Workplace Surveillance and Employee Monitoring in Canada

Whether a Canadian employer can watch, track, or read what an employee does at work depends on where that employee works and who employs them, since Canada has no single national workplace privacy law and PIPEDA, Alberta and BC's PIPA statutes, Quebec's Law 25, and Ontario's narrower disclosure law each cover a different piece of the same problem.

This article covers which privacy law applies to workplace monitoring depending on province and employer type, the reasonableness test used to judge video surveillance, GPS tracking, and computer monitoring, Ontario's electronic monitoring policy requirement under the Working for Workers Act, and the separate rule that lets an employee lawfully record their own workplace conversations. It does not cover unionized grievance procedure beyond the arbitral reasonableness test, or federal public servants covered by the Privacy Act rather than PIPEDA.

Is Workplace Monitoring Legal in Canada?

Yes, employers can monitor employees in Canada, but how much depends on which law applies. Canada has no single federal statute that regulates workplace surveillance across every province and every employer. Coverage instead comes from a patchwork: the federal PIPEDA, two provincial private-sector statutes that expressly name employees, Quebec's much stronger regime, and, across most of the rest of the country, no dedicated private-sector privacy statute for employees at all.

That does not mean monitoring is unregulated everywhere else. Arbitrators, courts, and the Office of the Privacy Commissioner of Canada (OPC) have built a substantial body of case law applying a consistent reasonableness test to workplace surveillance, described below, even where no statute directly covers the employer.

Which Privacy Law Applies to Your Job

The starting question is always the same: is the employer federally regulated, and if not, which province is it in.

Where no statute names employees, the gap is filled by the common law tort of intrusion upon seclusion, arbitral jurisprudence in unionized workplaces, and, for federally regulated employers only, PIPEDA's ordinary rules where they apply.

Federally Regulated Employers: PIPEDA

PIPEDA (the Personal Information Protection and Electronic Documents Act, SC 2000, c 5) is built around commercial activity generally, but s 4(1)(b) extends it specifically to the personal information of employees of a federal work, undertaking, or business, meaning banks, airlines, railways, telecommunications carriers, and similar federally regulated employers. For these employers, monitoring an employee's email, computer use, location, or on-camera activity engages PIPEDA directly, including the requirement that any collection, use, or disclosure be for a purpose a reasonable person would consider appropriate in the circumstances, under s 5(3).

Provincially regulated employers, meaning most Canadian workplaces, are not covered by PIPEDA for employee information at all. PIPEDA's employee-information provisions only reach federal works and undertakings; a retailer, restaurant, or law firm regulated by a province is outside PIPEDA's employee-information reach even though the same employer's customer data may still fall under PIPEDA as ordinary commercial activity.

Alberta and British Columbia: PIPA Covers Employees Directly

Alberta and British Columbia are the only two provinces whose general private-sector privacy statute expressly regulates employee personal information as its own category, separate from customer or commercial data. Both the Alberta Personal Information Protection Act and the British Columbia Personal Information Protection Act let an employer collect, use, and disclose an employee's personal information without consent where it is reasonable for the purposes of establishing, managing, or terminating the employment relationship, provided the employer gives reasonable notice.

That notice requirement is the practical safeguard: an employer that wants to rely on the employment-relationship exception, rather than obtaining individual consent, generally has to tell employees what it collects and why. The Alberta and BC Information and Privacy Commissioners have each issued guidance applying this framework to video surveillance, GPS tracking, and computer monitoring specifically, generally through the same reasonableness lens described further below.

Quebec: Law 25 and the Civil Code

Quebec runs the strictest privacy regime for employees in Canada, and it does not come from a single statute. Articles 35 and 36 of the Civil Code of Quebec already give every person, including every employee, a general right to respect for private life, and specifically list surveillance and use of a person's image or voice among the acts that can violate that right without consent.

Law 25 (the modernized Act respecting the protection of personal information in the private sector, formerly Bill 64) layered a full statutory regime on top of that, phased in between September 2022 and September 2024: a mandatory privacy officer and incident register, breach notification, stronger consent and transparency rules, privacy impact assessments, biometric disclosure requirements, and, as of September 22, 2024, a data portability right. Quebec's Commission d'acces a l'information (CAI) enforces Law 25 with administrative monetary penalties that are meaningfully larger than anything available to the federal OPC, plus a private right of action, which makes Quebec employers the most exposed in the country for unjustified monitoring.

Ontario and Most Other Provinces: No General Statute, But Not a Free-for-All

Ontario, like New Brunswick, Nova Scotia, Prince Edward Island, Newfoundland and Labrador, Saskatchewan, and Manitoba, has no general private-sector statute giving employees a right against employer monitoring. PIPEDA does not fill that gap either, since these are provincially regulated employers whose employee information falls outside PIPEDA's federal-works limitation.

That does not leave employees in these provinces unprotected. The Ontario Court of Appeal recognized the tort of intrusion upon seclusion in Jones v Tsige, 2012 ONCA 32, which allows a claim where someone intentionally intrudes on another's private affairs in a manner a reasonable person would regard as highly offensive. In unionized workplaces, arbitrators apply the same reasonableness test described below to decide whether monitoring evidence can even be used, regardless of whether any privacy statute applies.

