Technology has made it easier than ever to monitor how work gets done. With the rise of hybrid and remote work, digital productivity tools, and AI‑enabled systems, workplace monitoring has become a key compliance issue for Ontario employers.
Ontario does not have a single, comprehensive statute governing employee privacy in the workplace. However, under the Employment Standards Act, 2000 (“ESA”), employers with 25 or more employees in Ontario must have a written policy on electronic monitoring in place. This requirement was introduced through Bill 88, Working for Workers Act, 2022 and continues to apply each year.
A Refresher on Who Needs a Policy and When
If you employed 25 or more employees on January 1 of any year, you must have a written electronic monitoring policy in place before March 1 of that year. This headcount includes anyone who meets the definition of “employee”, including full‑time, part‑time, casual, and seasonal employees.
Even if you do not engage in electronic monitoring at all, you still need a policy that clearly says so.
What Must the Policy Include
The ESA is focused on transparency, not prohibition. A compliant policy must state:
- Whether the employer electronically monitors employees;
- How and in what circumstances monitoring occurs;
- Why the information is collected and how it may be used; and
- the date (including day, month, and year) the policy was prepared and last updated.
Employers must also provide a copy of the policy to employees within the required timelines.
Importantly, the ESA does not create new privacy rights or give employees a right not to be monitored. Nevertheless, that does not mean employers have free rein.
What Should Employers be cautious about
Even though Ontario lacks a standalone law governing employee privacy in the workplace, privacy expectations still matter. Courts and arbitrators consistently assess whether monitoring is reasonable and proportionate, and whether it serves a legitimate business purpose.
Common risk areas include:
- Overly broad monitoring tools that capture personal use;
- Monitoring that is not clearly disclosed in the policy;
- Collecting more information than is necessary; and
- Using monitoring data for purposes not described in the policy.
In a grievance between Rideauwood Addiction and Family Services and the Ontario Public Service Employees Union, the arbitrator held that the key issue was whether the electronic monitoring policy and the monitoring it permits constituted a reasonable exercise of management rights in all of the circumstances.1
While monitoring work‑related communications may be reasonable, a policy that broadly monitors internet and network activity without distinguishing between work-related and personal use, and without adequate justification, may be found unreasonable.
Workplace policies can reduce an employee’s expectation of privacy, but they do not eliminate it entirely.
Key Takeaways for Employers
- Review your monitoring practices annually against the ESA requirements.
- Clearly distinguish between work-related and personal use in your monitoring policy.
- Avoid vague, “catch-all” language that allows unlimited monitoring.
- Make sure your policy accurately reflects what you actually monitor in practice.
- Ensure your monitoring is justified and proportionate.
- Regularly review policies to ensure they remain legally defensible and aligned with evolving laws and best practices.
A clear, carefully drafted policy can help manage risk while still giving employers the flexibility they need to operate their business.
SpringLaw drafts privacy policies that balance compliance with practical business needs. Contact us anytime.
- Ontario Public Service Employees Union v Rideauwood Addiction and Family Services, 2024 CanLII 120507, ONLA at para 22.
