Privacy Alert: New Guidelines for the Workplace
The Commission d’accès à l’information du Québec (CAI) provided guidance on the type of personal information employers can and cannot collect at different stages of recruitment, taking into consideration the necessity and proportionality principles:
Recruitment:
Employers cannot collect any information they wish during recruitment, even with candidate consent.
Recruiters must ask, "Is it necessary at this stage to collect such information to evaluate an application for this position?"
The following is acceptable information to collect: first and last name, phone number, email address, academic career details, professional achievements, skills, and interests. Notice postal address is not there.
If you have standard forms for candidates to fill out, avoid collecting excessive information and consider having different forms for different positions, as each position may require unique information.
Do not request references before the interview.
All these points apply whether you are a company recruiting directly or if you are using a third-party agency.
Interview:
You may verify a candidate’s identity with ID, but you may not make a copy or store that information.
Do not ask about age, gender, religion, ethnic origin, marital status, pregnancy, sexual orientation, etc., unless it is essential for the position.
Psychometric tests must be scientifically valid and job-related. If it is not, then don’t use it. Employers are responsible for protecting this information.
Artificial Intelligence:
Inform candidates if AI is used to sort applications or assess candidates.
Ensure personnel using AI are well-trained and are aware of its limitations.
Provide candidates with the opportunity to review the AI-based decisions.
Conduct a Privacy Impact Assessment (PIA) before using AI.
Do not use AI to assess emotional or psychological states during video interviews.
Background Check:
Criminal background checks must be related to specific job requirements and require explicit consent.
Do not keep copies of criminal records if the offence is unrelated to the employment.
Hiring:
At this point of the hiring process, you can collect more information that is necessary, such as date of birth, social insurance numbers, address, bank information and a photo, so long as you need it to provide benefits, pay the employee, and any other employment-related activity.
Don't forget to delete or anonymize the data of unsuccessful candidates when you no longer need the information or as per other laws that specify how long to retain that information.