Last Updated: March 2026
PIPA and Employer Surveillance: Privacy Law for WCB Investigations in BC
BC’s Personal Information Protection Act (PIPA) is the privacy law that governs how private-sector organizations, including employers and private investigation firms, collect, use, and disclose personal information. When an employer commissions surveillance of a worker who has filed a WorkSafeBC claim, that surveillance is a collection of personal information subject to PIPA. If the collection is not conducted in compliance with the Act, the evidence may be ruled inadmissible, the employer may face a complaint to the Office of the Information and Privacy Commissioner (OIPC), and the worker gains additional grounds for a prohibited action complaint.
This page explains the specific PIPA provisions that apply to employer-commissioned investigations, the OIPC reasonableness standard that determines whether surveillance is lawful, the boundaries between public and private space, and how PIPA intersects with the Workers Compensation Act to create a dual compliance requirement for every WCB claim investigation. The information on this page is intended as a general reference and is not a substitute for legal advice specific to your situation.
In This Article
- What Is PIPA and Why Does It Apply to WCB Investigations?
- Section 12(1)(c): The Legal Foundation for Covert Surveillance
- Section 13: Employee Personal Information Rules
- Section 14: The Reasonable Purpose Requirement
- The OIPC Reasonableness Standard
- Public vs. Private Space: Where Surveillance Is Lawful
- Audio Recording and the Criminal Code
- PIPA vs. FIPPA: An Important Distinction
- How PIPA and the Workers Compensation Act Interact
- What Happens If PIPA Is Violated?
- FAQ: Privacy Law and WCB Investigations
What Is PIPA and Why Does It Apply to WCB Investigations?
The Personal Information Protection Act (SBC 2003, c. 63) came into force on January 1, 2004, and governs how private-sector organizations in British Columbia collect, use, and disclose personal information. It applies to all private-sector employers in BC and to any private investigation firm they retain. PIPA is enforced by the Office of the Information and Privacy Commissioner for BC (OIPC).
When an employer commissions a private investigator to conduct surveillance of a worker, the investigator is collecting personal information about that worker, such as video footage, photographs, location data, observations of physical activity, and potentially audio recordings. All of this is personal information under PIPA, and the collection must comply with the Act.
The general rule under PIPA is that an organization must obtain an individual’s consent before collecting their personal information. Surveillance of a WCB claimant is, by definition, conducted without the claimant’s consent. This means the collection must fall within one of PIPA’s specific exceptions to the consent requirement, and the most relevant exception for claim investigations is Section 12(1)(c).
Section 12(1)(c): The Legal Foundation for Covert Surveillance
Section 12(1)(c) of PIPA permits an organization to collect personal information about an individual without consent if two conditions are both met:
- Consent would compromise the information: It is reasonable to expect that collection with the consent of the individual would compromise the availability or the accuracy of the personal information.
- The collection is reasonable for an investigation: The collection is reasonable for an investigation or a proceeding.
Both conditions must be satisfied simultaneously. In the context of a WCB claim investigation, the first condition is typically straightforward. If you tell a worker you are conducting surveillance, they will modify their behaviour, making the evidence useless. The second condition is where most of the legal analysis occurs: is this specific surveillance, in these specific circumstances, reasonable for this specific investigation?
“Reasonable for an investigation” does not mean “any investigation for any reason at any scale.” It means the surveillance must be a proportionate response to a legitimate investigative need, supported by documented reasonable suspicion, and conducted in a manner consistent with the OIPC’s reasonableness standard.
Section 13: Employee Personal Information Rules
PIPA contains special provisions for “employee personal information,” which is defined as personal information collected, used, or disclosed solely for purposes reasonably required to establish, manage, or terminate an employment relationship.
Two subsections are particularly relevant to WCB claim investigations:
Section 13(2) provides that an organization may collect employee personal information without consent if Section 12 allows it, or if the collection is reasonable for the purposes of establishing, managing, or terminating an employment relationship. This means that even outside the Section 12(1)(c) investigation exception, employers have some latitude to collect employee information for employment management purposes, but the collection must still be reasonable.
Section 13(3) normally requires an employer to notify an employee before collecting personal information about them and to inform them of the purposes for the collection. This notification requirement would, on its face, appear to prevent covert surveillance. However, Section 13(4) creates a critical exception: the notification requirement does not apply when Section 12 allows collection without consent. This means that if the Section 12(1)(c) threshold is met, consent would compromise the evidence, and the collection is reasonable for an investigation, the employer does not need to notify the worker of the surveillance.
