The Nunavut Information and Privacy Commissioner has found the territorial government’s Human Resources department violated privacy law by failing to properly explain why it was collecting personal information from an employee on unpaid leave.
The commissioner ruled that an HR employee’s email asking whether the worker was employed elsewhere breached section 41(2) of the Access to Information and Protection of Privacy Act because it used the vague phrase “updating your file” instead of providing the true purpose for collecting the information.
The case involved a former government employee who was on extended unpaid leave and engaged in a complex employment dispute with the government. On Jan. 13, an HR employee sent an email stating: “I hope this email finds you well. I am reaching out as we are updating your file. Can you please tell me if you are working for another employer (start date and name of employer)?”
The employee declined to answer and later filed a privacy complaint after obtaining internal government records through an access to information request. Those records revealed HR’s real purpose was to determine whether to terminate the employee on medical or non-medical grounds—a distinction that significantly affects severance pay and benefit continuation.
Misleading purpose statement
The commissioner found that while HR had legitimate authority to collect the employment information, the department failed to meet legal requirements for how such information must be collected.
“The stated purpose of ‘updating your file’ was essentially meaningless, since that phrase is vague enough to cover just about any collection of personal information,” the commissioner stated.
Internal records showed HR staff consulted with a supervisor before sending the email, with the supervisor suggesting the phrase “updating the file” to keep the request “neutral and professional” given tensions in the employment relationship.
The commissioner noted this approach violated section 41(2), which requires public bodies collecting personal information directly from individuals to inform them of the specific purpose, legal authority for collection, and contact information for someone who can answer questions about the collection.
Legal requirements ignored
The ruling emphasized that section 41(2) requires public bodies to “explain itself openly and plainly to the person whose personal information is being requested.” The commissioner found HR’s vague language failed this standard.
“If they cannot produce the legal authority, or if they find themselves shading or hiding their real purpose, they should probably re-think what they are doing,” the decision stated.
The commissioner determined that HR staff appeared uncertain about their legal authority, noting they initially questioned whether they could even ask for the information and were unsure what to do if the employee refused to answer.
After the employee declined to provide the requested information, HR eventually found online references to what appeared to be the person’s new employment and used that information in making termination decisions.
Broader employment dispute
The privacy breach complaint emerged from a larger employment dispute between the worker and the territorial government. The employee said they could not return to work in Nunavut for medical reasons, while the government was unwilling to offer permanent out-of-territory employment.
The commissioner noted the case represented another example of privacy legislation becoming “a proxy battleground for the GN’s labour relations” but emphasized the privacy issue could be addressed separately from the broader employment dispute.
While finding HR had legitimate reasons to collect the employment information under territorial privacy law, the commissioner concluded the method of collection violated legal requirements.
Policy review recommended
Rather than prescriptive remedies, the commissioner recommended HR review its policies and procedures to ensure compliance with section 41(2). The department was also advised to circulate a memo to all staff who collect personal information, informing them of the ruling and legal standards.
The commissioner noted this was the first time section 41(2) had been substantively addressed during the current five-year term, calling it “a healthy reminder to public bodies that they need to explain what they are doing.”
The decision emphasized that while HR wanted to maintain a professional tone given relationship tensions, this goal “cannot override the requirements of section 41(2).”
The ruling found no privacy breach in HR’s attempt to collect relevant employment information, but concluded the department’s vague explanation of its purpose failed to meet territorial privacy law standards for transparency and accountability.
For more information, see Department of Human Resources (Re), 2025 NUIPC 13 (CanLII).
