Alberta’s Office of the Information and Privacy Commissioner recently heard a case in which an employer refused to provide employee records to a former employee upon request, allegedly claiming that, “legally she does not have to give [the employee] a copy.” The commissioner’s office had little trouble deciding that the employer was wrong and ordered that it provide the requested records to the former employee.
About a month after he left his job, the employee requested by letter a “Record of Employment and a copy of all pay stubs starting in February 2008, stating all hours, hourly pay, deductions, and vacation pay.” When the employer didn’t respond to the request, the employee applied to the commissioner’s office for a review of the issue. Subsequently, the employer provided the employee with his ROE and T4 forms, but not his pay stubs, and the employee sought a further review from the office. The employer offered no response and no more information.
The essential question was: Did the employer comply with section 27(1)(a) of the Personal Information Protection Act (duty to assist, including duty to conduct an adequate search for responsive records)?
The Act states:
On the request of an individual for access to personal information about the individual, and taking into consideration what is reasonable, an organization must provide the individual with access to the individual’s personal information where that information is contained in a record that is in the custody or under the control of the organization.”
As for the records that are in the custody of the employer, the Employment Standards Code states:
14(1) Every employer must keep an up-to-date record of the following information for each employee:
a) Regular and overtime hours of work;
b) Wage rate and overtime rate;
c) Earnings paid showing separately each component of the earnings for each pay period;
d) Deductions from earnings and the reason for each deduction;
e) Time off instead of overtime pay provided and taken.
(2) At the end of each pay period, an employer must provide a written statement to each employee setting out, in respect of the employee:
a) The information described in subsection (1), and
b) The period of employment covered by the statement.
15 Employment records must be retained by an employer for at least 3 years from the date each record is made.
In other words, the employer should have had in its custody all of the information that the employee requested.
As for the employer’s duty to provide the information, section 27(1) of the Act states simply,
An organization must make every reasonable effort to assist applicants, and to respond to each applicant as accurately and completely as reasonably possible.”
In other words, the employer was legally obliged to search for and provide the records to the employee, if reasonably possible.
According to the commissioner’s office:
An adequate search has two components: every reasonable effort must be made to search for the actual records requested, and the organization must inform the applicant, in a timely manner, what steps have been taken to search for the requested records. Further, the decision as to whether an adequate search was conducted must be based on the facts relating to how a search was conducted in the particular case.”
After providing the partial information requested, the organization failed to comment further and ignored requests from the commissioner’s office for comment. Therefore, the commissioner had no evidence that the employer made any effort to seek or provide the pay stubs, or to inform the employee of the status of the search. Without this information, the commissioner found that “the [employer] failed to fulfill any aspect of its duty to assist the [employee].”
The office consequently ordered the employer to “conduct an adequate search” for the pay stubs, and to inform the employee as to the status of the search. If the employer failed to find any of the requested records, the employer would have to:
…write an explanation to the [employee], indicating whether such records exist or ever existed, the specific steps taken to identify and locate records containing information responsive to his access request, the scope of the search conducted (e.g., physical sites, program areas, specific databases, off-site storage areas, etc.), the steps taken to identify and locate all possible repositories of records relevant to the access request (e.g., keyword searches, records retention and disposition schedules, etc.), and why, if no records are located, the [employer] believes that no records of the requested information exist.”
And it had to do so and report to the commissioner’s office within 50 days.
The lesson here is simple: if they wish to avoid orders form the Information and Privacy commissioner’s office, organizations should comply with employee requests to access their personal information that the organization holds. It’s also a good idea to review your obligations with respect to what information you are obliged to record and for how long, and under what circumstances you must provide it.
Adam Gorley
First Reference Human Resources and Compliance Editor
Thanks for this piece.
Cheers – LS