Personnel Files in Canada: Are Employers Required to Disclose Them to Employees?

​Here is a familiar scenario: An employee makes a request to HR asking for his or her personnel file. The employee may have been recently dismissed, "gunning" for a promotion, contemplating litigation or simply curious. Employers may have many reasons to hesitate to hand over this information to an employee and might wonder what they should do—could they decline this request?

Privacy law in Canada is regulated by both the federal government and the provinces. Federally regulated workplaces must comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). If provincial legislation is substantially similar to PIPEDA, as is the case in Alberta, British Columbia and Quebec, the provincial legislation applies instead of PIPEDA. However, PIPEDA does not apply in employment-related privacy law except in the federal sector. Federally regulated workplaces include airports, aircraft and airlines; banks; interprovincial or international transportation companies; telecommunications companies; offshore drilling operations; radio and television broadcasters; and organizations in the Northwest Territories, Yukon and Nunavut.

Whether an employer has an obligation to grant an employee access to his or her personnel file depends on the jurisdiction within which the employer operates. As a general rule, jurisdictions that have statutes that regulate employee privacy (listed below) grant employees a right to access their personnel files, subject to certain exceptions that will be discussed below.

In all other jurisdictions, employees do not have a general right to access their personnel file. The right to access personal information collected and maintained by the employer would have to be negotiated or granted in advance in a collective agreement, individual contract of employment or the employer's policy handbook. Otherwise, mandatory access would only apply in situations in which there was some form of production or discovery obligation, such as in civil litigation.

Provinces Where Employees Are Entitled to Access Their Personnel Files

Employers operating in British Columbia, Alberta, Quebec or the federal sector are required to provide employees with their personnel files upon request. These jurisdictions have privacy statutes governing the collection, use and disclosure of personal information relating to employees, among others. In these jurisdictions, employees are not only entitled to access their personal information, they are also entitled to have inaccurate or incomplete information amended.

Once an employee makes a request for access to his or her personnel file, the employer must respond to the request within a reasonable time. In British Columbia, Quebec and the federal sector, the employer must respond to the request within a maximum of 30 days. In Alberta, the employer has 45 days to respond. These timelines can be extended in certain circumstances, but delay in granting access may result in an award of damages to the employee.

Aside from the right to review his or her personnel file, an employee is entitled to request copies of this information. The employer is prohibited from making a profit over the provision of copies. Fees should therefore be limited to the cost of copying or other disbursements associated with retrieving the information. As a practical matter, most employers would not charge a fee to current employees for this unless the production request is substantial. 

Denying Access to Employee Personnel File

There are certain situations in which an employer may deny an employee's request to access parts of his or her file. Such a refusal must be documented in writing, outlining the reasons for the denial and alerting the employee that he or she may ask the privacy commissioner to review the refusal.

In most circumstances, the employer would be required to sever the information to which the employee should arguably not have access from the information that the employee should be granted access to. In other words, just because parts of the employee's file are covered by one of the exceptions to access does not allow the employer to instate a blanket denial of access to the employee's file.

Certain categories of information presumptively fall outside of the scope of what an employer is required to disclose to an employee. There are four categories of exception to an employee's statutory right to access their personal information.

Privilege. Organizations are generally not required to provide access to information that is related to legal proceedings or confidential commercial information relating to the organization.

Security. If the disclosure of information could threaten the security of an individual or interfere with law enforcement or national security, then the employer may refuse to grant access to such information. For example, information that could prejudice the employer's security investigation need not be disclosed.

Excessive expense and burden. In cases where the personal information requested by the employee is expensive or burdensome to retrieve, the employer may be entitled to deny the access request. Assessing whether an employer may deny access on this basis is founded on measuring the relative importance of the information to the employee against the cost and burden associated with its retrieval. For example, information necessary to the allocation of important benefits to the employee should be retrieved, even if it is relatively expensive or burdensome. Please note that this assessment does not generally go both ways—information that is not evidently important to the employee but that is relatively easy to retrieve should still be disclosed.

Personal information of a third party. Employers should not grant employee access to personal information about a third party unless the third party grants consent to the disclosure or the information about the third party can be severed.

[SHRM members-only toolkit: Introduction to the Global Human Resources Discipline]

Takeaway for Employers

Privacy legislation in British Columbia, Alberta and Quebec and the federal sector generally requires employers to comply with employee requests to access personal information the employer holds about them. In all other Canadian jurisdictions, the employer is generally not required to comply with such a request, unless access is granted through contractual means. The general right to access personal information is subject to certain exceptions. When denying access, the employer should be able to explain the category of exception under which access was denied.

Shir Fulga is an articling student with Ogletree Deakins in Toronto. Michael Comartin is an attorney with Ogletree Deakins in Toronto.