Ontario Municipal Human Resources Association

In 2025, “service transformation” in the municipal sector is inextricably linked to “digital transformation.” From AI-driven recruitment platforms to geolocation data in public work fleets, municipalities are evolving into sophisticated, data-driven enterprises.

At the heart of this evolution is human resources (“HR”). While IT departments focus on the technical capability of these new tools, it is HR that understands the human and legal implications of their deployment. You successfully led your organization through the initial rollout of Electronic Monitoring Policies under the Employment Standards Act, 2000 (“ESA”), in the wake of the COVID-19 pandemic, bringing necessary transparency to the workplace. Now, as the digital landscape shifts again, HR is uniquely positioned to lead the next phase: moving from simple transparency to substantive privacy governance.

The real challenge—and the real opportunity for HR leadership—lies in navigating the intersection of the Municipal Freedom of Information and Protection of Privacy Act (“MFIPPA”) and the emerging legislative guardrails around Artificial Intelligence (“AI”).

The ESA as a Foundation

For the past few years, HR departments have done the heavy lifting to ensure compliance with the ESA’s transparency requirements.

However, sophisticated HR professionals recognize that the ESA only requires transparency—it requires you to disclose monitoring, but it does not legally validate it. A monitoring practice that is “transparent” under the ESA can still be “unreasonable” under privacy laws.

Disclosing a new sentiment-analysis AI tool in your policy does not automatically protect the municipality from a grievance. This is where HR’s expertise becomes vital. By applying the “reasonableness” test found in arbitral jurisprudence (balancing the employer’s business interest against the employee’s privacy), HR ensures that digital tools are not just compliant, but defensible.

Bill 149 and Bill 194

The landscape has become significantly more complex in late 2024 and 2025 with the introduction of targeted legislation. HR is increasingly the primary line of defence against these new liabilities.

1. AI in Recruitment (Bill 149):

With the Working for Workers Four Act, 2024 (“Bill 149”), the province has regulated the use of AI in hiring. As municipalities turn to automated systems to screen the flood of applications, HR must ensure these tools comply with the new requirement to disclose AI used in publicly advertised job postings. This will be a requirement for every posting as of January 1, 2026. But your role goes deeper: you are also tasked with ensuring against bias in any algorithms that may be used. HR knows that if an AI tool inadvertently screens out candidates based on postal code or gap years (proxies for race or gender), the municipality faces human rights exposure regardless of the technology used.

2. Public Sector Governance (Bill 194):

The Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (“Bill 194”) signals a paradigm shift, emphasizing robust governance over AI. “Shadow IT”—where departments sign up for online tools without vetting—is a significant compliance risk. HR is often the first to spot these tools when they impact workflow, making you the critical early warning system for the organization.

Privacy Impact Assessments (PIAs)

How does HR support service transformation while managing these risks? By asserting ownership over the Privacy Impact Assessment (PIA) process.

In 2025, PIAs are strategic HR tools. Before any new workforce management technology is procured, HR should ask the tough questions that vendors often gloss over:

1. MFIPPA requires that you only collect personal information if it is “necessary” for a lawfully authorized activity. HR is best placed to determine if a specific data point is actually needed to manage employment.
2. Is there a less intrusive way to achieve the management goal? HR understands the nuance of workplace culture better than an algorithm does.
3. Who owns the data? Many AI vendors act as “vacuums,” using municipal data to train their own models. HR protects the municipality by ensuring our employee data serves us, not the vendor’s commercial interests.

Conclusion

As municipalities race to modernize, the pressure to adopt the latest digital tools is immense. HR’s role is not to slow this progress, but to secure it. By leveraging your knowledge of the ESA, MFIPPA, and the new AI legislation, you are safeguarding the organization against privacy concerns that accumulate when technology outpaces policy.

Written By: Jordan Bailey, Zubas Flett Liberatore Law LLP