Canadian employees have limited protections against monitoring in the workplace.

      TD's plan to monitor certain employees has highlighted a legal deficiency: in much of Canada, employers can observe staff and are required to provide little more than a notification. When the Toronto-Dominion Bank informed some employees that software would soon be monitoring their work, they reacted as most would in such situations. They inquired about what exactly would be tracked, whether the data could be used against them, and if they had any input in the matter. Unfortunately, the uncomfortable reality in much of Canada is that the law offers them minimal power to object.

      This action by the bank, reported exclusively by Reuters earlier this month, affected employees in its financial-crimes and risk-management divisions. They were informed that TD would implement a tool named WorkiQ to monitor how they utilized their time across web browsers, internal messaging, meeting applications, and other work-related software. During the call, employees raised valid concerns regarding privacy, the tool's data collection specifics, and whether this data would influence performance evaluations.

      TD characterized the initiative as “standard practice across the industry,” claiming it employs automated tools in various business areas to enhance insights and allocate resources. There was another, more concerning aspect; according to an internal memo reviewed by Reuters, TD initially intended to gather employees' mouse movements, keystrokes, and other actions as training data for artificial intelligence but reduced that plan after receiving significant pushback from staff.

      This situation mirrors what has been occurring at Meta, which implemented a program to capture keystrokes and mouse clicks on employee computers for AI training but paused the tool in June following data-security concerns. The emerging trend in workplace monitoring involves not just evaluating productivity but also collecting work habits as data for model development.

      What distinguishes the Canadian situation is the legal void surrounding it. The federal privacy law, PIPEDA, does not extend to provincially regulated employers in provinces without similar laws, including Ontario, home to a large portion of the financial sector. In these provinces, employee protections are derived from a mix of employment standards regulations, common-law privacy torts, contracts, workplace policies, and, where applicable, collective agreements. There is no singular statute that an employee can cite to assert that monitoring has gone too far.

      Ontario has taken the most significant steps of any province, albeit modest ones. Since October 2022, employers with 25 or more employees must have a written policy detailing whether and how they monitor employees electronically. However, the law's language presents a limitation. It mandates disclosure but does not impose restrictions. Employers must inform workers of their monitoring practices, but workers do not gain any new rights to object, limit surveillance, or exclude data from performance reviews. Simply notifying employees of their monitoring does not equate to safeguarding their rights.

      The disparity with Europe is stark. The EU’s data-protection framework introduces the principle of purpose limitation, which states that data collected for one purpose cannot be repurposed for another without appropriate justification. Transforming employees' routine digital activities into AI training data directly contradicts the principles established by European regulations. A worker in Ontario lacks any equivalent protections.

      This situation does not make TD an exception. Employee monitoring expanded rapidly during the remote-work era, and banks, given their compliance obligations, have even more motivation to track employee activities. The technology has evolved faster than the regulations designed to govern it, and in much of Canada, those regulations were never particularly robust.

      For the employees involved in the TD call, the current reality is that how much of their workday is considered their employer's domain largely rests with the employer.