Electronic monitoring of employees in Ontario

Yes, if you employ 25 or more people in Ontario on January 1 of a year. The Employment Standards Act then requires a written policy on electronic monitoring of employees before March 1, stating whether you monitor and, if so, how, in what circumstances and for what purposes. The rule requires transparency; it creates no new employee privacy rights.

The requirement was added to Ontario's Employment Standards Act, 2000 (ESA) on April 11, 2022. According to the Ministry's guide, employers that employ 25 or more employees in Ontario on January 1 of a year must have a written policy on electronic monitoring of employees in place before March 1 of that year. (The first-year deadline was October 11, 2022.)

Count individual employees, not full-time equivalents: part-time and casual employees each count as one, as do employees on leave, on lay-off without termination, probationary employees and some others. All Ontario locations are counted together, and related employers treated as one employer under the ESA are counted together. If you have fewer than 25 on January 1, the requirement does not apply for that year, even if you grow later.

The policy must apply to all Ontario employees covered by the provision, including managers and executives who are employees, and to assignment employees from temporary help agencies. It can be one policy or several for different groups. A copy must be given to employees within 30 calendar days of the date the policy must be in place or is changed, and to new employees within 30 days of hire. Employers must keep a copy of every required policy for three years after it is no longer in effect.

• Whether the employer electronically monitors employees. If it does not, the policy must say so.
• If it does: a description of how the employer may electronically monitor employees.
• A description of the circumstances in which it may do so.
• The purposes for which information obtained through electronic monitoring may be used.
• The date the policy was prepared and the date of any changes, including day, month and year.

The Ministry's guide says electronic monitoring includes all forms of monitoring done electronically. Its examples include GPS tracking of a delivery vehicle, sensors that track how quickly a cashier scans items, and tracking websites employees visit during working hours. Monitoring is not limited to employer-issued devices or the workplace: if an employer monitors through an employee's personal computer used for work, or while the employee works from home, the policy must cover it.

The ESA rule is a transparency rule. The Ministry is explicit that it does not create a right not to be monitored, and does not create new privacy rights. It also says the ESA does not limit how an employer uses information collected through monitoring, even for purposes not stated in the policy.

That is not the end of the analysis. Collective agreements, the common law, human rights law and, for some employers, privacy legislation can all limit monitoring. Federally regulated employers are covered by PIPEDA for employee information, and the Office of the Privacy Commissioner of Canada's guidance on privacy in the workplace stresses that monitoring should be for a legitimate purpose, proportionate, and transparent. Employers in BC and Alberta have their own private-sector privacy laws covering employee information. Overly broad monitoring can also damage trust, so 'legal' and 'wise' are separate questions.

Many monitoring activities are side effects of ordinary security tools. Your policy should describe what your IT environment actually records:

1. 01

   Inventory the tools

   Ask IT for a list of every system that logs employee activity, and what it records by default.

2. 02

   Describe how and when

   For each type of monitoring, state how it works and whether it is continuous, periodic or triggered by an event such as a security alert.

3. 03

   State the purposes

   Security, compliance, investigating misconduct, protecting assets, safety, performance. Be honest; don't list purposes you will never use.

4. 04

   Cover all groups

   Office, field, remote and assignment workers; personal devices used for work.

5. 05

   Date it and distribute it

   Record the preparation date, give copies within 30 days, and keep each version for three years after it is replaced.

6. 06

   Review on change

   Update the policy when you add a security tool or switch on a new logging feature.

Monitoring data is often the best evidence in an internal investigation: a departing employee downloading a client list, a mailbox rule forwarding invoices to a personal address, an unauthorized login from another country. To be useful, it must be preserved properly, analyzed by someone who can explain it, and handled in line with your policy and any other legal limits. Collect only what the investigation needs, keep a record of who accessed it, and involve HR and counsel before acting on it. Our forensic team can preserve and analyze this data in a way that holds up if the matter becomes a dispute.