Privacy legislation and payroll

While PIPEDA doesn’t generally apply to employee data, there are things that employers who outsource things like payroll and benefits administration should know

Jan. 1, 2004, marks the final phase in the implementation of the federal Personal Information Protection and Electronic Documents Act (PIPEDA). What impact will this have on employers? Probably less impact than many have been led to believe.

PIPEDA has applied to employers who are federally regulated since Jan. 1, 2001. If your employees are subject to the Canada Labour Code, then PIPEDA already applies to their employee personal information. This includes employers in any of the following industries: television and radio broadcasting, banking, airports, airlines, all forms of maritime transportation and any form of transportation or communications, such as trucking, railways and pipelines, that cross provincial boundaries.

This also includes federally regulated employees who work in the province of Québec. For example, the personal information of an employee who works for one of the chartered banks in Laval is subject to regulation by PIPEDA, not the equivalent Quebec legislation.

Conversely, the Office of the Privacy Commissioner has indicated that PIPEDA will not apply to provincially regulated employers in Quebec after Jan. 1, 2004, since Quebec privacy legislation is seen as broadly equivalent to PIPEDA.

For all other provincially regulated employers, PIPEDA applies to personal information that an organization “collects, uses or discloses in the course of commercial activities.”

Does this include employment related personal information? No. The Office of the Privacy Commissioner of Canada has confirmed that “commercial activities” do not include employment. In other words, PIPEDA does not apply to employee personal information collected, used or disclosed by a provincially regulated employer.

Suppose a chain of retail electronics stores tracks customer purchases for marketing purposes, including the operation of a loyalty program. As of Jan. 1, 2004, PIPEDA applies to the customer purchase information gathered by the retail chain, since the chain is regulated by each province in which it operates. However, personal information for the chain's employees is not governed by PIPEDA, either before or after Jan. 1, 2004.

Does this mean that PIPEDA can never apply to employee personal information collected, used or disclosed by a provincially regulated organization? Actually, no. There is one common situation in which PIPEDA would apply to employee personal information in provincially regulated organizations.

Employee personal information is used “in the course of commercial activities” by third-party payroll, pension, benefit or savings plan administrators involved in outsourcing employee administration.

In the retail chain example above, the personal information subject to PIPEDA was customer purchase history. For a third-party administrator, the personal information collected, used or disclosed in the course of commercial activities is the employment-related information of the third party's clients.

Again, just like the retail chain example above, personal information of the third-party administrator's own employees is not subject to PIPEDA where the third party is provincially regulated.

Note the phrase “commercial activities” does not apply where the third party is a non-profit organization. Many pension plans for provincial or municipal employees are administered by a multi-employer, non-profit organization, such as the Ontario Municipal Employees Retirement System. In this situation, PIPEDA would not apply to plan member personal information, since the pension administration services provided are not “commercial activities.”

How does Jan. 1, 2004, affect a for-profit, provincially regulated third-party administrator? Where client employee personal information is collected, used or disclosed by a for-profit, third-party administrator, all within a single province, then PIPEDA will apply as of Jan. 1, 2004. Where the three activities of collection, use or disclosure cross provincial boundaries, then PIPEDA has applied since January 2001.

For example, a for-profit payroll service bureau initially collects client employee personal information in Vancouver, but processes payroll in Edmonton. In this situation, PIPEDA has applied to the payroll service bureau since January 1, 2001.

How does the application of PIPEDA to third-party administrators affect their client employers?

Provincially regulated employers, who would not otherwise fall under PIPEDA for employee personal information, become subject to its provisions, to the extent that employee administration is outsourced.

For example, an employer has a third party administer its defined benefit pension plan. In order to administer the pension, the employer must provide the third-party administrator with employee personal information such as name, address, social insurance numbers and pensionable earnings.

The employer is subject to PIPEDA for all of this personal information, if the 3rd party administrator is a for-profit organization. However, any other employee personal information maintained by the employer and not shared or exchanged with a third party would not be protected by the privacy provisions of PIPEDA.

To summarize, employment-related personal information is subject to the privacy provisions of PIPEDA, if one of the following applies:

•the employer is federally regulated, including employers in Quebec; or

•employee administration is outsourced to a for-profit third-party payroll, pension, benefit or savings plan administrator.

Whether or not PIPEDA applies to a particular employer or to particular employee personal information, I think you will find that most payroll professionals take their responsibilities towards privacy very seriously, particularly given the publicity that this issue has had over the last several years.

Alan McEwen is a payroll consultant with 15 years experience. He can be reached at [email protected].

To read the full story, login below.

Not a subscriber?

Start your subscription today!