Introduction
On March 17, 2025, Quebec's Commission d'accès à l'information (CAI) published comprehensive guidelines on the collection of personal information during hiring processes. These guidelines represent a significant shift in how employers operating in Quebec must approach recruitment and candidate evaluation, placing strict limitations on the collection and use of personal information. For HR professionals and business leaders, understanding these changes is crucial to maintaining compliance and avoiding potential legal issues.
Key Provisions of Quebec's New Hiring Guidelines
The Necessity Principle
At the core of Quebec's new hiring guidelines is the "necessity principle," which states that employers may only collect personal information that is demonstrably necessary for evaluating a candidate's suitability for employment. This represents a higher standard than merely obtaining consent - even if a candidate consents to providing certain information, employers cannot collect it unless they can prove it's necessary for the hiring decision.
For example, while collecting information about professional qualifications and work experience is justified, collecting personal details such as social insurance numbers, banking information, or date of birth should be delayed until a conditional offer has been extended.
Reference Checks
The CAI has taken a firm position that reference checks should only be conducted after a conditional offer of employment has been presented to a candidate. Furthermore, explicit consent must be obtained before contacting references, even if candidates voluntarily provided reference information during the application process.
When conducting reference checks, employers must limit their inquiries to information necessary for evaluating whether the candidate meets the essential requirements of the position.
Social Media Screening
Perhaps most notably, the CAI explicitly advises against consulting candidates' social media profiles, considering it an "unjustified intrusion on privacy rights." The CAI's position is that information available on social media profiles is generally not relevant to evaluating professional competencies and should not be part of the candidate evaluation process.
The guidelines specifically note that information found on social media may be inaccurate, outdated, or unrelated to professional abilities, diminishing its reliability and relevance for hiring purposes.
Psychological and Psychometric Tests
The CAI recommends against the routine use of psychological and psychometric tests, stating that these should be reserved for special situations where their relevance is "undeniable." When such tests are used, employers must:
- Ensure the scientific validity of the testing methods
- Define objective criteria for their use
- Exercise caution in analyzing results, particularly when algorithms are involved
- Never substitute these tests for direct questions related to job requirements
AI in Hiring
While Quebec law already requires disclosure when decisions are made exclusively based on automated processing of personal information, the CAI's guidelines go further by recommending that candidates be proactively informed at the beginning of the hiring process if AI will be used.
Additionally, employers must conduct data privacy impact assessments before implementing AI systems in their hiring processes. The CAI specifically cautions against using AI to evaluate candidates' emotional or psychological states during video interviews, considering such technologies likely "disproportionate" to employers' legitimate needs.
Implications for Employers
Immediate Compliance Steps
- Review and audit current hiring practices to identify areas where personal information collection exceeds what is necessary for evaluating candidates.
- Update privacy policies and consent forms to reflect the new guidelines and ensure transparency about information collection practices.
- Train recruitment and HR staff on the new requirements, particularly regarding the limitations on social media screening and reference checks.
- Document necessity assessments for all personal information collected during the hiring process to demonstrate compliance if questioned.
- Implement phase-based information collection that aligns with different stages of the hiring process, collecting more sensitive information only after conditional offers.
Broader Strategic Considerations
Beyond immediate compliance, these guidelines signal a shift in how privacy is conceptualized in employment contexts. Even for employers outside Quebec, these guidelines may represent an emerging trend toward stricter protection of candidate privacy rights.Organizations should consider:
- Developing standardized interview procedures that focus on job-related competencies rather than personal characteristics
- Reviewing third-party recruitment service agreements to ensure vendor compliance with privacy regulations
- Implementing privacy-by-design principles in recruitment technologies and processes
- Creating transparent communication channels with candidates about how their information will be used
At Talencore, we help small and medium-sized businesses navigate complex HR compliance requirements like Quebec's new privacy guidelines. Our boutique operational model allows us to quickly adapt to regulatory changes, providing practical solutions rather than theoretical guidance.
We've developed compliant recruitment templates with phase-based information collection, privacy-focused ATS implementation, proper consent mechanisms for reference checks, and targeted compliance audits to identify privacy gaps. For organizations without dedicated privacy teams, our services offer peace of mind that your hiring practices remain both compliant and effective at identifying the best candidates.
Special Considerations for Different Organization Types
Placement Agencies
The CAI guidelines impose additional requirements on placement agencies, including:
- Disclosing potential employer identities to candidates as early as possible
- Providing detailed information about how personal information will be used
- Obtaining express consent before retaining candidate information for consideration for other positions
Companies Using Third-Party Recruiters
The guidelines emphasize that employers retain ultimate responsibility for personal information collected on their behalf by third parties. Organizations using external recruitment services should:
- Set clear expectations regarding information collection practices
- Document these requirements in formal agreements
- Regularly audit compliance with privacy standards
Conclusion
Quebec's new hiring guidelines represent some of the most stringent privacy protections for job candidates in North America. By prioritizing data minimization, necessity, and transparency, these regulations fundamentally reshape how organizations approach the recruitment process.
While compliance may require significant adjustments to existing practices, working with experienced HR partners like Talencore can streamline the transition and ensure your hiring processes remain both compliant and effective. We stay at the forefront of regulatory changes to provide clients with practical, timely guidance on evolving HR compliance requirements.
As privacy regulations continue to evolve across jurisdictions, Quebec's approach may serve as a model for other regions, making proactive compliance an investment in future-proofing your hiring practices. Whether you need comprehensive HR support or targeted guidance on privacy-compliant recruitment, Talencore is here to help your organization navigate this changing landscape.