Plenty of careers pages were put together in an afternoon, from a form template or an applicant tracking system left on its default settings. They ask for a date of birth "for our records", a photo "to put a face to the name", and a yes/no question about criminal records. When we review a small business's website security and compliance, the careers form is often the chattiest form on the site.
Hiring is where Law 25 meets Quebec's Charter of human rights and freedoms. The first tells you what you may collect, and when; the second, what you may neither ask nor hold against anyone. And the most serious risk often comes less from artificial intelligence than from a plain knockout question that has been live for years.
The short answer, for the busy
In Quebec, an employer may collect from a job applicant only the information necessary for the current stage of hiring (sections 4 and 5 of the Act respecting the protection of personal information in the private sector), and the Commission d'accès à l'information says the applicant's consent does not change that. When applications come in, a name, contact details and a resume are enough: date of birth, social insurance number and photo wait until hiring, and section 18.1 of the Quebec Charter bars asking about age on an application form, with narrow exceptions. References, credit reports and criminal record checks come after a conditional offer, with the applicant's consent, preferably in writing. Section 18.2 of the Charter forbids refusing someone over an offence unconnected with the job or pardoned. And software that rejects an application with no human involved renders an automated decision: section 12.1 requires telling the applicant and offering a review by a staff member.
The form asks too much, and consent doesn't fix it
Section 4 of the Act requires a business to determine the purposes of collection before collecting. Section 5 limits collection to "only the information necessary for the purposes determined before collecting it". In hiring, the purpose changes from stage to stage, and so does what is necessary.
The Commission d'accès à l'information (CAI), Quebec's privacy regulator, says it plainly on its page about recruitment (in French; our translation): "even if an applicant consents to provide information that is not necessary, the employer is not entitled to collect it." An "I agree" checkbox under a superfluous field settles nothing.
At the application stage, the CAI lists contact details, education and work history, skills and interests, which a resume already holds. A more detailed form built for a regulated position should not be reused for every job, and references come after interviews.
Three fields keep showing up on careers pages.
Date of birth. Age is a prohibited ground under section 10 of the Charter, and section 18.1 bars requiring information about those grounds "in an employment application form or employment interview", unless it serves a job requirement (section 20) or an affirmative action program. The employer guide Recruter sans discriminer from the Commission des droits de la personne et des droits de la jeunesse (CDPDJ) accepts the question when a law sets a minimum age for the job, or to run a criminal record check. Outside that last case, says the CAI, date of birth waits until hiring.
Social insurance number. Tax law requires the employer to collect it, but the CAI says it is not needed at any stage before hiring. An online form that asks every applicant for it piles up SINs the business had no right to receive.
Photo. The CDPDJ lists asking for a photo with the application, or before an interview, among practices to avoid. A photo can be requested after hiring, for identification: see photo consent for employees and, if the access badge turns biometric, workplace biometrics.
Same logic at the interview: the CAI allows looking at an ID card, not photocopying it, photographing it or writing its numbers into the file.
References, credit, social media: after the offer, with written consent
Section 6 requires collecting information from the person concerned, unless they consent to collection from third persons. Calling a former boss is collecting from a third person.
The CAI sets out the sequence: make a conditional job offer first, then get the applicant's consent to the checks, "through a signed form, for example", stating why they are necessary for this job and which third parties will be contacted. Section 14 requires consent that is clear, free, informed, given for specific purposes and presented separately. Our consent form examples show the format.
For credit reports, the CAI requires consent and prefers references for judging honesty. For social media, it recommends staying away, except for a spokesperson or political staff, and then with consent.
Criminal records: an assessment, not a checkbox
Section 18.2 of the Charter reads: "No one may dismiss, refuse to hire or otherwise penalize a person in his employment owing to the mere fact that he was convicted of a penal or criminal offence, if the offence was in no way connected with the employment or if the person has obtained a pardon for the offence." A pardon is now called a record suspension.
The CDPDJ guide insists that the link between an offence and a job "is not automatic and each situation must be analyzed individually" (our translation). It gives the example of two people with a theft record, in two casinos. Firing a slot machine attendant who handled cash in unmonitored areas was found consistent with the Charter; firing a dealer who handled only chips and cards, under cameras, was not.
The guide suggests asking whether the applicant has been convicted of a penal or criminal offence connected with the job for which they have not obtained a record suspension. On the privacy side, the CAI requires the check to match a specific job requirement, with prior consent when it goes through the police, and bars filing an offence that is unconnected or pardoned.
The knockout question is already an automated decision
This is where the form meets section 12.1. A business that renders "a decision based exclusively on an automated processing" of personal information must tell the person no later than when it informs them of the decision, and let them submit observations to a staff member "in a position to review the decision". The details are in our article on automated decisions.
Applicant tracking systems offer knockout questions. In Workable, a "No" to a yes/no question can disqualify the applicant automatically; the applicant still gets a confirmation email and "does not know that they have been disqualified", and the activity log names no user because "this is a system-generated action". In Recruitee, a knockout answer can trigger an automatic rejection email, and the help page suggests scheduling it "with a short delay, rather than sending it immediately".
No AI involved. Yet in our reading, a rejection nobody looked at is a decision based exclusively on automated processing, and the CAI's own example is the automatic rejection of applications by sorting software. On the same reading, the delay does not change what the rejection is, and an email that suggests a person read the file runs opposite to the notice section 12.1 requires.
The worst case combines this section and the previous one: a knockout question asking "Do you have a criminal record?". It rejects without the case-by-case assessment the Charter requires. The fix is simple: route knockout answers to a "to review" pile that a person actually opens before any rejection goes out.
AI screening: announced up front, assessed before purchase
The CAI recommends telling applicants "from the start of the process" that AI is used to sort or assess applications. Before using it, the employer must carry out a privacy impact assessment, as section 3.3 requires for any project to acquire an information system. Our privacy impact assessment generator produces that document.
We also read a tool that scores resumes as profiling under section 8.1, which defines it as assessing a person's characteristics, "in particular for the purpose of analyzing that person's work performance". The applicant must then be informed beforehand. The CAI goes further on emotion recognition systems in video interviews, which it considers very unlikely to be proportionate to the employer's needs.
AI screening also comes in through the side door: a manager pasting twenty resumes into a personal ChatGPT account to get a ranking. That is shadow AI, and exactly the case an AI use policy has to settle.
Your hiring software is your mandatary
The CAI says that when an employer works with a third party, it "remains legally responsible" for the personal information processed (our translation). Section 18.3 lets you hand applications to a vendor without applicants' consent, through a written mandate that sets confidentiality measures, limits use to the mandate and bars keeping the data after it ends: see the vendor contract. If the servers are outside Quebec, section 17 adds an assessment before the transfer: see AI agents hosted outside Quebec.
For unsuccessful applicants' resumes, our article on data retention applies to the copy your software keeps as well.
Where to start
Open your application form and justify each field for the application stage. Remove what belongs to hiring. List your knockout questions and check which ones send a rejection with no human look. Prepare a consent form for checks, separate from the offer. Add a sentence to the job posting saying whether an AI tool sorts applications, and how to ask for a review.
We build careers pages that ask only for what is needed, and AI agents that sort applications while leaving the decision to a person. We can also review your form or your hiring software's settings.
→ Let's talk about your hiring process
This article explains legal obligations to help a small business ask the right questions; it is not legal advice. The text of Quebec's Act respecting the protection of personal information in the private sector and Charter of human rights and freedoms, the pages of the Commission d'accès à l'information and the CDPDJ, and your software's documentation as of the date you read them prevail: for a specific situation, consult a lawyer or a certified HR professional.
Written byXavier Peich