Pre-Employment Due Diligence Without Breaching PIPEDA

Most employers who end up explaining themselves to a privacy commissioner or a human rights tribunal were not doing anything exotic. They ran a background check. Somebody looked at the candidate’s Facebook along the way. Nobody wrote down why any of it was necessary. None of that is unlawful on its face, and all of it is hard to defend afterwards.

The fix is almost never “check less.” Hiring due diligence is lawful, and in some roles close to negligent to skip.

Short answer: what makes hiring due diligence defensible in Ontario is not the volume of checking but three things: a purpose you can state in one sentence, information genuinely relevant to that purpose, and specific informed consent to that particular check. Get those right and identity, credential, licensing, employment and public-record verification is safe ground. Get them wrong and the exposure is rarely a privacy fine. It is a human rights complaint, because an open-ended check surfaces protected-ground information you cannot un-know. And on the jurisdictional point most writing here gets backwards: PIPEDA does not govern most Ontario employers’ handling of applicant information at all. It governs the investigator you hire.

Because this turns on four statutes, treat it as orientation and have an employment lawyer review any real screening program.

This article is general information about investigative practice in Ontario, not legal advice. Laws change and every situation is different. For advice about your specific circumstances, consult a licensed Ontario lawyer or contact a licensed investigator directly.

Which privacy law actually applies to you

PIPEDA (the Personal Information Protection and Electronic Documents Act) applies to two things. Under s. 4(1)(a), to personal information an organization “collects, uses or discloses in the course of commercial activities.” Under s. 4(1)(b), to information “about an employee of, or an applicant for employment with, the organization” only where it is collected “in connection with the operation of a federal work, undertaking or business.”

Read that second branch carefully. PIPEDA reaches applicant information only if you are a federally regulated employer: a bank, airline, railway, interprovincial trucking firm, telecom or broadcaster. The Privacy Commissioner puts it plainly. The Act applies to employee information “only in organizations that are engaged in federal works, undertakings or businesses.”

Ontario has no general private-sector privacy statute to fill the gap. Alberta, British Columbia and Quebec have laws declared substantially similar to PIPEDA. Ontario’s is health-sector only. So if you are a provincially regulated Ontario employer, no general privacy statute governs what you do with a candidate’s file. That is not permission. Your exposure runs through four other channels:

• The third party you hire. A screening firm or licensed investigator collects that information in the course of commercial activity, which lands it inside PIPEDA s. 4(1)(a). Your investigator is regulated even where you are not, and what they can lawfully collect is capped by their obligations, not your instructions.
• Contract. Whatever you promised in your privacy notice and consent form binds you as a term.
• Common law. Ontario recognizes the tort of intrusion upon seclusion (Jones v. Tsige, 2012 ONCA 32).
• The Human Rights Code, the real risk and the subject of most of what follows.

The absence of a governing privacy statute makes disciplined practice more important, not less.

The three questions that govern every check

Every check should survive three questions, answered in writing before it runs.

1. What is the purpose? Not “due diligence.” A purpose is specific: confirming this candidate holds the professional licence the role requires. PIPEDA’s Identifying Purposes principle requires purposes identified at or before collection, and clause 4.2.4 requires fresh consent before information collected for one purpose is used for another.
2. Is the information actually relevant to that purpose? Clause 4.4.1 is blunt: organizations “shall not collect personal information indiscriminately,” and both amount and type must be limited to what is necessary. Section 5(3) adds a reasonable person test on the purpose itself. A driving abstract is relevant for a delivery role and irrelevant for a bookkeeper.
3. Did the candidate meaningfully consent to this specific check? Not to “background screening” generally. To this check.

If you cannot write a one-sentence answer to all three, you are not ready to run it. That document is also what you produce if the decision is challenged.

Consent has to be specific, and police checks need their own

The most common defect we see is a blanket line buried in an application form: I consent to the Company conducting any background checks it deems necessary. That line is close to worthless.

