In today’s digital age, the protection of personal information has become a critical concern for individuals and organizations alike. Employers, in particular, hold a significant responsibility to safeguard the personal information of their employees. Under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) in Ontario, Canada, employers are required to comply with specific legal obligations regarding the handling of protected employee information. In this blog post, we will explore the key requirements under MFIPPA and discuss the appropriate responses and actions for employers in the event of a breach or unauthorized release of employee information.

Understanding Protected Employee Information: Protected employee information refers to any personal information collected, used, or disclosed by an employer in the course of its operations. This includes but is not limited to employee records, contact details, social insurance numbers, medical information, performance evaluations, and disciplinary records. The purpose of MFIPPA is to ensure that this information remains confidential and is used only for legitimate business purposes.

Response of the Employer if Personal Information is Released: If the personal information of employees is released without authorization, the employer must take immediate action to mitigate the potential harm caused. The following steps should be considered:

1. Containment: The employer must promptly identify the source and extent of the information breach. All-access points and potential vulnerabilities should be secured to prevent further dissemination.
2. Investigation: A thorough investigation should be conducted to determine how the breach occurred, the nature of the information disclosed, and the potential impact on affected individuals.
3. Notification of Employees: In most cases, the employer has a duty to notify affected employees about the breach, the type of information disclosed, and any potential risks or consequences. This allows employees to take necessary precautions to protect themselves against potential identity theft or other adverse effects.
4. Remediation: The employer should take appropriate steps to rectify the situation and prevent similar incidents from occurring in the future. This may include updating security protocols, enhancing employee training, or implementing additional safeguards to protect personal information.

Duty to Notify the Information and Privacy Commissioner of Ontario:

Under MFIPPA, employers are required to notify the Information and Privacy Commissioner of Ontario (IPC) if a privacy breach involves a significant risk of harm to affected individuals. The IPC should be informed as soon as reasonably possible, providing details of the breach, the steps taken to mitigate harm, and any future preventive measures.

Employee Releases Personal Information of a Colleague(s):

If an employee releases the personal information of a colleague(s) without authorization, the employer must treat this situation as a serious privacy breach. The employer should follow the same steps outlined earlier, including containment, investigation, employee notification, and remediation measures.

Whistleblower Claims and Employer Responsibility:

If an employee claims to be a whistleblower and releases personal information as part of exposing wrongdoing within the organization, it does not automatically eliminate the employer’s responsibility to protect personal information. While whistleblower protection laws exist to safeguard employees reporting misconduct, the release of personal information should be proportionate and limited to what is necessary for exposing the alleged wrongdoing. Employers may need to balance their obligations under privacy legislation with the duty to investigate and address the whistleblower’s concerns.

Conclusion:

Compliance with the Municipal Freedom of Information and Protection of Privacy Act is crucial for employers when handling protected employee information. By understanding their legal requirements and taking prompt and appropriate action in the event of a privacy breach, employers can demonstrate their commitment to protecting the personal information of their employees. Adhering to these obligations not only promotes trust and transparency but also helps safeguard employees’ privacy rights and reduces the risk of potential legal repercussions for the organization.