Ontario has no general private-sector privacy statute covering employee information held by provincially regulated employers, and some employers conclude they can disclose freely. That is risky. The Court of Appeal recognized the tort of intrusion upon seclusion in Jones v. Tsige, 2012 ONCA 32, and listed financial records among the matters it protects. Ontario employers should obtain written consent anyway and reconcile figures with the records kept under section 15 of the Employment Standards Act, 2000.
British Columbia regulates the point directly. Section 19 of the Personal Information Protection Act permits disclosure of employee information without consent only for purposes reasonable to the employment relationship, and a third-party verification request does not qualify. Complaints go to the Office of the Information and Privacy Commissioner, and payroll records under section 28 of the Employment Standards Act remain the reference point for every figure.
Alberta follows the same model. Section 21 of the Personal Information Protection Act limits disclosure of personal employee information without consent to managing the employment relationship, and the Information and Privacy Commissioner of Alberta enforces it. The figures in the letter should match the payroll records required by section 14 of the Employment Standards Code.
Quebec works on a civil law foundation. Article 2096 of the Civil Code of Québec and section 84 of the Act respecting labour standards entitle a departing employee to a work certificate that may not comment on the quality of the work or the employee's conduct. That rule targets end-of-employment certificates, but applying the same restraint to a current employee's letter is sound practice. Consent must meet section 14 of the Act respecting the protection of personal information in the private sector, which means a separate, specific request for each recipient.
Federally regulated employers apply Part III of the Canada Labour Code for employment standards and PIPEDA for employee privacy. Banks and interprovincial carriers therefore work from one federal framework, whichever province the employee is in. Complaints go to the Office of the Privacy Commissioner of Canada.