Quebec's privacy regulator puts spotlight on employee hiring practices

At a glance

• The Quebec privacy regulator (CAI) has been active, publishing decisions and guides on biometric technologies, signalling a new phase following privacy law amendments.
• New guidelines emphasise the necessity of collecting personal information only when required for hiring and obtaining explicit consent for reference checks and other evaluations.
• Employers should avoid consulting candidates' social media profiles and using psychological or psychometric tests due to privacy concerns.
• Employers must inform candidates about AI use in hiring processes and conduct data privacy impact assessments to minimise risks.
• Collection of medical information should be limited to what is necessary for evaluating job-related skills, to avoid discrimination complaints.
• When using third party recruitment services, the CAI reminds employers that they ultimately retain responsibility for the personal information that is collected by third parties engaged in the recruitment process on their behalf.

---

Over the course of the past several weeks, the CAI has been very active, publishing several key decisions concerning the implementation of biometric technologies. This increased level of activity by the regulator signals that we have entered a new phase following sweeping amendments to privacy legislation in the province over the past several years. The recent decisions issued by the CAI, as well as its publication of various guides on topics of interest, come as a welcome development for companies operating in Quebec, as well as for privacy professionals looking to gain clarity on the practical implementation of some of the requirements introduced in the context of the modernisation of the province’s privacy legislation.

On 17 March 2025, the CAI published guidelines on the collection of personal information by employers or by third-party service providers for the purposes of evaluating candidates for employment and making hiring decisions (Hiring Guidelines). More recently, on 29 March 2025, the president of the CAI, in conjunction with the Commission des droits de la personne et des droits de la jeunesse (the body responsible for upholding the application of human rights legislation in Québec), published an open letter reminding companies of the importance of upholding fundamental rights — including privacy and protection from discrimination — in hiring processes.

These developments signal that this topic has been identified as a priority by Québec authorities. Businesses operating in Québec should therefore expect their hiring practices to be placed under increased scrutiny in the coming months.

In this article, we summarise the key takeaways for employers and third-party recruitment services engaged in the collection of personal information during the hiring process.

The obligation to demonstrate the necessity of collection

The CAI has once again seized this opportunity to remind businesses subject to Québec laws that the predominant question must always be whether the collection of personal information is necessary for achieving the purposes for which it is being collected. If necessity cannot be demonstrated, the collection of that personal information is prohibited, even if the candidate may have consented to providing that information. As such, while certain information such as name, contact information and professional qualifications will be necessary for evaluating a candidate’s suitability for employment, the collection of certain other information may only become necessary once the candidate has been presented with a conditional offer of employment. This would include information such as social insurance number, date of birth, banking details or information concerning beneficiaries. Where there is a doubt, information is deemed to be non-necessary. It is interesting to note that in the Hiring Guidelines, the CAI has divided the hiring process into several distinct steps insisting on the importance of minimising data collection at each stage of the process, in addition to only requesting additional information as it becomes necessary once the individual advances through the various stages of the hiring process.

Reference checks

The CAI has taken the position that requesting references and the subsequent verification of those references should only be done after a candidate has been presented with a conditional offer of employment. When checking references, the information collected must be limited to what is necessary for evaluating whether the candidate meets the essential requirements of the role.

We would have assumed previously that a candidate voluntarily providing references on an application may have been sufficient to demonstrate implied consent to contact those individuals for the purposes of evaluating a job application. The CAI has now said that explicit consent must be sought from candidates before contacting their references.

In this same vein, prior to engaging in credit or bankruptcy checks, or other checks which are meant to verify the reputation or personality of a candidate, the employer must obtain express consent. If the objective is to verify a candidate’s personality or character, the CAI recommends favouring reference checks over credit checks.

Social media

The CAI has issued another important reminder that although candidates may have publicly accessible social media profiles, consulting them represents an unjustified intrusion on privacy rights and is to be avoided. Once again, the employer must always adhere to the necessity principle when collecting personal information.

The reasoning for the CAI’s position on this issue has long been to the effect that the personal information accessible on these profiles are, in principle, not relevant for the purposes of evaluating a candidate’s professional competencies and should therefore not form part of the candidate’s file. Notably, the CAI reminds employers that this information may be inexact, obsolete or unrelated to the professional competencies of the candidate, which diminishes the reliability and pertinence associated with that information for hiring purposes.