PIPEDA s. 6.1 makes consent valid only where “it is reasonable to expect that an individual to whom the organization’s activities are directed would understand the nature, purpose and consequences” of it. Clause 4.3.2 requires purposes stated so the individual “can reasonably understand how the information will be used or disclosed,” and clause 4.3.3 prohibits requiring consent beyond what the specified, legitimate purposes require. A catch-all fails all three.

Specific consent is itemized, each check named rather than a category heading, purpose-linked, and signed at the point the check runs. It is also scoped in time: consent for a pre-hire check is not consent to re-screen annually.

Police record checks are a separate regime with their own consent. Ontario’s Police Record Checks Reform Act, 2015 came into force on 1 November 2018 and applies wherever a police database is searched to screen someone for suitability for employment (s. 2(1)). It permits exactly three types of check under s. 8(1): a criminal record check, a criminal record and judicial matters check, and a vulnerable sector check. Each discloses a different defined set of information under s. 9 and the Act’s Schedule.

Two provisions matter most. Under s. 8(3), a provider “shall not conduct a police record check in respect of an individual unless the request contains the individual’s written consent to the particular type of check.” Consent is to the type, so you cannot consent someone to a criminal record check and receive a vulnerable sector check. Under s. 12, results go to the individual and nobody else, reaching you only if the individual “provides written consent after receiving the results.” Section 13 limits you to the purpose the check was requested for.

Note what the Human Rights Code does and does not protect. Section 5(1) lists record of offences as a prohibited ground in employment, but s. 10(1) defines it narrowly: a conviction pardoned under the Criminal Records Act (Canada) and not revoked, or a conviction under any provincial enactment. An unpardoned Criminal Code conviction is not itself a protected ground, and charges that never led to conviction are not covered. Even so, s. 24(1)(b) permits acting on a record of offences only where it is “a reasonable and bona fide qualification because of the nature of the employment.”

The verification work that is nearly always defensible

Much of hiring due diligence is confirming that stated facts are true. It is proportionate almost by definition, because each item maps to a claim the candidate made.

• Identity. Everything else is worthless without it.
• Education and credentials, direct from the institution. Confirm with the registrar, not with a PDF the candidate supplied.
• Professional licensing status. Most Ontario regulators publish a public register, including the investigative sector itself.
• Employment dates and title, from named references. Confirming what the candidate told you, with referees they named, is different from a covert approach to a current employer who does not know they are looking. The second is where people get hurt.
• Corporate directorships and officerships, where undisclosed outside interests would matter to the role.
• Public court and bankruptcy records, where relevant to the role. The qualifier does real work: litigation history matters for a fiduciary role and not for most others.
• Sanctions and disqualification lists, for regulated roles.

Verify at the source rather than accepting documents, and keep the report to findings that answer the stated purpose. That is how a background check stays defensible: confirmed or unconfirmed facts against a defined list, not a dossier.

The social media screening trap

The trap is not the one most employers expect.

An open-ended trawl through a candidate’s public social media will tell you things you have no lawful basis to weigh. Creed. Age. Family status. Pregnancy. Disability. Sexual orientation. Ethnic origin. Most of the prohibited grounds in s. 5(1) of the Code are visible in an ordinary personal feed within about ninety seconds.

You cannot un-know it. If the candidate is then rejected, you are defending a decision made by someone who demonstrably knew their protected characteristics. Section 23(2) says the right to equal treatment is infringed where an inquiry “directly or indirectly classifies or indicates qualifications by a prohibited ground of discrimination,” and an unstructured sweep is an indirect inquiry into most of them at once. That creates a discrimination record even where no discrimination occurred. The employer who screened honestly and the one who screened badly look identical in the file.

PIPEDA’s exception for publicly available information is also narrower than assumed. The Regulations Specifying Publicly Available Information (SOR/2001-7) list five categories: telephone and business directories, public registries, judicial and quasi-judicial records, and publications where the individual supplied the information. Social media is not among them.