This chain of provisions is what makes lawful covert surveillance of a WCB claimant legally possible under PIPA: Section 12(1)(c) permits collection without consent, and Section 13(4) exempts that collection from the notification requirement.
Section 14: The Reasonable Purpose Requirement
Section 14 provides an overarching standard that applies to all use of personal information: an organization may use personal information only for purposes that a reasonable person would consider appropriate in the circumstances. This “reasonable person” standard applies even when the collection itself was lawful under Section 12.
In practical terms, this means that even if surveillance evidence was lawfully collected, using it for purposes that a reasonable person would consider inappropriate, such as sharing footage with co-workers, posting it publicly, using it to embarrass or humiliate the worker, or using it for purposes unrelated to the investigation, would violate Section 14. The evidence must be used solely for the purpose for which it was collected: assessing whether the worker’s functional capabilities are consistent with their reported limitations.
The OIPC Reasonableness Standard
The OIPC evaluates the reasonableness of personal information collection through a multi-factor analysis established through its orders and investigation reports. The leading precedents for private-sector surveillance are Order P12-01 (Schindler Elevator Corporation, 2012) and Order P20-04 (Re Teck Coal Limited, 2020). Investigation Report P17-01 (2017), which addressed body-worn employee surveillance by a BC organization, further reinforced the OIPC’s position that surveillance should be a “last resort.”
When evaluating whether surveillance was reasonable, the OIPC considers the following factors:
Purpose of the Collection
Is there a genuine, specific, documented reason for the surveillance? The purpose must be tied to verifying a particular suspected inconsistency between the worker’s claimed limitations and their actual behaviour. A generalized concern about claim costs, a vague suspicion, or a desire to “see what the worker is up to” does not satisfy this factor.
Amount of Information Collected
Is the scope of surveillance proportionate to the suspected activity? Multi-week, full-time surveillance for a minor inconsistency is disproportionate. A targeted surveillance window that focuses on the times and locations where the suspected activity is most likely to occur demonstrates proportionality. The amount of information collected should match the scale of the concern.
Sensitivity of the Information
Does the surveillance intrude into areas of heightened privacy expectation? Observing a worker in a public park is less sensitive than observing them inside a medical appointment. The more sensitive the context, the stronger the justification must be.
Likelihood of Effectiveness
Is the surveillance method reasonably likely to produce the information being sought? The investigative plan should be rationally connected to the evidence being sought while specifically documenting the claimant’s observable physical capabilities and daily activity as they relate to their reported limitations.
Detailed schedule intelligence is often not available when surveillance is first commissioned. The employer or insurer may have a confirmed address and a reported injury with specific functional restrictions, but limited information about the claimant’s daily routine, vehicle, or patterns of activity. In these circumstances, initial surveillance periods commonly serve the dual purpose of establishing baseline information, such as identifying vehicles, confirming the claimant’s presence at the address, and determining their general pattern of activity, while also documenting any observable physical capability relevant to the claim. This is a standard and accepted investigative approach, not a deficiency in the file.
As the investigation progresses, subsequent surveillance periods can be refined based on what the initial coverage revealed, making each deployment more targeted. What becomes harder to justify under PIPA’s reasonableness standard is surveillance that continues over an extended period without producing any observations relevant to the reported limitations, or surveillance that has no rational connection to the specific functional restrictions documented in the claim.
Whether Less Intrusive Alternatives Exist
Were less invasive measures considered or attempted before deploying surveillance? The OIPC has consistently held that surveillance should be a “last resort” after less privacy-invasive alternatives have been explored. This does not mean every alternative must be exhausted, but the employer must be able to articulate why alternatives were insufficient or inappropriate. Common alternatives include social media review, direct inquiry, requests for updated medical documentation, and Functional Capacity Evaluations. For the full escalation framework, see our knowledge page on reasonable suspicion and less intrusive alternatives.
These five factors are not applied as a checklist where each must be independently satisfied. They are weighed together as a holistic assessment. Strong performance on most factors can compensate for a weaker showing on one, but a failure to address any factor entirely creates a vulnerability.
Public vs. Private Space: Where Surveillance Is Lawful
The distinction between public and private space is fundamental to PIPA-compliant surveillance. The boundary determines what an investigator can lawfully observe and record.
