AI does not create a new legal right to monitor employees. What it changes is scale: continuous, automated tracking of email, chat, location, and productivity data that would once have taken a manager’s deliberate, occasional attention now happens by default. The legal layers that apply were mostly written before AI, and they are weaker, in one specific way, than most employers assume.
Key takeaways
Ontario employers that employ 25 or more employees on January 1 of any year must have a written policy on the electronic monitoring of employees in place before March 1 of that year, describing how and in what circumstances monitoring occurs and the purposes information from it may be used for. Ontario ESA, written policy on electronic monitoring The government’s own guide is unusually direct about what this does not do: “the ESA requirements: do not establish a right for employees not to be electronically monitored by their employer; do not create any new privacy rights for employees.” It adds a second, easily missed point — the ESA “does not limit the employer’s use of the information to the stated purposes” it discloses in the policy. In other words: the law requires an employer to say what it monitors and why, not to actually limit itself to that stated purpose once the information exists.
Transparency is not the whole picture. Treadstone Law’s guidance on Ontario workplace surveillance notes that “where footage captures identifiable individuals in the course of commercial activity, PIPEDA’s principles around purpose, consent, and proportionate collection can apply.” Treadstone Law, workplace video surveillance in Ontario Its companion guidance on employee privacy adds the general principle that applies just as much to monitoring software as to a camera: employees “generally have a reduced, not zero, expectation of privacy on employer-owned systems.” Treadstone Law, employee privacy in Ontario Areas with a strong expectation of privacy should never be under any form of monitoring, and the workplace-surveillance guidance flags that courts, arbitrators, and privacy regulators tend to ask a consistent question regardless of the technology: was the monitoring necessary, proportionate, and disclosed, or was it a surprise, excessive, and used in a way employees could not reasonably have expected.
AI monitoring tools do not just record; they aggregate, score, and flag continuously, in a way a human supervisor never could at the same scale. Canada’s privacy commissioners’ joint AI principles ask organizations to “consider whether the use of a generative AI system is necessary and proportionate, particularly where it may have a significant impact on individuals or groups,” adding that “the tool should be more than simply potentially useful” and that the analysis “should be evidence-based and establish that the tool is both necessary and likely to be effective.” OPC, generative AI principles An AI productivity-scoring tool that touches every employee, continuously, is a materially different proportionality question than the periodic, targeted monitoring the underlying legal principles were originally built around — even though the legal test itself has not changed.
The obligation is more procedurally specific than “have a policy.” An employer must provide an actual copy of the written policy — not just make it available on request — “to all of its employees and to all assignment employees who are assigned to perform work for that employer,” within specified timeframes, and the policy itself must be dated and updated whenever it changes. Ontario ESA, written policy on electronic monitoring The threshold count is done across all of an employer’s Ontario locations combined, not location by location — an employer with three small sites that individually employ fewer than 25 people can still be caught if the combined count reaches 25.
Even where an employer sits below Ontario’s 25-employee threshold, or operates outside Ontario entirely, the ESA’s written-policy structure — describing what is monitored, how, and for what stated purpose — is a reasonable baseline for any AI monitoring deployment, precisely because it is the same disclosure the necessity-and-proportionality principle above effectively asks for anyway. PIPEDA’s own general standard reinforces the same instinct outside Ontario’s specific rule: an organization “may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.” PIPEDA, s.5(3) Continuous, all-employee AI monitoring is exactly the kind of collection that standard is built to test.
An employer deploys an AI tool that scores employee productivity from keystrokes, email volume, and call data across a workforce of 40. Because it employs 25 or more people, Ontario’s written-policy requirement applies: it must disclose that it monitors, how, and for what purposes — but that disclosure does not, by itself, cap what it can later do with the resulting data. Separately, and regardless of the ESA threshold, PIPEDA-style reasonableness principles ask whether continuous, all-employee scoring is actually necessary and proportionate to whatever business purpose is claimed, or whether a narrower, targeted approach would serve the same purpose with less collection. An employer that has satisfied the first question can still fail the second.
Related: AI and employee privacy at work, AI in performance reviews: what applies, and what a workplace AI policy should cover.
Ontario’s electronic-monitoring rule does not require consent — only disclosure, for employers above the 25-employee threshold. Underneath that, general privacy and reasonableness principles still constrain what monitoring is defensible, consent or not.
Largely, under Ontario’s ESA specifically — the government’s own guide confirms the Act does not limit an employer’s use of monitoring information to the purposes stated in its policy. Other legal principles around reasonableness and proportionality can still constrain a genuinely unrelated use.
Not fundamentally. Both are assessed under the same underlying questions — was it necessary, proportionate, and disclosed — even though the specific rules referenced (the ESA’s electronic-monitoring policy duty, PIPEDA’s purpose and proportionality principles) apply to both in the same way.
A short call is enough to check the policy and proportionality questions before staff notice the tool is there.