If you are going to do it anyway, and for some roles there is a real reason to, the mitigations are structural:

1. Screen late. After a conditional offer, on a shortlist of one.
2. Define the criteria in advance and in writing. Statements inconsistent with a regulated professional obligation, disclosure of a former employer’s confidential information, conduct bearing on the duties. If it is not on the list before the search starts, it is not a finding.
3. Use a trained third party who reports only job-relevant findings. A licensed investigator running structured OSINT and social media screening reports against your criteria and filters out the rest, including protected-ground material.
4. Keep the decision-maker away from the raw feed. The hiring manager reads the filtered report and never sees the profile. That is what lets you say truthfully that the decision-maker did not know.
5. Document what was searched, when, and against what criteria, including negative results.
6. Never ask for passwords or access to private accounts.

Credit checks are defensible for a narrow set of roles

A credit check is the check employers most often run and least often justify.

It holds up where financial exposure is part of the job: signing authority, cash handling, control of payment systems, fiduciary duties, or a regulated financial position. For everything else, a credit history tells you almost nothing about performance and a great deal about circumstances you should not be weighing, including medical debt, a divorce, or unemployment. Several of those correlate with prohibited grounds, which turns a weak predictor into a live discrimination risk.

Where a third party supplies the report, Ontario’s Consumer Reporting Act engages. Employment is a permitted purpose under s. 8(1)(d)(iii), but s. 10(2) bars obtaining a consumer report containing personal information “unless that person first gives written notice of the fact to the consumer,” and s. 10(6) requires that notice in bold or underlined type of at least ten point. The Act defines “personal information” broadly, as information about a consumer’s “character, reputation, health, physical or personal characteristics or mode of living,” so the notice duty reaches well beyond credit data.

Stage the checks so the intrusive ones come last

Sequencing solves several problems at once and costs nothing. Run the cheap, low-intrusion checks early: identity, credentials, licence status. Run the expensive and intrusive ones after a conditional offer, on one candidate, with consent obtained at that point.

You then collect far less personal information and hold fewer files on people you never hired. Consent given at that stage is specific and contemporaneous rather than boilerplate signed weeks earlier. And you narrow the population who could allege that something learned during screening influenced a rejection. Write the conditional offer to name the checks it is conditional on.

Adverse findings: put it to the candidate first

Records are wrong more often than employers assume: name collisions in court databases, entries never updated after a charge was withdrawn, credentials filed under a former name, employment dates that differ because a company was acquired mid-tenure. A meaningful share of apparent discrepancies dissolve on a single question to the candidate.

PIPEDA’s Accuracy principle sets the standard that should apply whether or not the Act binds you directly. Clause 4.6.1 requires information sufficiently accurate, complete and up to date “to minimize the possibility that inappropriate information may be used to make a decision about the individual,” and clause 4.9 gives individuals a right to challenge accuracy and have information amended.

So before an adverse finding becomes an adverse decision: give the candidate the substance of the discrepancy, a real opportunity to correct it, and document the exchange. Where a consumer reporting agency was involved, s. 10(7) of the Consumer Reporting Act requires that when a benefit is denied wholly or partly because of information received, the user “shall deliver to the consumer at the time such action is communicated” notice of that fact, and on request within sixty days identify the source or the agency. This step is not a courtesy. It is the difference between a defensible decision and an indefensible one.

Retention, access, and who sees the file

Screening material is among the most sensitive information an employer holds and routinely the worst governed.

• Keep it separate from the general personnel file, with its own access control.
• Limit access to those who need it to make or defend the decision. A hiring manager needs a pass or fail against defined criteria, not the underlying report.
• Set a written retention period and destroy on schedule. Clause 4.5.3 says information no longer required “should be destroyed, erased, or made anonymous.” The most common failure by a distance is indefinite retention of unsuccessful candidates’ files, which is pure liability with no offsetting value.
• Safeguard it proportionately to its sensitivity, per clause 4.7.
• Bind your vendor by contract. Clause 4.1.3 makes an organization responsible for information transferred to a third party for processing and requires “contractual or other means to provide a comparable level of protection.”