Generally Permissible
- Observation and recording of the subject in public places, such as streets, sidewalks, parking lots, parks, commercial establishments open to the public, recreational facilities, and similar venues
- Recording of the subject on their own property where they are visible from a public vantage point. For example, a subject working in their open driveway or front yard that is visible from the street
- Observation at public events, outdoor sports fields, open markets, and other venues accessible to the general public
High Risk or Prohibited
- Recording through windows into a private residence
- Recording over fences into private backyards or enclosed areas
- Recording inside medical facilities, therapy offices, or counselling offices, or positioning to capture information about the nature of a claimant’s treatment or medical providers
- Recording in any location where there is a reasonable expectation of privacy, such as washrooms, change rooms, hotel rooms, enclosed private yards
- Following a subject so closely or persistently that it constitutes harassment or intimidation
- Trespassing on private property to obtain a vantage point
- Using drones without required Transport Canada authorization and a privacy impact assessment
The grey area between public and private space requires judgment. A subject who is visible from the street while working in their front yard is in a less private setting than one who is in a fenced backyard. A subject entering a public gym is in a less private setting than one entering a counsellor’s office. Professional investigators understand these boundaries and make real-time decisions about what can and cannot be captured based on the specific circumstances.
Audio Recording and the Criminal Code
While PIPA governs the collection of personal information, the Criminal Code of Canada (Section 184) governs the interception of private communications. These are separate legal frameworks that apply simultaneously.
Under Section 184(1), it is a criminal offence to knowingly intercept a private communication using any electromagnetic, acoustic, mechanical, or other device. The penalty can be up to five years’ imprisonment. However, Section 184(2)(a) creates an exception: the prohibition does not apply to a person who has the consent, express or implied, of one of the parties to the communication.
In standard passive surveillance, the investigator is observing from a distance and is not a party to any conversation. They cannot lawfully record private conversations between the subject and other individuals because they are not a participant. This is why Shadow Investigations’ standard surveillance protocol does not include audio recording of private conversations.
The one exception arises in undercover pretext operations, where the investigator is a direct participant in the conversation. In that case, the investigator’s own consent satisfies the one-party consent requirement, and recording the interaction is lawful under the Criminal Code. However, the recording must be active only while the investigator is a participant. If the investigator steps away from the conversation, the recording must stop.
PIPA vs. FIPPA: An Important Distinction
British Columbia has two separate privacy statutes, and they are frequently confused:
- PIPA (Personal Information Protection Act) governs private-sector organizations, such as employers, private investigation firms, businesses, and non-profit organizations.
- FIPPA (Freedom of Information and Protection of Privacy Act) governs public bodies, such as government agencies, municipalities, school boards, health authorities, and similar entities.
The rules under each statute are different. FIPPA has stricter requirements in some areas, including mandatory privacy impact assessments and different legal authorities for collection. In January 2026, the OIPC released updated public-sector surveillance guidelines under FIPPA. These guidelines apply to public bodies, not to private-sector employers or private investigation firms.
While the FIPPA guidelines provide useful analogous reasoning about proportionality and necessity, they should not be confused with the PIPA requirements that govern employer-commissioned investigations. When assessing the legality of a WCB claim investigation commissioned by a private employer through a private investigation firm, the applicable statute is PIPA, not FIPPA. This distinction matters because referencing the wrong legal framework in a compliance argument can undermine the employer’s position.
How PIPA and the Workers Compensation Act Interact
WCB claim investigations are subject to two parallel legal frameworks simultaneously. PIPA governs how the investigation is conducted (what information can be collected, how, and under what conditions), while the Workers Compensation Act (Division 6, Sections 47–50) governs why the investigation was initiated and how the results are used.
A PIPA violation can compound a prohibited action complaint. If a worker files a prohibited action complaint and can also show that the investigation violated PIPA, for example, by being disproportionate, conducted in private spaces, or lacking documented reasonable suspicion, this strengthens the argument that the investigation was retaliatory rather than investigative. Conversely, a well-documented investigation that clearly meets the PIPA reasonableness standard provides evidence that the investigation was a professional, proportionate response to legitimate concerns, supporting the employer’s defense under the reversed burden of proof.
This dual compliance requirement is why the investigation must be planned and documented carefully before it begins. PIPA compliance and Workers Compensation Act compliance are not separate tasks, they are two sides of the same defensibility standard.
What Happens If PIPA Is Violated?
If the OIPC determines that an investigation violated PIPA, the consequences can be significant:
- Evidence inadmissibility: Evidence gathered in violation of PIPA may be challenged or excluded in a subsequent proceeding at WorkSafeBC, WCAT, or in court. If the evidence is the foundation of the employer’s case, losing it can be fatal to the employer’s position.
