Employers, use care when disclosing workers’ information during public health crises: expert

By Terry Davidson

Law360 Canada (March 30, 2020, 9:21 AM EDT) -- Employers can share employees’ health information without consent during a public health emergency but must limit it to only what is necessary in the situation and verify the authenticity of any public authorities requesting such disclosure, says a privacy lawyer.

These were just two of a handful of business-related issues discussed during a March 25 webinar by Borden Lander Gervais (BLG), where questions were addressed on how Canadian businesses still open and operational during the COVID-19 pandemic should conduct themselves in the face of a health crisis.

Éloïse Gratton, BLG

Éloïse Gratton, national co-leader of BLG’s cybersecurity and data protection practice group, talked of employee consent not being required when it comes to the sharing of their information during a health emergency such as this.

There are two types of sharing in this context, Gratton said.

One is the sharing of information within an organization as a way of protecting other employees.

“Businesses across Canada can generally disclose personal information without employee consent when it is necessary to respond to an emergency that would threaten someone’s life or someone’s health or security,” Gratton told those in attendance. “There are some exceptions. For instance, Quebec doesn’t have that consent exception, but elsewhere, [businesses] do have that consent exception. Also, given that employers are subject to occupational health and safety laws, generally they are required to take reasonable measures to provide a safe work environment. I think this means that they could probably be justified to disclose personal information about an employee affected by COVID-19, to the extent that the sharing would be necessary to provide a safe work environment. When we are relying on these consent exceptions, the employee concerned must be notified before the disclosure.”

The second type is when public health officials request such information.

“A business that receives a request from a public health authority to disclose specific information about an employee will usually benefit from a consent exception. Again, it depends on jurisdiction but, generally speaking, that is the case. Upon receiving the request, the authority on which the request for disclosure is based should be verified, so businesses should not necessarily be taking these requests at face value. They must ensure that any disclosure is justified by law, [and that] it’s limited to what is necessary to achieve the goal behind the disclosure — protecting citizens against a health crisis. … It probably also makes sense for businesses to implement written policies and procedures concerning the management of personal information related to COVID-19 and make them available to relevant stakeholders [such as employees and clients].”

Gratton was asked if businesses are able to request that employees provide their health information as a way of assessing risk to others in the workplace.

“The short answer is it depends. Currently, given the fact that the pandemic has been declared a public health emergency in a number of [jurisdictions], and that employers are generally required to preserve the health and safety of their employees, they may be justified in collecting some type of information related to an employee’s exposure to COVID-19. This may include requiring them to disclose whether they have recently travelled to an affected region, been in contact with a person that has contracted the virus or been diagnosed with the virus. However, given that personal health information is usually considered sensitive, employers ought to exercise caution and limit their collection to what is necessary.”

Organizations may want employees to be periodically tested during a health crisis, she said. For example, in this case, they may want to conduct temperature checks.  

But before doing this, Gratton said, they should take into account the reliability of the testing, as well as weigh the benefits of testing against any impact it may have on employee privacy. They should also consider any alternatives less intrusive.  

Gratton said Canadian privacy laws dictate that businesses must collect and use such personal information for “purposes that are reasonable and legitimate in the circumstances,” and that reasonableness should be evaluated on a case-by-case basis.

Other topics discussed included lessons learned from the SARS outbreak of 2003, navigating temporary layoffs during the COVID-19 outbreak and the application of force majeure contract provisions in a time of crisis.

If you have any information, story ideas or news tips for The Lawyer’s Daily, please contact Terry Davidson at t.davidson@lexisnexis.ca or call 905-415-5899.