Law 25 and Human Resources: What Changes for Employee Information

Employees generate a large volume of personal information: social insurance number, medical records for disability claims, performance reviews, time tracking data, work emails, browsing history, workplace accident files. Law 25 applies to all of this and imposes obligations on HR departments that go beyond what most SMEs have in place.

This guide summarizes the key Law 25 obligations in an HR context: what can be collected, how to keep it, how to govern electronic monitoring, how to handle biometrics, and how section 12.1 on automated decisions applies to AI-powered HR tools.

The Starting Principle: An Employee Is a Concerned Person

Under Law 25, an employee is a concerned person in their own right. The information the employer holds about them is personal information within the meaning of the Act. That status triggers all the usual principles:

Purpose: the collection must be justified by a clear purpose (employment contract, payroll, performance management, legal obligations)
Minimization: only the information necessary for the purpose may be collected
Consent: except for legal exceptions (contractual obligations, legal requirements, legitimate interest), free and informed consent is required
Retention period: keeping the information is limited by the fulfillment of the purpose
Security: reasonable measures must protect the files
Access and rectification rights: the employee can ask to consult and correct their file

These principles interact with other laws: the Act respecting labour standards, the Labour Code, the Act respecting industrial accidents and occupational diseases, and the Civil Code of Quebec (sections 35 to 41 on the right to privacy). Where conflicts arise, the protections most generous to the employee generally prevail.

What You Can Collect (and What You Cannot)

At Hiring

At the recruitment stage, collection is strictly limited to what is necessary to assess the application. The following are generally justified:

Contact information
Resume and relevant experience
Professional references (with prior consent of the candidate)
Relevant diplomas and certifications
Work permit if applicable

The following are rarely justified at this stage:

Social insurance number (request only after the offer is accepted, for payroll)
Criminal record (unless the nature of the role objectively justifies it)
Medical information (unless required by the nature of the role)
Family situation information
Biometric data

An application form that asks for age, marital status, or medical history without specific job justification is problematic.

During Employment

Once a person is in the role, collection is justified by the nature of the employment contract and legal obligations. The following are generally justified:

Complete payroll data (SIN, banking information, deductions)
Attendance and absence records
Performance reviews
Training completed
Workplace accident or occupational disease file (special framework under workplace safety legislation)
Emergency contact information

The guiding principle remains minimization: do not collect more than necessary for the stated purpose.

Job Applications Not Retained

The information of unsuccessful candidates must be destroyed or anonymized after a reasonable retention period. For most organizations, 6 to 12 months is enough to respond to a possible complaint or challenge.

Electronic Monitoring at Work

This is the most visible Law 25 issue in modern workplaces. Electronic monitoring includes:

Video surveillance of work areas
GPS tracking of company vehicles
Productivity tracking software (clicks, applications, websites visited)
Monitoring of work email
Reading of professional instant messages (Teams, Slack)
AI tools that analyze performance from observed behavior

Each of these forms of monitoring involves continuous collection of personal information. They trigger Law 25 obligations and are also governed by the Civil Code of Quebec (sections 35 to 41) protecting privacy.

For electronic monitoring to be defensible, the organization must generally show:

A legitimate purpose (physical security, asset protection, legal obligations)
Proportionality between the monitoring and the purpose
Transparency: employees must be informed in advance
Minimization: the scope and duration of monitoring must be limited
The absence of less intrusive means to achieve the purpose

A written electronic monitoring policy, communicated to all employees, is essential. It should specify what is monitored, how, for what purposes, and who has access to the collected data.

Biometric Data: A Special Regime

Fingerprints, facial recognition, voice recognition, and other biometric data are considered sensitive personal information. Their use in the workplace (time tracking, facility access, identification) is governed by the Act to establish a legal framework for information technology in addition to Law 25.

To use biometric data:

The person's consent is in principle required
A declaration to the CAI is required when setting up a biometric database
A PIA is generally needed
Stronger security measures are expected
The use must be proportional: if another means achieves the purpose, it must be preferred

For most SMEs, badge-based time tracking remains simpler and less risky than biometrics.

Automated Decisions in HR (Section 12.1)

Several modern HR tools use AI to screen candidates, evaluate performance, or identify employees at risk of leaving. When the final decision is made exclusively by the system (without meaningful human intervention), section 12.1 of Law 25 applies.

The organization must then:

Inform the person that the decision is based exclusively on automated processing
Allow the person to know the personal information used
Allow the person to understand the main factors and parameters
Allow the person to present observations to a staff member with authority to review the decision

In practice, most SMEs should avoid 100% automated decisions in HR. Keeping a human in the loop avoids strict application of section 12.1 and reduces the risk of algorithmic discrimination. The reviewer must actually examine each recommendation before applying it; clicking "approve" without examination does not count.

Employee Right of Access to Their File

Under Law 25, an employee can ask to consult the personal information the employer holds about them. The organization has 30 days to respond.

The right of access generally extends to:

The employee file held by HR
Performance reviews
Work emails the employer has archived
Notes taken during internal investigations (with some restrictions)
Electronic monitoring data concerning the employee

Some elements may be restricted, for example information concerning a third party (a colleague), preliminary evaluation notes, or information protected by professional secrecy. Any restriction must be justified in writing.

Retention and Destruction After Departure

At the end of the employment relationship, some documents must be kept to meet legal obligations:

Tax records: 6 years (Income Tax Act)
Workplace accident records: according to the deadlines in the workplace safety legislation
Reviews and disciplinary letters: 3 to 5 years according to civil prescription and the nature of the facts

Information that no longer has a legitimate purpose must be destroyed or anonymized. Keeping the entire file of a former employee indefinitely is not justified.

How Observantia Supports HR

Observantia centralizes the retention schedule for employee files, the register of incidents involving HR information, and the documentation of PIAs completed for HR tools (assessment software, payroll platforms, monitoring systems). The dashboard helps the privacy officer and HR director coordinate their obligations. Start your 14-day free trial.

This content is provided for informational purposes only and does not constitute legal advice. For questions specific to your situation, consult a qualified legal professional.