Psychological and psychometric tests to be avoided

In the Hiring Guidelines, the CAI has also advised against the use of psychological and psychometric tests as these present specific concerns with respect to protecting the privacy rights of candidates who are subject to them. These types of tests should be reserved for special situations where their relevance is undeniable.

Where such tests are used, the CAI underscores the importance for employers to exercise caution and rigor, paying particular attention to the scientific validity of the method used and to defining objective criteria for their use. Caution must also guide the analysis of the results, given these outputs are often driven by algorithms that lack transparency. Furthermore, these types of tests should never be substituted in for questions directly related to job requirements during the interview.

Using AI in the hiring process

As a reminder, Quebec’s Act respecting the protection of personal information in the private sector requires employers to inform the persons concerned when decisions are made exclusively based on the automated processing of personal information, including via artificial intelligence systems. While the legal requirement is that the use of automated processing be disclosed no later than at the time the decision is rendered, the Hiring Guidelines go further by recommending that candidates be proactively informed at the outset of the hiring process when artificial intelligence is being used.

The CAI also reminds employers of the obligation to conduct a data privacy impact assessment before resorting to the use of AI systems in the hiring process. The purpose of this impact assessment is to anticipate and minimise potential risks to candidate privacy by ensuring that the use of AI is proportionate and respectful of individual rights to privacy.

In addition, the CAI has cautioned employers on the use of AI systems which are designed to evaluate the emotional or psychological state of candidates during video interviews. These technologies are likely to be disproportionate when weighing the employer’s needs against the privacy rights of the individuals concerned.

The collection of medical information

Being that medical information is highly sensitive and confidential; the collection of such information must be strictly limited to what is necessary to evaluate the aptitudes or skills required for the specific position. An unjustified collection of this information could be considered illegal and constitute grounds for a discrimination complaint. As such, medical information should only be collected in exceptional circumstances and only where necessity has been clearly established, which would generally be limited to cases where there are specific requirements for the position in question, or in the context of an accommodation request.

The employer remains responsible for its use of third-party recruiters

When using third party recruitment services, the CAI reminds employers that they ultimately retain responsibility for the personal information that is collected by third parties engaged in the recruitment process on their behalf. Employers should therefore be setting out clear requirements and expectations for any third-party service providers and ensure that these criteria have been memorialised in a written agreement between the parties.

A special note for placement agencies

In addition to the obligations which apply to all employers, placement agencies have additional transparency and protection of privacy obligations regarding candidates. First, they must inform candidates of the identity of the potential employer as soon as possible during the recruitment process. However, in situations where the employer wishes to remain anonymous in the initial stages of the recruitment process, the agency must advise candidates and explain to them that their candidacy will be considered on an anonymous basis at that stage of the process.

In addition, the CAI insists on the importance of placement agencies providing detailed information to candidates on the ways in which their personal information will be used throughout the hiring process. In the event the agency intends to hold on to candidate personal information for secondary uses (such as to consider suitability for other jobs), express consent must be sought from the candidates before retaining their personal information for those purposes.

Best practice recommendations

These Hiring Guidelines constitute a key resource outlining considerations related to the protection of personal information. While these Hiring Guidelines are not law, they do detail the CAI’s expectations, which is important given the CAI’s role as the body overseeing compliance with applicable privacy legislation in Quebec. Points of particular importance to that should be considered by employers are as follows.

• Develop an applicant privacy policy which is distinct from an employee privacy policy, and which is tailored to specific considerations related to the collection, use and disclosure of personal information at the pre-hire stage.
• Tailor requests for personal information to each position to mirror the personal information that is required to be collected for evaluating suitability for that specific role – if personal information is not necessary for those purposes, then do not ask for it.
• The implementation of AI and other technologies in the hiring process gives rise to special considerations which should be accounted for prior to implementation.
• Abstain from consulting social media profiles; the fact the information has been made public does not give a potential employer the right to indiscriminately consult that information.
• If using third parties in your hiring practices, ensure that they are abiding by all applicable privacy laws; third-party failures or negligence in that regard may ultimately fall back on the employer.

The CAI’s Hiring Guidelines are available here (in French only).

Our employment and data privacy teams are well-equipped to assist you with elaborating hiring practices which comply with the requirements of Quebec law. We invite you to contact one of the authors of this article for any further support that you may need in this area.