Employers are increasingly interested in the use of biometrics in the workplace. In fact, Quebec’s privacy regulator, the Commission d’accès à l’information (CAI), indicates in its 2023-2024 Annual Activity and Management Report (available in French only) that it has received 124 declarations of biometric data collection, which is a 59% increase from 2022-2023.
Biometric systems are used in the workplace to improve the safety and efficiency of human resource management processes. They include various tools that collect data such as fingerprints and hand shapes, as well as facial and voice recognition systems. Current legislation in Quebec regulates the use of these systems by requiring employers to comply with certain specific obligations aimed at protecting employee privacy. Employers in Quebec are also required to demonstrate that they are using these systems for legitimate purposes.
Biometric data is regarded as sensitive personal information and is therefore subject to privacy legislation applicable to the public and private sectors, regardless of the purpose of its use. Given its composition of distinctive characteristics and identifiers, such data is considered intimate information and should be processed carefully.
Prior Notice to the CAI
Employers are required to notify the CAI at least 60 days before collecting biometric data.
Assessing the Necessity of Collecting Biometric Data
Employers are also required to assess the necessity of collecting biometric data. Pursuant to applicable legislation, the purpose of any such collection must be to address concrete issues and be legitimate, important and real. Here are a few questions to guide this assessment:
- Why is the biometric data being collected?
- For what purpose is the biometric data being used?
- Is there a documented issue that justifies the collection?
The mere convenience or practicality of using biometric data does not, in the CAI’s view, constitute a valid justification.
Employee Privacy
Employers must also consider the risk of intrusion on employee privacy. According to the CAI, employers are required to explore means other than the use of biometrics to address identified issues. An employee’s consent to the collection and use of their biometric data does not allow the employer to use this information without proper justification. The CAI has also stated that such consent must be clear, free, informed, given for a specific purpose and valid for a limited period only. Furthermore, employers are required to implement other means of collecting data from employees who do not consent to having their biometric data collected.
Data Protection and Employee Access
Employers are responsible for putting in place measures that protect the biometric data collected from their employees. Such data must also be destroyed in a secure manner when no longer useful. In addition, employees should be able to access their personal information and request corrections if necessary.
While the benefits of using biometric data in the workplace are undeniable for workplace safety and efficiency, such use is governed by a strict legal framework that seeks to protect the personal information of employees. Employers can take full advantage of these benefits by complying with reporting requirements, carefully assessing the need for data collection and ensuring data protection.
Legislative Amendment
Pursuant to Quebec’s Act respecting the Protection of Personal Information in the Private Sector (Act) organizations may anonymize, for serious and legitimate purposes, personal information they have collected once the initial purpose for which such information was collected or used is achieved. Information is to be considered anonymized if it is, “at all times, reasonably foreseeable in the circumstances that it irreversibly no longer allows [a] person to be identified directly or indirectly.” Organizations must anonymize personal information “according to generally accepted best practices” and “the criteria and terms determined by regulation.”
Furthermore, Quebec’s Regulation respecting the anonymization of personal information (Regulation), which came into force on May 30, 2024, establishes criteria and terms applicable to the process of anonymizing personal information in Quebec. Section 9 of the Regulation, which comes into force on January 1, 2025, introduces new provisions for the anonymization of personal information. It provides that any organization that anonymizes personal information must record the following in a register:
- A description of the anonymized personal information
- The purposes for which the organization intends to use the anonymized information
- The anonymization techniques used by the organization
- The protection and security measures established by the organization
- The date on which the re-identification risk analysis is completed, as well as the date on which the update of such analysis is completed
There is no doubt that the use of biometrics will become more widespread in the coming years. Employers that abide by the parameters established in the applicable legislation will be able to implement systems that truly improve workplace safety and efficiency.
For further insight on privacy and data protection in Quebec, please see the following Blakes Bulletins: Privacy Update: Quebec Publishes Final Anonymization Regulation and New Quebec Privacy Law Obligations Coming: Is Your Organization Ready?
For more information, please contact any member of our Employment & Labour group.