Ontario's Working for Workers Act: A Disclosure Duty, Not a Ban

Ontario's Working for Workers Act, 2022 added s 41.1.1 to the Employment Standards Act, 2000, requiring an employer with 25 or more employees in Ontario on January 1 of a year to have a written policy on electronic monitoring of employees in place by March 1 of that year, and to give every employee a copy within 30 days after that deadline. The policy must describe whether the employer electronically monitors employees, and if so, how and in what circumstances, and the purposes for which information obtained through monitoring may be used.

It is important not to overstate what this law does. It is a transparency requirement, not a restriction on monitoring itself. An Ontario employer that discloses extensive monitoring in its policy has fully complied; the Act does not limit what can be monitored, does not require employee consent, and creates no new right to challenge the monitoring described. It simply means a covered Ontario employee is entitled to know, in writing, that monitoring is happening and roughly how.

The Reasonableness Test Used Across Canada

Whether a statute applies or not, Canadian arbitrators, courts, and privacy regulators converge on the same basic question when judging workplace surveillance: was it reasonable. The Federal Court applied a four-part version of this test, drawn from labour arbitration jurisprudence, in Eastmond v Canadian Pacific Railway, 2004 FC 852, when it upheld a federally regulated railway's video surveillance of a rail yard as a use a reasonable person would consider appropriate under PIPEDA s 5(3):

1. Is the measure demonstrably necessary to meet a specific, legitimate business need.
2. Is it likely to be effective in meeting that need.
3. Is the loss of privacy proportional to the benefit gained.
4. Is there a less privacy-invasive way of achieving the same end.

The OPC applies the same four factors in its own guidance to employers outside litigation, and Alberta and BC's Information and Privacy Commissioners, along with labour arbitrators across the country, apply a materially identical test to grievances over surveillance evidence. In practice, monitoring aimed at a specific, documented problem, such as repeated inventory loss at one location, tends to survive; blanket, continuous, or covert monitoring with no defined trigger tends not to.

Video Surveillance in the Workplace

Camera surveillance of common work areas, entrances, and cash-handling points is routinely found reasonable where it is overt, aimed at a legitimate security or loss-prevention purpose, and does not extend into spaces where employees have a heightened expectation of privacy, such as washrooms, changerooms, or a closed-door office used for private conversations. Continuous, unfocused surveillance of a single employee's workstation, with no triggering incident, is much harder to justify under the same test.

Covert video surveillance faces the highest bar. Regulators and arbitrators generally expect an employer to have already tried less invasive measures, and to have a specific, reasonable suspicion, before resorting to hidden cameras targeting a particular individual, rather than deploying it as a first response to a general concern.

GPS Tracking in Company Vehicles

GPS and telematics tracking of company vehicles is assessed under the same reasonableness framework. A legitimate business need, such as routing, fuel efficiency, maintenance scheduling, or client billing for time on site, tends to support GPS tracking of a vehicle during working hours. Tracking that continues after hours, or that is used to build a profile of an employee's off-duty movements rather than the vehicle's business use, is much harder to justify and has drawn adverse findings from provincial and federal privacy regulators.

Employers relying on the employment-relationship exception in Alberta or BC's PIPA, or on PIPEDA's reasonable-purpose test federally, should also give notice that vehicles are tracked and describe what the data is used for, mirroring the same notice obligation that applies to other forms of monitoring under those statutes.

Computer, Email, and Internet Monitoring

Employers can generally monitor use of company-owned computers, networks, and email accounts, particularly where a policy makes clear that these systems are for business use and may be monitored. The reasonableness test still applies: broad, suspicionless review of every employee's personal correspondence is harder to justify than targeted monitoring tied to a specific security incident, data-loss concern, or policy violation.

Ontario's electronic monitoring policy requirement, described above, is aimed squarely at this kind of monitoring: a covered Ontario employer's policy needs to say, in plain terms, whether it monitors computer and email use and what it does with the results. Elsewhere, that disclosure is not legally required outside Alberta, BC, and Quebec, though a written policy remains the strongest evidence an employer can point to if monitoring is later challenged.

Can You Record Your Own Workplace Conversation?

Separately from all of the above, an employee who secretly records a conversation they are personally part of, such as a performance review or a meeting with a manager, is not committing a criminal offence anywhere in Canada. Criminal Code s 184(1) makes it an offence to wilfully intercept a private communication, but s 184(2)(a) exempts a person who is a party to the communication, which is why Canada is described as a one-party consent country for recording generally, a rule covered in more depth on this site's Canada recording laws overview.

Being lawful is not the same as being safe from consequences. Secretly recording coworkers or a manager can still be a valid ground for discipline or dismissal, particularly where it breaches a clear workplace policy or damages the trust the employment relationship depends on, and a privacy statute in Quebec, Alberta, or BC can still restrict what an employee does with a recording afterward, such as sharing it, even though making it was lawful in the first place. For a closer look at that overlap, see recording conversations at work in Canada.

Disclaimer: This article provides general legal information about workplace surveillance and employee monitoring in Canada. It does not constitute legal advice and does not account for individual circumstances. For advice about a specific workplace situation, consult a lawyer licensed in the relevant province.

Related reading: Alberta and BC's PIPA laws covers the provincial employee-information rules in more depth, workplace privacy and monitoring in Canada covers this topic from the employment-law side, and the Canada employment law hub links to related employee-rights topics.