The Commission d’accès à l’information (CAI) recently added a new page to its website dedicated to the collection of personal information during the various stages of the hiring process. The CAI emphasizes the criterion of necessity and reminds employers that, even if a candidate consents to providing personal information that is not necessary for the hiring process, the employer is not entitled to collect it in accordance with applicable personal information protection legislation.
Receiving applications
At the application stage, employers may only request and collect personal information that is necessary to assess whether the applications received are eligible and express interest for the position advertised. The CAI recognizes that more personal information may be required for positions of high responsibility or for positions subject to professional regulation or specific regulations.
Personal information collection forms discouraged: The CAI discourages the use of the same form for all positions, as this could lead an organization to collect personal information that is not necessary for the hiring of certain employees.
Too early to ask for references: According to the CAI, it is too early to obtain references for candidates at the application stage. Instead, the CAI considers that references should be collected after interviews.
Application evaluation
Interviewers can request ID but not keep a copy: An employer may ask to see an ID to confirm a candidate’s identity, but they can’t keep a record of the information appearing on the ID.
Prohibited discrimination: Employers may not collect or request information relating to personal characteristics protected by the Charter of Human Rights and Freedoms, unless such information is objectively required by the nature of the position to be filled or if the employer is a non-profit organization pursuing a particular mission that justifies a distinction, exclusion or preference in the selection of its personnel.
Psychometric tests should be used with caution: According to the CAI, these tests should be reserved for specific situations. Caution is advised when using psychological or psychometric tests for candidates. The employer must notify the candidate that such a test will be conducted and remains responsible for protecting the personal information of candidates collected during this process.
Use of artificial intelligence should be disclosed: The CAI requires employers to pay particular attention to the necessity, transparency, and discriminatory bias criteria if they are considering using or do use AI in the hiring process. For more information, see our article on the CAI’s brief on the use of AI in the workplace here.
Confirmation of the successful candidate’s skills and abilities by the employer
References and consultation of external files permitted after conditional job offer: According to the CAI, an employer should wait until a conditional job offer has been made to the candidate before asking for references or consulting external files about them. The employer must obtain the candidate’s prior consent before contacting their references or consulting an external file about them.
The CAI reminds employers that they must limit themselves to necessary personal information. For example, unless a candidate’s date of birth is necessary for consulting an external file, it should only be collected after the candidate has been officially hired.
Social insurance number is not necessary: The CAI believes that it is not necessary to ask for a candidate’s social insurance number to confirm their skills and abilities.
Reviewing candidate social media generally prohibited: The CAI recommends that employers refrain from consulting candidates’ social media profiles unless it is necessary in the specific context of the job. If necessary, employers should give preference to “strictly professional” social networks. The public or accessible nature of content posted on social networks does not exempt employers from the requirement to respect the necessity criterion.
Employers should exercise caution when drawing conclusions about a candidate based on their credit report: The CAI recommends that employers use a less intrusive means than credit checks (e.g., reference checks) to verify a candidate’s honesty and character.
Medical information collection justified in only the narrowest of circumstances: The CAI believes that even when necessary, the collection of medical information should not be systematic, intrusive, or overly broad. Any questions about health problems or functional limitations must be directly related to the essential skills or qualities required for the position. In addition, the company must ensure that the number of people with access to this medical information is limited.
Criminal history checks permitted only for certain positions: Criminal history checks are permitted, provided that there is a connection between the check and the position to be filled and that the collection of personal information is limited to what is necessary. The CAI also reminds employers that they must be able to demonstrate the legitimacy of criminal history checks. In this regard, it should be noted that an employer cannot refuse to hire a person solely on the basis that they have been convicted of a criminal offence if the offence is not related to the job or if the person has been pardoned.
Hiring
The CAI recognizes that when hiring a candidate, an employer may collect additional personal information that is necessary for the administration of the employment relationship or employment contract (e.g., residential address, emergency contact name, date of birth, social insurance number, bank information, and a photograph).
Employment agencies
According to the CAI, employment agencies must:
- identify themselves to applicants and explain how their personal information will be used;
- obtain consent from applicants if they wish to retain their personal information for secondary use;
- inform candidates of the employer’s identity as soon as possible or, if the employee does not want to be identified at the beginning of the recruitment process, send anonymized applications to the employer. Note that sending anonymized applications is not required by the Private Sector Privacy Act or the Anonymization of Personal Information Regulation.
Employment agencies are also required to be transparent with job seekers.
For more information on this topic, please contact Kirsten Thompson, Alexandra Quigley or other members of the Dentons Privacy and Cybersecurity group.
