COVID-19 Employee Privacy Issues

Below is a featured article by TDS lawyers Megan Smith and Kristin Kersey, highlighting the importance of employee privacy issues during the pandemic.

Since the beginning of the COVID-19 pandemic, employers in Manitoba have been confronted with questions as to the amount of information they can share when an employee informs their employer that they have tested positive for the virus.

Employers must be mindful that a COVID-19 diagnosis is private health information, and the individual employee’s privacy must be maintained whenever possible. At the same time, employers have an obligation to take reasonable steps to provide a safe workplace for their employees. Assessing the appropriate use and disclosure of employee personal health information involves a balancing of an individual employee’s right to privacy with the employer’s obligation to protect its workplace.

Privacy Laws Which May Apply to Employers

As a starting point, employers need to be aware of what privacy legislation may apply to them, and how that may impact the ways in which they can use and disclose employee personal health information. In Manitoba, there are a number of privacy laws that may or may not be applicable depending on the nature of the business.

Unlike in some provinces, provincially regulated private sector employers in Manitoba are not subject to specific provincial privacy legislation concerning the collection, use, and disclosure of employee personal information. This does not mean that employers do not need to be concerned with protecting employee privacy!

The Privacy Act (Manitoba) creates a statutory tort where a person “substantially, unreasonably and without claim of right” violates the privacy of another person, which may allow an individual to bring a civil claim if they believe their privacy has been violated. In addition, an employee may have the option to file a Human Rights complaint if they feel that discrimination or harassment has occurred. In unionized work environments, grievances may be filed if an employer does not properly protect the personal health information of employees.

Employers in the public sector, or which are federally regulated, must be mindful of additional legislation which applies to their businesses. The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to private sector, federally regulated employers. Public sector employers are governed by the Freedom of Information and Protection of Privacy Act (FIPPA). The Personal Health Information Act (PHIA) applies to health care providers and others deemed to be “trustees” of personal health information.

Respect for employee privacy and privacy legislation matters. Failure to comply with applicable privacy legislation can result in hefty fines, and even those employers who are not subject to specific privacy legislation may be sued or find themselves subject to a complaint or grievance. As a result, it is important to consider what steps can (and cannot) be taken where an employee tests positive.

What Can (and Can’t) An Employer Do When an Employee Tests Positive?

It is clear that employers may find themselves in a difficult situation where an employee notifies the employer that the employee has tested positive for COVID-19. The employer must balance their obligation to protect the health and safety of other employees with their obligation to protect the privacy of the individual employee. The employer’s goal should be to disclose sufficient information to make other employees aware of a possible exposure, but to give as little information as possible regarding the identity of the employee who has tested positive (or about the employee’s condition/other health information).

As a first step, the employer should determine when the affected employee was on the employer’s premises and when possible transmission to other employees could have occurred. The employer is generally entitled to send a notification to employees informing them that an employee has tested positive for COVID-19. This notice can typically specify the times and general locations (building, floor, etc.) where the employee was present in order to allow other employees to assess whether they may have been exposed and monitor for symptoms.

Except in rare situations, this notice should not reveal the identity of the employee in question, and employers should be careful not to reveal information which inadvertently identifies the specific employee (such as the employee’s specific work station). If the employee voluntarily gives express permission to be identified, the employer may identify the employee. The employer must, however, be careful to ensure that the employer does not inadvertently pressure the employee to grant such permission.

The employer should also make efforts to identify specific individuals who are likely to have come into close contact with the COVID-19 positive employee, and to notify those employees that they may have been in contact with an employee who tested positive for COVID-19. There may be circumstances where notifying an employee that they have been in close contact will effectively identify the COVID-19 positive employee – for example, where two employees work closely together but have limited exposure to other employees. In such cases, employers should acct with caution if they do not have consent to identify the employee.  Depending on circumstances, the employer may wish to ask exposed employees to work from home (if possible) or take other measures in order to isolate and monitor for symptoms.

Employers should also be mindful of ensuring that all health information provided by employees is stored securely and can only be accessed by managers and human resources personnel who require the information. This may require storing employee health information in a secure location which is separate from normal employee personnel files.

Given the potential consequences for employers, it is imperative that employers be mindful of the above principles while managing any situation involving a COVID-19 positive employee. In summary, employers must carefully secure any and all personal health information, only disclose the minimum amount of information necessary for the purpose, obtain consent prior to disclosure wherever possible, and comply with any applicable legislation.

At Thompson Dorfman Sweatman, we recognize the importance of staying up-to-date as an employer during a pandemic. TDS provides services in over 25 areas of practice to clients locally, nationally and internationally across every major sector. We are committed to help you adapt to change and the new normal with knowledge and resources in a wide variety of industries and services.

TDS offers many resources in our COVID-19 Resource Centre, which are available on our website here:

Know More.


28 minutes ago
Last chance to join us for our FREE Asked & Answered: Q&A with epidemiologist, Cynthia Carr, founder of EPI Research Inc! We'll be talking vaccine policy, and all things COVID with an emphasis on employer guidance.

Register: @PitbladoLaw & @BioscienceMB
18 hours ago
Have you heard about MCCs new engagement & polling platform?

With quick polls and surveys, MB PULSE will measure sentiment, collect LMI, & take the temperature of our community to create research outputs. Sign up today:

Get Help.