The HR folder no federal privacy statute covered

The situation

A national home-goods retailer had a standard data-room privacy diligence protocol, refined over a dozen prior acquisitions, that treated every target’s customer and employee records the same way: confirm PIPEDA-compliant consent language, confirm a business-transaction agreement satisfying s.7.2 for anything moving pre-closing, and flag gaps. It applied that protocol without modification to an Ontario-only chain of eleven home-goods stores it was acquiring by share purchase.

The buyer’s diligence team flagged the target’s employee records — personnel files, payroll history, performance reviews for roughly 180 staff — as a PIPEDA compliance gap, because the target had no documented consent-basis analysis for its HR data of the kind the checklist expected to see.

The problem

The checklist was diligencing the target against a statute that had never applied to its employee records in the first place. PIPEDA does not reach every organization’s employee information as a matter of course — it reaches employee information only for a narrow category of employer, and this target was not in that category.

The numbers

180 employee files, none of which had ever been assessed against PIPEDA, because none needed to be. The buyer’s legal spend on the (misdirected) PIPEDA gap analysis for the HR folder ran to roughly $14,000 before someone asked the more basic jurisdictional question — a cost that bought no useful information, because the analysis was aimed at the wrong statute.

The rule that decided it

Read the unit. PIPEDA’s application clause draws a sharp line between the two kinds of personal information a business handles, and the line matters most for employee data. Section 4(1) states: “This Part applies to every organization in respect of personal information that (a) the organization collects, uses or discloses in the course of commercial activities; or (b) is about an employee of, or an applicant for employment with, the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business.”

Paragraph (a) is what the buyer’s standard checklist was really built around, and it works for customer records because handling a customer’s data is, definitionally, part of commercial activity. It does not extend to employee records at all — that extension is paragraph (b), and paragraph (b) is conditional on the employer itself being “a federal work, undertaking or business”: interprovincial transportation, telecommunications, banking and a handful of other federally-regulated sectors. An Ontario home-goods retailer with no interprovincial operations is not one.

The consequence is not that some other federal statute quietly steps in. Ontario has no general private-sector employee-privacy statute — unlike Alberta’s Personal Information Protection Act, British Columbia’s statute of the same name, and Quebec’s Act respecting the protection of personal information in the private sector, each of which applies to employee records within that province regardless of the employer’s industry. For this Ontario target, the HR folder sat outside PIPEDA and outside any provincial equivalent, because Ontario has not enacted one for the general private sector.

Section 26(2)(b) explains why the provincial statutes exist alongside PIPEDA at all rather than being pre-empted by it: the Governor in Council may, by order, “if satisfied that legislation of a province that is substantially similar to this Part applies to an organization, a class of organizations, an activity or a class of activities, exempt the organization, activity or class from the application of this Part in respect of the collection, use or disclosure of personal information that occurs within that province”. Alberta, BC and Quebec have each had substantially-similar legislation declared under that mechanism, which is precisely why their statutes fill the employee-privacy gap that PIPEDA s.4(1)(b) otherwise leaves open — and precisely why Ontario, having enacted no general private-sector statute of its own, has no equivalent gap-filler for a target like this one.

The outcome

The buyer redirected its diligence spend: the customer folder stayed a PIPEDA analysis, correctly, because retail customer data is handled in the course of commercial activity under s.4(1)(a). The employee folder was assessed instead against the ordinary common-law and employment-law obligations that do apply regardless of a specific privacy statute — confidentiality terms in employment agreements, PIPEDA’s inapplicability noted rather than treated as a compliance gap to be closed.

What it would have cost otherwise

Had the buyer closed the (nonexistent) PIPEDA gap on the HR folder by imposing PIPEDA-style consent mechanics the target was never required to have, it would have spent money and diligence time solving a problem that did not exist, while potentially missing that a genuinely federally-regulated target elsewhere in its portfolio needed the real s.4(1)(b) analysis the checklist was designed for.

The tell

A privacy diligence checklist that treats customer and employee data identically, applying the same statute to both without first asking whether the target is a federal work, undertaking or business, has not actually read s.4(1) — it has assumed PIPEDA is a general-purpose employee-privacy statute, which for the large majority of Canadian employers it is not.

Takeaways

• • PIPEDA s.4(1)(a) covers commercial-activity data generally; s.4(1)(b) covers employee data only where the employer is a federal work, undertaking or business. The two paragraphs do not travel together.
• • For a provincially-regulated employer, ask which provincial statute (if any) applies to employee records before assuming PIPEDA does — and in a province with no general private-sector employee-privacy statute, the honest answer may be that none does.
• • Ontario has no general private-sector employee-privacy statute of the kind Alberta, BC and Quebec each have. Do not assume a provincial gap-filler exists everywhere.
• • A single diligence checklist applied uniformly across every target risks spending real budget diligencing a statute that was never in play, while missing the analysis that was actually required.

Sources

• • Personal Information Protection and Electronic Documents Act s.4(1) — the application clause distinguishing commercial-activity data from employee data, and confining the latter to a federal work, undertaking or business.
• • PIPEDA s.26(2)(b) — the substantially-similar-provincial-legislation exemption power, which is why Alberta, BC and Quebec have their own employee-privacy statutes operating alongside PIPEDA.
• • Not asserted: the specific list of sectors that qualify as a “federal work, undertaking or business”. That definition sits elsewhere in the Act and was not fetched for this file; nothing above should be read as an exhaustive list.
• • Treadstone Law — transferring employee HR records on an Ontario business sale — general practice on moving HR records in a sale. It does not address which privacy statute, if any, governs those records; the analysis above is the operative rule.