Can My Employer Monitor My Work Email and Computer Use in Canada?

Generally yes, but how far your employer can go, and what legal limits apply, depends entirely on which privacy law covers your workplace. No single Canadian law bans employer monitoring of work email or computers. Instead, three separate frameworks can apply, and they land very differently depending on whether you work for a federally regulated business, an Ontario employer, or an Alberta employer.

Which privacy law applies to your workplace

The starting point is figuring out which statute, if any, governs your employer’s collection of your monitoring data.

Federally, PIPEDA (the Personal Information Protection and Electronic Documents Act, Canada’s private-sector privacy law) applies to employee personal information only where the employer is a “federal work, undertaking or business” under section 4(1)(b), meaning banks, airlines, telecoms, and other federally regulated industries. For the vast majority of provincially regulated employers, including most businesses in Ontario and Alberta, the Privacy Commissioner confirms that PIPEDA simply does not apply to employee information at all.

Alberta and British Columbia stepped in with their own private-sector privacy statutes, deemed “substantially similar” to PIPEDA, which is why federally regulated employers aside, Alberta employers are governed by Alberta’s own law rather than PIPEDA. Ontario has never enacted an equivalent private-sector statute. That gap matters: it means Ontario private employers face only a narrow, transparency-focused rule under the Employment Standards Act, plus whatever the common law provides, rather than a substantive privacy statute.

Ontario’s transparency rule doesn’t limit monitoring itself

In Ontario, employers with 25 or more employees on January 1 of any year must have a written policy on electronic monitoring in place before March 1 of that year, covering whether and how the employer monitors employees electronically.

That requirement is about disclosure, not restriction. The Employment Standards Act is explicit that nothing in the electronic monitoring section limits an employer’s ability to use information obtained through monitoring. An employer can lawfully monitor extensively as long as the policy says so.

The complaint process is correspondingly narrow. An employment standards officer can only investigate a failure to provide the written policy within the required timeframes; any other complaint about the substance or scope of the monitoring itself cannot be investigated under this provision.

Alberta’s PIPA puts real limits on what can be collected

Alberta takes a substantively different approach. Under the Personal Information Protection Act, an employer may collect personal employee information without consent only for reasonable purposes related to recruiting, managing, or terminating personnel, which constrains monitoring in a way Ontario’s transparency-only rule does not.

Before disclosing a current employee’s personal employee information to a third party, Alberta’s PIPA also requires the employer to give the employee reasonable notice of the disclosure and its purposes. More broadly, any collection of personal information by an Alberta organization, including data generated by monitoring, must be for reasonable purposes and limited to what is reasonably needed for that purpose.

The common-law backstop that applies everywhere

Even where no privacy statute directly restricts monitoring (as in most Ontario workplaces), courts have recognized limits rooted in common law and constitutional reasoning that can be persuasive across Canada.

The Supreme Court of Canada held in R v Cole that computers reasonably used for personal purposes, whether at work or at home, contain information “meaningful, intimate, and touching on the user’s biographical core,” and that Canadians may reasonably expect privacy in that information where personal use is permitted or expected. The Court also made clear that a workplace monitoring policy is not automatically determinative; courts weigh the totality of the circumstances. Cole was a criminal case and binds government actors directly, so for private employers its reasoning is persuasive rather than binding, but it shapes how Canadian courts think about workplace privacy generally.

In Ontario specifically, the Court of Appeal in Jones v Tsige recognized a common law tort of intrusion upon seclusion, which can provide a remedy where an intrusion into highly personal information would profoundly disturb a reasonable person in the employee’s position.

What you can do if monitoring feels excessive

The practical options differ by what triggered the concern:

1. Check whether a written policy exists and what it discloses. In Ontario, if your employer has 25 or more employees and has no policy, or missed the March 1 deadline, that specific failure can be raised with the Ministry of Labour under the Employment Standards Act.
2. In Alberta, assess whether the collection was tied to a reasonable purpose. PIPA’s reasonable-purpose and reasonable-extent limits give Alberta employees a substantive basis to question monitoring that goes beyond managing, recruiting, or terminating personnel, unlike Ontario’s disclosure-only rule.
3. Consider whether the intrusion was into genuinely private information. Where monitoring captured highly personal content unrelated to work, the reasoning in Jones v Tsige (Ontario) and R v Cole may support a claim, though these are common-law routes rather than a regulator complaint.
4. Identify whether your employer is federally regulated. If so, PIPEDA’s consent-based framework and the Privacy Commissioner’s findings on unacceptable covert monitoring may give you a stronger, statute-based avenue.