In the spring of 2020, the Black Lives Matter movement sparked conversations around the world about systemic racism and unconscious bias. Businesses have been re-evaluating their diversity, equity and inclusion (DEI) polices and taking a hard look at what their own data says about their role in reducing – or perpetuating – the inequalities faced by marginalized groups.
Many businesses are conducting DEI surveys to gather demographic information and adopt more robust DEI policies. In these surveys, employees are asked how they self-identify in questions about gender identity, preferred pronouns, sexual orientation, race, ethnic/cultural origin, religious/spiritual affiliation, disabilities, family status, and if they are Indigenous, to name a few. In an increasingly data-driven world, results from DEI surveys can reveal valuable information about an organization and can inform future decision-making. However, businesses may wonder if their attempt to advance DEI initiatives through these surveys exposes them to any legal risks with respect to their privacy or employment law obligations.
Privacy considerations
DEI surveys capture sensitive personal information. Under Canadian employment privacy laws, businesses can collect this type of information with express, informed consent and voluntary, opt-in participation from employees. Organizations must provide employees with specific information, including their purposes for collecting data. Businesses that use third party service providers outside of Canada may need to comply with additional notification requirements.
Data security is an essential issue to consider and appropriately address when collecting information through DEI surveys. Businesses can mitigate this risk by implementing stringent data security measures. They should consider limiting access to identifiable data to a small group of individuals within the organization who have a (strictly construed) “need-to-know” as well as technical security measures such as pseudo anonymization and encryption. If businesses wish to report or share aggregate data from their DEI surveys, whether internally or externally, they should establish a process to protect against the inadvertent inclusion of identifying information in reports. Businesses should also consider data retention, as Canadian employment privacy laws set out limitations on how long organizations can retain personal information.
Employment considerations
Businesses may seek to use the information gathered from DEI surveys to make hiring, promotion and advancement decisions aligned with their employment equity objectives. This is generally permissible, as Canadian human rights laws provide specific carve-outs for programs aimed at advancing the interests of historically disadvantaged groups.
For example, under the British Columbia Human Rights Code, is not discrimination to implement an employment equity program that has the objective of ameliorating conditions of disadvantaged individuals or groups if that program achieves or is reasonably likely to achieve that objective. Similarly, the Ontario Human Rights Code provides that it is not discrimination to implement a special program designed to relieve hardship or economic disadvantage, assist disadvantaged individuals or groups to achieve or attempt to achieve equal opportunity, or eliminate discrimination.
As a best practice, organizations should develop formal programs, rather than simply use a set of priorities to inform decisions on an ad hoc basis. Human rights legislation in both British Columbia and Ontario sets out that organizations can apply to the human rights commissions for an approval or designation of a program. An approval or designation is not required, but it is evidence under the human rights legislation that the program is not discriminatory. While an approval or designation may be extremely useful if the organization ever faces a discrimination complaint, in reality, it may be difficult to obtain. Some human rights commissions have not established formal processes in which to approve or designate these programs even though their constituent statutes contemplate them.
Of course, as much as organizations can use the data collected by DEI surveys to advance diversity, equity and inclusion in the workplace, even a decision-maker’s knowledge of a characteristic that causes an employee to be disadvantaged can raise questions about the bona fides of a decision. This is all the more reason to limit access to identifiable DEI data to those with a strict “need-to-know” (typically excluding line management) and to use DEI data for decision-making purposes pursuant to a formal program.
Conclusion
As DEI initiatives become increasingly important to today’s businesses and consumers, organizations are embracing DEI surveys and the valuable information they can provide. As long as businesses satisfy their privacy obligations and meet the affirmative action exceptions provided under Canadian human rights laws, data from these surveys can be collected and used for DEI initiatives. Demographic data can reveal historic patterns and trends within organizations. It can also be utilized to disrupt these patterns and trends in future decisions and succession planning.
The authors would like to thank Danielle Windt for her contribution in writing this article.
BLG has a team of lawyers with expertise in labour and employment and cybersecurity, privacy, and data protection and we regularly advise clients on these matters. For assistance, please reach out to one of our key contacts shown below.