Confirm the vendor is licensed. In Ontario, work performed for remuneration consisting primarily of conducting investigations to provide information, including information on “the character or actions of a person” and “the business or occupation of a person,” is licensed activity under the Private Security and Investigative Services Act, 2005 (s. 2(2) and s. 2(3)), and both the investigator and the agency need licences (s. 6, s. 7(1)). If a supplier cannot give you a licence number, that is the end of the conversation.

Candidates who have lived or worked outside Canada

This is where a well-designed program tends to fall apart, and where honesty about limits matters most.

Foreign criminal record checks generally cannot be obtained by a third party at all. Most jurisdictions issue a certificate only to the individual, often requiring in-person attendance, fingerprints or a consular process, on timelines measured in weeks. Foreign court and corporate records vary enormously in accessibility. Some countries restrict the export of personal data, others keep no meaningful record, and a nominally equivalent document can mean something different in its home system.

What works: ask the candidate to obtain the foreign certificate themselves and build the time into the offer conditions. Verify what can be verified at the source, since foreign universities and regulators will often confirm credentials directly. And be explicit about the gap, because a report that quietly omits a five-year overseas period invites the reader to assume coverage that does not exist.

Do not penalize the gap itself. Treating an unverifiable foreign period as a negative finding is where this becomes an adverse-effect discrimination problem on place of origin, ethnic origin and citizenship, all grounds under s. 5(1).

What to do next

Five things, in order.

1. Write down the purpose for each check, per role. One sentence each. If you cannot write it, drop the check.
2. Replace the blanket consent line with an itemized, purpose-linked authorization signed at the point the check runs.
3. Move the intrusive checks behind a written conditional offer. This alone removes most of your exposure.
4. Take social media out of the hiring manager’s hands. Defined criteria, late in the process, filtered report.
5. Set a retention period and a destruction schedule, and confirm your vendor’s licence number and contract terms.

None of this reduces how much you learn about a candidate’s suitability. It changes what you collect, when, and on what record.

If you want screening structured this way, our background checks and OSINT and social media investigations services report against defined, job-relevant criteria rather than handing you a dossier. Assign a Case or contact us and we will scope it to the role. For how privacy law constrains investigative work more generally, see our reference on PIPEDA and lawful surveillance.

Frequently asked questions

Does PIPEDA apply to an Ontario employer’s background checks on job applicants?

Usually not directly. PIPEDA covers applicant and employee personal information only where the employer operates a federal work, undertaking or business, such as a bank, airline or telecom. Ontario has no general private-sector privacy statute for provincially regulated employers. PIPEDA does still reach the investigator or screening firm you hire, as a commercial actor.

Can an employer require a police record check as a condition of hiring?

An employer can request one, but under Ontario’s Police Record Checks Reform Act, 2015 a check cannot be conducted unless the request contains the individual’s written consent to that specific type of check. Results go to the individual first, and reach the employer only if the individual consents in writing after seeing them.

Is it legal to look at a job candidate’s social media?

Looking at genuinely public content is not itself unlawful in Ontario. The risk is what you learn. An open-ended trawl surfaces creed, age, family status, disability and other protected grounds, and the employer cannot un-know it. If the candidate is later rejected, that knowledge is part of the record.

When is a credit check on a job applicant defensible?

Only for roles where financial exposure is part of the job: signing authority, cash handling, payment systems, fiduciary duties, or regulated financial positions. For most roles a credit history says nothing about performance. Where a third party supplies the report, Ontario’s Consumer Reporting Act requires written notice before it is obtained.

What should an employer do when a background check turns up something bad?

Put it to the candidate before acting on it. Records are wrong more often than employers assume: name collisions, stale data, uncorrected court entries, misfiled credentials. Give the candidate the substance of the discrepancy and a real chance to respond, document the exchange, then decide.