Employers may think the pandemic is long behind them. It isn't — not from a legal standpoint at least.

Its most enduring legacy is a transformed workplace, where privacy law is about to explode.

With hybrid work entrenched and employees scattered between boardrooms and bedrooms, many companies have turned to surveillance software — key-stroke loggers, screen trackers, and webcam monitoring — to keep tabs on productivity. Even some divisions of the federal government are now electronically tracking where their employees are during the workday.

It may seem harmless enough. But in law, it's a potential powder keg.

Every week, I hear from employers frustrated that remote workers are less accountable, less productive or harder to supervise. Their instinct is to install digital oversight tools — a virtual version of walking the factory floor. Yet those same tools could land businesses before human rights tribunals, labour boards and the courts.

Canadian privacy law has lagged badly behind technological reality. For years, it focused on protecting consumers' data. But now those statutes are colliding head-on with employers' desire to monitor their own workforce. When those instincts meet, it's usually the employer who loses.

Under Canadian law, workplace monitoring isn't inherently unlawful. The test is whether the surveillance is reasonable, proportionate and transparent. That is where most employers fail.

An employer must have a legitimate business purpose — protecting security, verifying productivity or preventing fraud. "Curiosity" doesn't count. Employees must also be clearly told what data is collected, how it will be used and how long it will be kept.

Secret surveillance, unless justified by specific suspicion of serious misconduct, is generally prohibited. In some provinces — notably Quebec, Alberta and British Columbia — privacy commissioners have already ruled that covert monitoring violates personal information statutes. Ontario's recent Bill 88 requires employers to publish written policies disclosing any electronic monitoring, although it stops short of restricting it.

Despite these legal restrictions, too many companies act as though their workers' laptops are extensions of the corporate server room. They are not. When an employer installs keystroke-logging software or tracks logins without disclosure, they are not merely potentially crossing an ethical line — they may be venturing into a privacy breach, a constructive dismissal claim or a human rights claim.

The irony is that employers often collect surveillance data hoping to defend themselves, only to discover it cannot be used.

Arbitration boards, and even some courts, have rejected evidence obtained through unlawful or excessive monitoring. In some cases, they have gone further, awarding moral or punitive damages for bad-faith conduct. What begins as an effort to discipline an underperforming employee can morph into a lawsuit the employer cannot win.

The reputational fallout can be just as damaging. No company wants to see its name in headlines for "spying" on employees — especially in professional environments where trust is a currency of its own.

The legal danger is only half the story. The other is cultural.

In a post-pandemic world, employees view privacy not as a perk but as a right. They have spent years working from home without supervision. To suddenly be monitored feels not only invasive but insulting — a signal that their employer doesn't trust them.

Just today, as I am writing this, I had one employee–client tell me that they considered their employer's request for evidence to support a medical-accommodation request to not work Fridays an insulting lack of trust.

And mistrust, once sown, rarely stays contained. It spreads quickly through the workplace, eroding morale and loyalty faster than any pay dispute.

The smartest companies are recognizing that you can't monitor your way to productivity. You can only lead your way there.

The law may still be catching up, but prudent employers need not wait for the courts. They can protect themselves now by following five simple rules:

• Put it in writing: Publish a clear electronic monitoring policy explaining what is tracked, when and why.
• Limit the scope: Collect only what is necessary for a defined business purpose.
• Disclose everything: Transparency is your best legal defence. Surprises are your worst.
• Stay off personal devices: Monitoring anything beyond company-issued equipment invites privacy complaints.
• Audit regularly: Technology evolves faster than law. Review your policies annually and update them as tools change.

The cost of compliance is a few paragraphs in a policy manual. The cost of secrecy could be six figures in damages and your company's name in a precedent-setting decision.

The last decade of employment law revolved around termination clauses and severance. The next may revolve around privacy. The question will no longer be what employers pay when they fire someone, but what they can see, collect and record while that person is still employed.

In the coming years, I expect privacy to become a defining employment issue in Canada. The courts will have to reconcile two competing truths: that employers have a right to manage their business and employees have a right not to be treated like suspects in their own homes.

Until then, the rule is simple: If you would not follow an employee home to watch what they are doing, think hard about whether you will let your software do it for you.

Handled prudently, workplace monitoring is a management tool. Handled carelessly, it's a lawsuit waiting to happen.

Howard Levitt is senior partner of Levitt LLP, employment and labour lawyers with offices in Ontario, Alberta and British Columbia. He practices employment law in eight provinces and is the author of six books, including the Law of Dismissal in Canada.