Employee privacy in the age of COVID-19

In addition to shouldering medical and economic concerns, employers in the age of COVID-19 face ethical and legal dilemmas with respect to the privacy of their employees. Can employers ask about their employee’s COVID-19 test results, or is that private? What about asking about employees’ family members — is that going too far? Do employees have a right to know when a co-worker tests positive, or is that confidential?

In this article, we address some of the privacy concerns arising in the workplace during COVID-19.

What privacy laws apply to a COVID-19 diagnosis? Can an employer compel their employees to disclose that they are being tested for COVID-19?

The short answer is yes — but employers should be careful about the way they request personal health information and what they do with that information. As such, employers should be aware of applicable privacy legislation.

In Manitoba, the unauthorized use and disclosure of personal health records can be grounds for a lawsuit under The Privacy Act. Employers have a duty of care with respect to the privacy of their employees, and employees have a reasonable expectation of privacy in the workplace. 

A COVID-19 diagnosis is “personal information” for the purposes of privacy law. Employers therefore must respect how information surrounding a COVID-19 diagnosis is collected, used and disclosed.

An employer can collect, use, or disclose personal health information only for purposes that a reasonable person would consider appropriate in the circumstances. When it comes to COVID-19, this means that employers must share only the minimum amount of information necessary to accomplish the purpose for disclosure.

Are workplace safety and health considerations relevant?

Under The Workplace Safety and Health Act, an employer has a duty to ensure “so far as is reasonably practicable” the safety, health and welfare of all their workers at work.

COVID-19 is a health hazard for the purposes of that legislation. In this context, it is reasonable for employers to ask that employees disclose that they are being tested for COVID-19 so that employers can do their part to ensure the workplace stays safe from that health hazard.

But an employer’s pursuit of a safe workplace must take into account employees’ privacy.

Generally speaking, an employer should not ask for more information than is necessary to ensure a safe workplace. Asking employees to disclose if they are testing for COVID-19 is necessary; this question allows the employer to decide whether that employee should work from home, whether the employee should be on sick leave until they recover, or whether the employer wants to take precautionary steps to limit potential exposure in the workplace.

On the other hand, asking for information such as why and how the employee came in contact with COVID-19 is not necessary to ensure a safe workplace, and these types of questions should be avoided.

What if an employee’s family member is tested? Is that private, or can an employer compel the employee to share about their family’s testing or results?

Because of the highly infectious nature of COVID-19, an employer can reasonably ask employees to share the fact that one of their close contacts is being tested or receives a positive test result. Again, this information allows an employer to make decisions about proper next steps to reduce the hazard to other employees.

But once again, employers should only ask for the minimum amount of information necessary to ensure a safe workplace. This can typically be done without asking the employee to disclose the identity of their close contact.

Can employers ask about employees’ travel, attendance at social gatherings, or other off-hours activity?

Generally speaking, what a person does away from the workplace is not an employer’s business.

Employers can ask that employees provide information regarding COVID-19 to the extent that it directly relates to ensuring the health and safety of the workplace. Based on the Public Health Agency of Canada’s current travel restrictions as well as restrictions between provinces, it may be reasonable for an employer to request that employees who have travelled outside the province or country to disclose that travel to the employer.

If an employer has a policy asking employees to disclose that they are being tested, have a positive result, or if they have close positive contacts, further questions about the employees’ off-hours activity are likely unnecessary. These questions do not help the employer make decisions to ensure a safe workplace and should usually be avoided.

Do employees have a right to know that somebody was tested for COVID-19 in their workplace? What about positive results?

Employees have a right to a safe workplace. Since COVID-19 is a workplace hazard and a public health emergency, employers should inform employees when there is a positive or suspected case at their place of work.

However, employers should carefully consider the purposes for disclosure and their employees’ reasonable expectation of privacy.

It is normally sufficient for health and safety purposes to state that an unnamed person was in the workplace and has been exposed to the virus. The exposed person’s identity should not be disclosed: a COVID-19 diagnosis is sensitive personal health information and should be treated as confidential.

If the workplace is small and informing employees that somebody has been exposed to COVID-19 would effectively identify that person, consider a broader notification (e.g. somebody in the area or floor).

When it comes to contact tracing, what is Manitoba Public Health’s role compared to an employer/employee’s role?

Employers should contact their local health authorities if they believe there was a risk of transmission of COVID-19 at the workplace. The regional health authority will provide instructions on appropriate next steps.  

Keep in mind that it may not be appropriate for an employer to make a public announcement about an outbreak in their business, whereas the public health authority may be required to do so according to its mandate.

In all cases, employers should focus on maintaining a safe workplace while disclosing the minimal amount of personal information possible to satisfy that purpose.

How can employers plan ahead for some of these decisions?

Respecting employee’s rights to a safe workplace and their rights to privacy is a tough balancing act. A good place to start is a transparent COVID-19 response policy. This policy can give employees a heads-up about exactly what information the employer will ask for, and what information the employer will not ask for. Employers can let their employees know the purpose for asking for COVID-19 related information, how the information will be shared (and not shared), and how it will be stored and eventually destroyed. A clear privacy policy also shapes an employee’s reasonable expectations of privacy.

Transparency, preparation and clear communication can go a long way toward building trust in anxious and uncertain times. When it comes to personal privacy, building that trust is all the more important.

If you have further questions about privacy in the workplace or other employment-related questions, our team is here to help.

Fillmore Riley's Employment and Labour Law Practice

Fillmore Riley’s employment law practice continues to be available to assist Manitoba employers with their response to the COVID-19 pandemic.

Resource posted December 8, 2020, with reports from David Thiessen.