It is broadly speaking not legal. Many lawsuits spiralled out of this. In the broadest settlement, workers were entitled to $2,500 in general damages plus any out-of-pocket costs & losses incurred due to this clusterfuck including "a compensation process for severe impacts such as ruined credit ratings, accumulated interest on loans or credit cards, loss of security clearance due to bankruptcy, mental anguish and trauma, or loss of savings from cashing in investments such as RRSPs to pay debts". There's still other lawsuits ongoing.