- Cessation order: The OIPC can order the organization to stop collecting the personal information.
- Destruction order: The OIPC can order the destruction of personal information that was collected in violation of the Act.
- Publication of findings: OIPC investigation reports and orders are published and become public record. A finding against an employer or investigation firm creates reputational risk and sets precedent for future cases.
- Strengthened prohibited action complaint: A PIPA violation provides the worker with additional evidence that the investigation was unreasonable, disproportionate, or conducted in bad faith, all of which support a prohibited action argument under the Workers Compensation Act.
The cost of a PIPA violation extends well beyond the OIPC proceeding itself. It can undermine the employer’s entire case, including the evidence, the defense against a prohibited action complaint, and the credibility of the investigation as a whole.
Frequently Asked Questions
Yes, under specific conditions. PIPA Section 12(1)(c) permits collection of personal information without consent when consent would compromise the evidence and the collection is reasonable for an investigation. Section 13(4) waives the notification requirement when Section 12 applies. Both conditions must be met, and the surveillance must satisfy the OIPC’s multi-factor reasonableness standard.
The OIPC evaluates five factors: the purpose of the collection (is there a genuine, documented reason?), the amount of information collected (is the scope proportionate?), the sensitivity of the information (does it intrude into heightened privacy areas?), the likelihood of effectiveness (is the method rationally connected to the evidence being sought?), and whether less intrusive alternatives were available and considered. These factors are weighed together holistically.
Not during standard passive surveillance. Under the Criminal Code (Section 184), it is a criminal offence to intercept a private communication without the consent of one of the parties. A PI observing from a distance is not a party to the subject’s conversations. The exception is during undercover pretext operations, where the PI is a direct participant in the conversation and their own consent satisfies the one-party consent requirement.
Generally no. A fenced backyard is considered a private space where the occupant has a reasonable expectation of privacy. Filming over fences or through barriers into private areas is a high-risk PIPA violation. If the subject is visible from a public vantage point, such as an unfenced yard visible from the street, observation may be permissible, but the circumstances require careful judgment.
PIPA governs private-sector organizations (employers, businesses, PI firms). FIPPA governs public bodies (government agencies, municipalities, health authorities). The rules are different. Private-sector WCB claim investigations are governed by PIPA, not FIPPA. The OIPC’s 2026 public-sector surveillance guidelines apply to FIPPA, not PIPA, and should not be confused with the requirements for private-sector investigations.
The evidence may be challenged or excluded in proceedings. The OIPC can order cessation of collection, destruction of the information, and publication of findings. A PIPA violation also strengthens any prohibited action complaint the worker may file, because it provides evidence that the investigation was disproportionate or conducted in bad faith.
Yes. The OIPC has consistently described surveillance as a measure that should be deployed after less privacy-invasive alternatives have been explored. You are not required to exhaust every possible alternative, but you must consider them and document why they were insufficient or inappropriate. Going directly to surveillance without considering or documenting alternatives creates vulnerability on two fronts: under PIPA, the collection may be found to be disproportionate and therefore unauthorized; and under the Workers Compensation Act, the lack of a measured, escalating approach weakens the employer’s defense if a prohibited action complaint is filed.
Related Knowledge Pages
- Injury Claim Investigations in BC Guide (Pillar Page)
- Prohibited Action Complaints in BC: What Every Employer Must Know
- Reasonable Suspicion: What BC Employers Need Before Hiring a PI
- Undercover and Pretext Investigations for WCB Claims in BC
- SHA-256 Hashing and Digital Chain of Custody
References and Regulatory Resources
- BC Personal Information Protection Act (PIPA) – Full Text
- Office of the Information and Privacy Commissioner for BC (OIPC)
- OIPC Guidance Document: Employee Privacy Rights (2017)
- OIPC Investigation Report P17-01: Employee Surveillance (2017)
- Criminal Code of Canada – Section 184 (Interception of Private Communications)
- Workers Compensation Act – Division 6 (Sections 47–50)
Need a PIPA-Compliant Investigation?
Shadow Investigations conducts every WCB claim investigation in compliance with PIPA, the Workers Compensation Act, and OIPC guidance. Our intake process verifies reasonable suspicion before deployment, our surveillance is limited to public spaces with proportionate scope, and all evidence is verified through SHA-256 cryptographic hashing to ensure an immutable chain of custody. Contact us by phone at 604-657-4499 or through the form below. All consultations are free and confidential.
Contact Form for Investigation Inquiries
"*" indicates required fields
About the Author
