Payroll & Privacy: Is Disclosing Employee Payroll Information a Privacy Violation?
A nurse applying for salary replacement under a provincial program fills out a government form listing her name, title, salary and information about her recent suspension. She then hands the form to the payroll manager for approval. The payroll manager signs the form and hands it to a co-worker to deliver to the nurse. The payroll manager claims he put the form in an unsealed envelope but the nurse says the form was not in an envelope and the Commissioner believes the nurse. The payroll manager also says the nurse was standing right outside the office and within his sight the whole time. But the nurse contends that she received the form in her office down the hallway. Again, the Commissioner believes the nurse.
Did the payroll manager violate the nurse’s payroll information privacy?
- No, because the form didn’t contain protected personal information
- Yes, because it disclosed her personal information without consent
- No, because handing the form to a co-worker wasn’t disclosure
- No, because the disclosure was authorized for payroll administration
- Handing the unsealed form containing private information to the co-worker was a violation of the nurse’s privacy.
Employers subject to Alberta, BC, Federal and Québec privacy law aren’t allowed to disclose protected personal information, including payroll information about employees unless:
- The employee properly consents to the disclosure; or
- The disclosure, although not consented to, is authorized for the purpose of administration or personnel management.
This scenario, which is based on an Alberta case, [ORDER F2016-62, 2016 CanLII 91846 (AB OIPC), Dec. 12, 2016] illustrates how these rules play out in real-life situations, specifically with regard to:
- What employee information is protected;
- What constitutes a disclosure; and
- The scope of the personnel management authorization.
WHY WRONG ANSWERS ARE WRONG
A is wrong because the privacy laws protect recorded information about an “identifiable” individual and the information listed in the application form the nurse gave the payroll manager, including her name, title, salary and facts about her recent suspension, are all forms of identifiable information.
C is wrong because the payroll manager disclosed the information by handing it to the co-worker. The form was unsealed and the co-worker could have read it before delivering it to the nurse—even if it’s unclear whether he actually did so.
D is wrong because authorization to disclose for personnel management covers only disclosures that are “necessary” to carry out the purpose. Processing the nurse’s paperwork was part of the payroll manager’s personnel duties. But, the Commissioner said, the payroll manager could and should have carried out that function without disclosing the nurse’s personal information to the co-worker.