if you do, you have already addressed it in your workplace policies prior to it becoming an issue so that you can proceed without potential conflict or liability.
The issue: As an employer you generally collect, use and disclose personal information, including for example employee home addresses and telephone numbers for payroll, benefits and other administrative purposes. You might also collect and store personal health information that protected by the Personal Health Information Protection Act (PHIPA) in Ontario. Securing and maintaining the privacy of any employee health information is a top priority for every employer.
As an employer you most likely also collect and have employees’ consent to use and disclose employee emergency contact information in case they experience an injury or illness while at work.
What if an employee leaves work ill or injured?
What if an employee leaves work appearing ill and inexplicably doesn’t return?
What if you know employees have health issues that might be the cause of their absences or that creates grave concerns when absent (e.g., severe depression)?
What if you know an employee has a health issue (e.g., heart disease) that requires medication?
Can you use their home address to do a wellness check?
Can you disclose the employee’s home address to concerned co-workers so that they can do a wellness check?
Can you call the employee’s emergency contacts to ask about the employee’s wellbeing and to ask them to do a wellness check? Can you disclose the health concern that is the basis of this request?
Can you call the police to conduct a police wellness check? Can you disclose the health concern and employee health information/history that is the basis of this request?
What as a responsible and concerned employer do you do when you are faced with such questions?
On the one hand, when an employee is not at work use of their personal or emergency contact information is not covered by the intended purposes for which it was collected under a traditional emergency contact form. This can lead to breach of privacy and policy concerns. Added to this, not every employee would appreciate their employer disturbing them and their privacy at home – even when their employer has done so with the best of intentions and in good faith.
On the other hand, employees have provided emergency contact information for emergency purposes and urgent circumstances. Surely an employee being unexpectedly absent from work without calling in as required, who is not answering the phone, and for whom the employer or the employee’s coworkers are concerned about their safety constitutes an urgent circumstance.
Update your personal information and emergency contact information policies and forms to cover these scenarios and answer these questions.
Add express consent to use and disclosure of personal information and emergency contact information for concerns relating to illness or injury outside of the workplace and working hours.
Remind employees when selecting emergency contacts to ensure they have listed appropriate persons who can handle dealing with an emergency or urgent situation (e.g., not elderly and frail), are generally available to assist (e.g., don’t frequently travel and are likely to answer their phones or check messages on a regular basis), know the employee’s health history, whom the employee would not be embarrassed knowing their personal health information, and who know the employee’s family and friends whom the employee is okay with knowing they are in a health crisis and their contact information.
Sheryl Johnson is a Partner at Sullivan Mahoney. She has extensive experience in representing clients in both the provincial and federal jurisdictions on all matters relating to employment, labour, administrative and employment related privacy, cannabis, Aboriginal and Indigenous law as well as in civil litigation. She is the author of Sexual Harassment in Canada: A Guide for Understanding and Prevention. Email: firstname.lastname@example.org