A request for personal information arrived on the desk of the human resources director at a mid-sized software development company based in the lower mainland of British Columbia. The request came from a senior developer who had worked for the organization for 7 years and who had recently been placed on a performance improvement plan following concerns raised by her team lead about productivity and collaboration. The employee's written request cited her rights under British Columbia's Personal Information Protection Act and asked for copies of all personal information the company held about her, including performance evaluations, internal communications referencing her, any monitoring data collected from company systems, and medical documentation she had submitted over the years in connection with accommodation requests.
The human resources director recognized that responding to this request would require the organization to confront how it had managed employee information since its founding 12 years earlier. The company had grown from a 5-person startup to an operation employing 87 staff across 3 offices, accumulating personnel files, digital records, and system-generated data without a consistent framework for organizing or retaining that information. Over the years, the organization had implemented various monitoring tools on company devices and networks, including software that logged application usage, tracked keystroke patterns during work hours, and captured screenshots at intervals throughout the day. The employee's request would require disclosure of what these systems had collected about her specifically, raising questions about whether the monitoring had been implemented with appropriate notice and consent.
The situation grew more complex when the human resources director discovered that 4 months earlier, a departing employee in the IT department had inadvertently exposed a folder containing personnel records for 23 current and former staff members to an external cloud storage service during a system migration. The breach had been identified and contained within 48 hours, but no formal breach response protocol had been followed, no affected individuals had been notified, and no report had been made to the Office of the Information and Privacy Commissioner. The senior developer's file was among those exposed.
The company's executive team now faced overlapping obligations under provincial privacy legislation. They needed to respond to the access request within the statutory timeframe, determine what notification and reporting duties arose from the earlier breach, and assess whether their existing policies and practices around employee information collection, monitoring, and retention could withstand regulatory scrutiny. The organization had no dedicated privacy officer and had never conducted a formal audit of its HR information practices.