An AI scheduling tool, an HR chatbot, or a productivity dashboard all quietly accumulate personal information about employees that no one filed a form to collect. Before asking whether that is a problem, it is worth establishing which law actually governs it — because for most Canadian employers, the answer is not the one they assume.
Key takeaways
Treadstone Law’s guidance on Ontario employee privacy states the gap plainly: “Ontario has no general private-sector privacy statute of its own. PIPEDA, the federal privacy law, fills that gap for most commercial activity — but PIPEDA’s specific employee-information provisions apply fully only to federally regulated employers, such as banks, airlines, and telecommunications companies. For most Ontario businesses, which are provincially regulated, employee records used strictly for employment purposes fall into a genuine legal gap.” Treadstone Law, employee privacy in Ontario That gap does not disappear because an AI tool is involved — if anything, it becomes more consequential, because an AI tool tends to concentrate and retain far more employee data than any single manager ever did manually.
An AI scheduling tool, a performance dashboard, or an HR chatbot pulls together data that used to sit in separate, largely unreviewed places — timesheets, emails, call logs, chat messages — into one system that can be queried and cross-referenced instantly. Canada’s privacy commissioners’ joint AI principles ask that any such use be necessary and proportionate: “the tool should be more than simply potentially useful. This consideration should be evidence-based and establish that the tool is both necessary and likely to be effective in achieving the specified purpose.” OPC, generative AI principles That test applies whether or not a dedicated employee-privacy statute exists, because it comes from guidance about the AI tool itself, not from employment law.
Québec is the clearest exception to the general Canadian gap. Its privacy regulator, the CAI, requires that where a decision about a person is based exclusively on automated processing, the organization must inform the person, at the latest when it informs them of the decision, and must give them the opportunity to have that decision reviewed by a staff member able to revisit it. CAI, automated decisions in Québec Alberta’s Office of the Information and Privacy Commissioner has published its own dedicated AI resource index, including guidance for small custodians on AI use Alberta OIPC, AI resources — a live, provincial regulatory posture on AI that most other provinces have not yet matched. Neither of these is PIPEDA, and neither is interchangeable with the other; an employer operating across provinces cannot rely on satisfying one to satisfy the rest.
Alberta and British Columbia go further than either of those two examples: each also has its own private-sector statute — a Personal Information Protection Act in each province — that defines and separately regulates “personal employee information,” something PIPEDA does not do at all. Alberta’s Act lets an employer collect that information without consent only where the collection is solely to establish, manage or end an employment relationship, is reasonable for that purpose, and, for a current employee, is preceded by reasonable notice of the collection and why. Personal Information Protection Act (Alberta), s.15 British Columbia’s equivalent provision is narrower still: an employer may not collect employee personal information without consent unless the collection is reasonable for establishing, managing or terminating the employment relationship, and the employer has notified the individual that the collection is happening and why. Personal Information Protection Act (BC), s.13
Even inside the statutory gap, Treadstone Law’s guidance sets out categories most Ontario employers can generally collect: “information reasonably needed to administer the employment relationship: contact details, banking information for payroll, emergency contacts, and information needed to comply with statutory obligations,” and “information relevant to performance and conduct, collected and used for a legitimate business purpose.” Treadstone Law, employee privacy in Ontario It also flags where employers need to be more careful — background and credit checks tied to a genuine job requirement, and “medical and disability information,” which should be “limited to what is genuinely needed to manage an accommodation.” An AI tool that pulls indiscriminately from email, chat, and file systems does not automatically respect these category lines the way a manager manually gathering the same information for a specific purpose would — it is easy for an AI-fed system to absorb health information or performance commentary that was never meant to leave the narrow purpose it was collected for.
Treadstone Law’s guidance is clear that the statutory gap is not a free pass: “general legal principles, employment contracts, human rights law, and — for unionized workplaces — arbitral standards still shape what is reasonable,” and that employers can generally collect “information reasonably needed to administer the employment relationship,” while employees “generally have a reduced, not zero, expectation of privacy on employer-owned systems.” Treadstone Law, employee privacy in Ontario An AI tool that collects far beyond what its stated purpose requires is exposed on exactly this reasonableness test, statutory gap or not.
A hybrid employer deploys an AI scheduling and productivity tool that logs application usage, message volume, and location data across its workforce. If the employer is federally regulated, PIPEDA’s employee-information provisions apply directly to that data. If it is a typical provincially regulated Ontario business, the same data sits in the statutory gap Treadstone Law describes — governed by reasonableness, the employment contract, and human rights law rather than a dedicated privacy statute. If the employer operates in Québec, it additionally has to consider whether any output of the tool amounts to an exclusively automated decision about an employee, which would trigger the CAI’s notice-and-review requirement regardless of which of the other regimes also applies.
Related: can employers monitor staff with AI, AI in performance reviews: what applies, and what happens to data you paste into AI.
Only fully if your employer is federally regulated — a bank, airline, telecommunications company, or similar. Most provincially regulated employers fall outside PIPEDA’s specific employee-information provisions for records used strictly for employment purposes, though general legal principles and human rights law still apply.
Québec has a more concrete, AI-specific rule for exclusively automated decisions — a notice-and-review right — that Ontario does not have as a dedicated statute. Ontario relies instead on general legal principles, employment contracts, and human rights law.
Yes. It determines whether PIPEDA’s employee-information provisions apply directly, or whether your employer instead sits in the statutory gap that provincial employers occupy for employment-purpose records.
A short call is enough to map which rules apply where your business and your employees actually sit.
