Disclosure of Personal Information During COVID-19
All employers in Ontario are subject to numerous privacy laws that regulate the collection, use, and disclosure of employee personal information. In the natural course of business, an employer collects employees’ medical information for a variety of purposes, including; administration of leaves of absence, accommodation of disability, administration of benefits, and ensuring the safety of the employees and the workplace in general.
During a public health emergency such as COVID-19, private information can be shared by employers for two distinct purposes: (1) to inform and protect individuals who may have come in contact with the affected individual, and (2) to inform public health authorities to aid in the containment and tracking of COVID-19. Rightfully, there are many concerns over the disclosure of necessary private medical information. The following outlines to what extent your employer may share your personal information with the intention of limiting the spread of COVID-19.
Can an employer request COVID-19 related medical information from their employee?
Yes. Employers who collect medical information for the purposes of tracking and limiting the spread of COVID-19 must do so judiciously. An employer must make reasonable efforts to limit disclose of personal information that may help to identify the individual who has tested positive for COVID-19. The employer must only provide sufficient details to allow the potentially exposed individuals to ascertain the date(s) of their potential exposure, and the extent and circumstances of their potential expose.
Does an employer need an employee’s consent to collect personal medication information related to COVID-19?
No. Since COVID-19 was declared a public health emergency, employers have the right to share an employee’s personal medical information without their consent with any individual who may have been exposed to COVID-19, as well as with appropriate public health authorities.
Does the employer have to notify its workforce if one of their employees develops COVID-19?
Yes. An employer has a positive obligation to notify its employees of a credible risk to their health and safety. If an employee tests positive for COVID-19, there is a risk of transmission to all other individuals who were working in close contact with that individual. Consequently, once it has come to an employer’s attention that one of their employees has tested positive for COVID-19, the employer is obligated to collect only the information necessary to fulfil its notification and reporting obligations under the law.
Employers must also be cautious of employees exhibiting symptoms of COVID-19, employees who have been exposed to individuals who have tested positive for COVID-19, and employees who have recently traveled outside of Canada. In an effort to safeguard its workforce, an employer can prohibit an employee from coming into work while awaiting confirmation that they no longer pose an imminent health risk.
An employer should avoid discriminatory claims by sending an employee home because of their belief that their race, place of origin, or other personal characteristics makes them more likely to present a risk of infection. This could result in a discriminatory claim under human rights legislation.
What should employers do when notifying other employees or customers that they may have been exposed to COVID-19?
In the event that an employer collects personal information from an employee relating to COVID-19, Canadian privacy law requires the employer to explain to the employee the purpose and future use of the collected private information. When the medical information is used, it must be done while limiting the collection of essential personal information. Even during COVID-19, employers have an obligation to protect personal information with adequate security measures, and properly protect documents concerning any disclosure of personal information.
We gratefully acknowledge the contribution of Yasmine Atif, Articling Student, in writing this blog post. If you would like further information on this topic, please contact Nigel McKechnie. Nigel can be reached at 613-369-0382 or at email@example.com.