I mentioned in an earlier post that employment law and specifically privacy of employee information is a growing part of my practice. One of the least understood portions of PIPEDA is how it applies to employee information. PIPEDA is a constitutionally peculiar bit of law, which is best reflected in how it applies to employee information. Privacy is generally seen as a matter of "civil rights", which is within the provincial jurisdiction under the Canadian Constitution Act. For the federal government to attempt to legislate in this area, they have characterized it as a matter of commerce and assert jurisdiction under the general trade and commerce power. (Whether this is tenable, I leave to the Quebec Court of appeal and the Supreme Court of Canada (see Quebec Expected to Challenge PIPEDA's Constitutionality".)

All matters of legitimacy aside, it is agreed that the traditional employer-employee relationship is not a part of general trade and commerce and is reserved to the exclusive jurisdiction of the provinces. The federal government does not have power to legislate or govern the employer-employee relationship except for federal works and undertakings and where there is a clearly interprovincial aspect. Therefore, PIPEDA does not apply to the employer-employee relationship for the provincially regulated private sector but does for employees of "federal works, undertakings or businesses". It likely applies where there is an asset-purchase of a businesses where the employee information is part of the transaction and this information crosses provincial or international boundaries.

So what is a "federal work, undertaking or business"? It is defined in Section 2 of PIPEDA, which definition is virtually identical to that found in the Canada Labour Code:

So, if you are federally regulated, PIPEDA applies to your employees. If you are not a federal work, undertaking or business, PIPEDA only applies to your employee information if you use it in a commercial way (sell it to a marketing company) or if you transfer it over provincial boundaries "for consideration." Hope this clears things up!

Labels: information breaches