There is definitely a movement lately for organizations, both in the public and private sectors, to collect and analyze diversity, equity and inclusion data, for many very important reasons.
For sure, most of this data would be considered sensitive personal information. Unfortunately, the privacy analysis in Canada for these types of programs is murkier than it should be. This is because on the employment side of things, we only have laws in Quebec, British Columbia and Alberta. At the federal level, the Personal Information Protection and Electronic Documents Act applies but only to the federally regulated sector (known as FWUBs).
So in Canada’s largest province of Ontario, there is no privacy law to help guide organizations that want to collect and analyze this data. Ontario does have its own Human Rights Code, but the code is limited to making it clear that discriminating on the enumerated grounds that closely mimic DE&I data is prohibited. There’s very little guidance on, for example, what the best practices are, the role of consent, the need for deidentification of the data, etc.
This is one reason why I’m curious to see if the Ontario government will ever move forward with the idea it proposed awhile back about passing its own privacy law. In fact, I feel all the provinces should think hard about filling the void left in the employment side of things because of the constitutional limitations on the federal government (i.e., regulating employment matters at the federal level can only occur in otherwise federally regulated industries).
On the other hand, it might be worrisome to think about Canada having 10 or more privacy laws to contend with. Would they truly be “substantially similar” to one another or will a pan-Canadian organization have to tailor its approach in 10 ways in order to be compliant with each law?
This is a topic that I’d like to hear from you on. What does your organization do with respect to the collection and use of DE&I data? Does the lack of rules for these worthwhile programs make the privacy challenges more difficult than they should be? Leave your thoughts in the comment section below.
Have a great weekend.