Privacy in the Time of a Pandemic: Fact Sheet for Employees

October 2009

The Offices of the Privacy Commissioner of Canada, and the Offices of the Information and Privacy Commissioners of British Columbia and Alberta, have received inquiries from organizations seeking clarification about how privacy laws apply in the private sector workplace during the H1N1 pandemic. We have developed guidance to assist organizations in knowing the personal information that they can collect, use and disclose in both non-emergency and emergency pandemic situations.

The World Health Organization has declared H1N1 to be a pandemic flu. In the future, should the virus become even more widespread and severe, federal, provincial and territorial authorities in Canada may decide that it is an emergency pandemic and they may invoke special emergency measures. Privacy legislation would not prevent the sharing of information in the event that H1N1 is declared to be an emergency pandemic.

Business continuity planning: In the current non-emergency situation, privacy laws apply in the usual way and your employer should be focused on business continuity planning and communicating with you about appropriate flu-prevention measures and providing you with resources that will reduce the need to collect personal information. Your employer may wish to collect your personal email address and alternate telephone numbers. You generally need only provide this contact information if you wish to do so. If you have concerns about providing this information, you should discuss alternative arrangements with your manager. For example, you might want to suggest that you will call in to work at regular, agreed-upon intervals.

The employer should explain that the personal information collected is the minimum necessary for the purposes and that it will be used for pandemic planning purposes only. The employer should also indicate when the personal information will be destroyed. You are generally not required to provide the employer with personal information to assist in their planning; however, you may see the benefits in contributing this information to better manage a difficult situation. Your employer should clearly communicate his expectations around employees staying at home and their return to work.

If you become sick: We would generally discourage you from sharing your health status, including any diagnosis made by a physician, with your manager. Many employees will not be officially diagnosed by a physician, and will not themselves know if they have pandemic flu. In most cases, you need only say that you are sick and provide an approximate day for your return to work. However, given the ease of transmission of the pandemic flu, you may wish to volunteer information about your health status if you become ill, so that others in your workplace may be able to take additional precautions. You should know that, under private sector privacy legislation, organizations are required to establish and make available policies and procedures for the handling of personal information in their care. You should also be aware that there may be other factors such as collective agreements and pieces of legislation, such as labour law, workers’ compensation, or human rights laws, that have a bearing on the amount of information collected, used or disclosed by the employer.

An absence notice on your voice or electronic mail should not make reference to any medical condition or diagnosis. It should say that you are unavailable and you may want to provide an alternate contact in the organization. You may want to specify that you will be away for a few days or an extended period.

Your return to work: You should consult any applicable collective agreement or relevant policy. Your employer can ask you whether you have been under a doctor’s care and if there are any restrictions, including any medications you might be taking, that might prevent you from doing your job safely.

Declaration of a public health emergency: This is discussed in more detail in the guidance for organizations. If an outbreak has been declared to be a public emergency, the powers to collect, use and disclose personal information to protect the public health may be very broad. We expect that governments and public health officials will provide specific guidance on emergency procedures and restrictions in the event an emergency is declared in a severe pandemic flu situation. Your employer should communicate the specific legislative authority that has been engaged if he needs to collect, use or disclose your personal information in an emergency.

Federal
Privacy Commissioner of Canada

Provincial
Information and Privacy Commissioner of Alberta
Information and Privacy Commissioner for British Columbia

Date modified: