A number of news stories have reported employers asking for Facebook passwords from job applicants. Is this legal in Canada?
In a social media environment, reputations circulate not only within the business community, but also within the virtual community. Employers clearly appreciate the importance of maintaining a professional appearance to the public. Employees in turn face increasing pressure to exercise caution when posting personal information, photographs, and opinions on services such as Facebook and Twitter.
Employers justify asking for passwords by claiming they need to screen the service for undesirable content that may reflect poorly on their business. Under both privacy and human rights legislation, Saskatchewan employers risk legal action by following this practice.
In Saskatchewan, an employer’s responsibility to an employee begins during the application process. One such obligation is a duty of privacy regarding the personal information collected and used by employers. Under The Personal Information Protection and Electronic Documents Act (PIPEDA), information collected by organizations from applicants can only be gathered for the specific purpose of employment, and must also be reasonable within the circumstances. In other words, one should not collect information only because it is “nice to have.”
By collecting the Facebook password of an applicant, the employer would have access to a wide range of information irrelevant to the position sought. This includes anything from private messages between the prospective employee and other users to political or religious affiliations to ethnic origins. Employers could also have access to profiles of other users that they may not have otherwise been able to see. This broad access would probably be viewed as unreasonable to request from an employee.
Some argue that if an applicant is unwilling to release their Facebook password to his or her future employer, the employee can always remove themselves from employment consideration. Yes, consent to the collection of personal information is a common defence to allegations of privacy infringement. Yet the law is in place for the protection of individuals from organizations, due to the inherent power imbalance between employer and employee. Regardless of consent, employers must still only collect the minimum information they require for their purpose, and only what is reasonable in the circumstances.
PIPEDA breaches can generate a complaint to the Privacy Commission of Canada. Even if the complaint is unsuccessful, the employer will incur legal costs and risk negative media attention of the potential privacy breach.
Employers must also comply with human rights laws during the application process. The Saskatchewan Human Rights Code prohibits employers from discrimination on prohibited grounds. If they refuse to employ individuals on the basis of certain characteristics listed in the Code, employers violate the legislation. Some of these characteristics include religion, nationality, marital status, sex, sexual orientation, disability or age, many of which are readily apparent in a Facebook profile.
In practice, this means employers cannot seek information related to these characteristics, either directly or indirectly, during the interview process. While the reason for choosing not to hire the applicant may be legitimate, there still could be an inference that a prohibited ground impacted the employer’s decision as a result of the inappropriate request. Similarly, Facebook profile access could suggest the employer made its decision in a discriminatory manna By demanding Facebook access, an employer could be faced with an expensive and embarrassing complaint to the Saskatchewan Human Rights Commission, even if there was no intent to use prohibited information.
To avoid potential claims by prospective employees for privacy breaches under PIPEDA or discrimination under the Saskatchewan Human Rights Code, employers should not seek Facebook passwords from their applicants. This does not mean employers cannot still delve into the online community to gather as much information as possible about their potential employees. Employers are entitled to seek out information on the Internet, or through other means, so long as it has been made readily accessible to the public at large. By following these guidelines employers can ensure that they are maintaining a balance between protecting the rights granted to applicants and safeguarding the reputation of their business within the community.