Recent Decision on Privacy and Use of Workplace Computers
On Friday, October 19, 2012, the Supreme Court of Canada issued its decision on R. v. Cole. [If you would like to read the full case, please refer to the following link to this Case]
BACKGROUND: The case involved a high school teacher who had stored a nude picture of an underage female student on his school-owned laptop computer. Shortly after the IT administrator found the picture file when conducting a routine search for viruses, the teacher was required to hand over the laptop to the school principal. The school then turned the laptop over to police, who subsequently charged the teacher with possession of child pornography. No search warrant was obtained, because the computer belonged to the school, not the teacher.
In issue was whether the teacher had a reasonable expectation of privacy and whether the ownership of the laptop was sufficient to conduct a search and seizure without a warrant (presumably in breach of the teacher’s Charter rights).
DECISION: The majority of the Supreme Court of Canada decided that both home and workplace computers that are used for personal purposes contain information “that is meaningful, intimate, and touching on the user’s biographical core.” On that basis, employees should be able to expect some reasonable degree of privacy when personal use of employer-owned computers is allowed.
The Court noted that while ownership of the computer is a “relevant consideration”, that does not fully decide the issue of an employee’s expectation of a right to privacy. Similarly, while the employer’s workplace policies on employee use of the employer’s computers, networks and email may also be relevant, these policies would only diminish (but not eliminate) an employee’s reasonable expectation of privacy. On that basis, a “reasonable though diminished expectation of privacy is nonetheless a reasonable expectation of privacy.”
The following excerpts provide important comments from the Supreme Court of Canada around the employer-employee privacy issues (Note: underlines provided for emphasis only, and do not appear in the original decision):
“The context in which personal information is placed on an employer-owned
computer is nonetheless significant. The policies, practices, and customs of the
workplace are relevant to the extent that they concern the use of computers by
employees. These “operational realities” may diminish the expectation of privacy
that reasonable employees might otherwise have in their personal information.”
“Even as modified by practice, however, written policies are not determinative of a
person’s reasonable expectation of privacy. Whatever the policies state, one must
consider the totality of the circumstances in order to determine whether privacy is
a reasonable expectation in the particular situation.”
In this case, the operational realities of Mr. Cole’s workplace weigh both for and
against the existence of a reasonable expectation of privacy. For, because written
policy and actual practice permitted Mr. Cole to use his work-issued laptop for
personal purposes. Against, because both policy and technological reality deprived
him of exclusive control over — and access to — the personal information he chose
to record on it.
As mentioned earlier, the Policy and Procedures Manual stated that the school
board owned “all data and messages generated on or handled by board equipment".
Moreover, the principal reminded teachers, annually, that the Acceptable Use Policy
applied to them. This policy provided that “[t]eachers and administrators may
monitor all student work and e-mail including material saved on laptop hard
drives”, and warned that “[u]sers should NOT assume that files stored on network
servers or hard drives of individual computers will be private”.
The “totality of the circumstances” consists of many strands, and they pull in
competing directions in this case. On balance, however, they support the objective
reasonableness of Mr. Cole’s subjective expectation of privacy.
The nature of the information in issue heavily favours recognition of a
constitutionally protected privacy interest. Mr. Cole’s personal use of his work-
issued laptop generated information that is meaningful, intimate, and organically
connected to his biographical core. Pulling in the other direction, of course, are the
ownership of the laptop by the school board, the workplace policies and practices,
and the technology in place at the school. These considerations diminished Mr.
Cole’s privacy interest in his laptop, at least in comparison to the personal
computer at issue in ‘Morelli’, but they did not eliminate it entirely.
The fact that the school board had acquired lawful possession of the laptop for its
own administrative purposes did not vest in the police a delegated or derivative
power to appropriate and search the computer for the purposes of a criminal
CONCLUSION: It is clear that employers who have comprehensive workplace policies and practices that reserve the right to ‘search’ employer-owned computers, emails and networks for improper activities or content remains a crucial requirement for justifying any electronic ‘searches.’ However, it is only relevant and not determinative of the employee’s reasonable expectation of privacy when personal use of internet, email and computer equipment or networks are permitted through either practice or policy. Employers should review and update their workplace policies and practices to ensure that they are compliant with the latest approach by the courts.
[Note: this case dealt with the application of the Charter of Rights and Freedoms arising from a criminal investigation involving search and seizure by the police. Generally, non-government organizations are not subject to the Charter’s reach, so much of the discussion in the case around the employee’s Charter rights would not apply. Many of the comments about employees’ privacy rights are in this context, and may have limited application to your particular situation. If you are unsure whether your organization falls within the normal reach of the Charter of Rights and Freedoms, you should seek legal advice.]
The Labour and Employment Practice Group at McDougall Gauley LLP regularly advises clients on the establishment and administration of organizational policies that include use of the employer’s computers, networks and email systems.
The views expressed herein are solely the author's and should not be attributed to the MG LLP or its clients. Any postings on legal issues are provided as a public service, and do not constitute solicitation or provision of legal advice. The author makes no claims, promises or guarantees about the accuracy, completeness, or adequacy of the information contained herein or linked to. Due to professional ethics, the author may not be able to comment on matters in which a client has an interest. Nothing herein should be used as a substitute for the advice of competent and informed counsel.
This web site/blog is presented for informational purposes only. These materials do not constitute legal advice and do not create a solicitor-client relationship between you and MG LLP. If you are seeking specific advice related to your situation, please contact MG LLP for a personal consultation.
Any unsolicited information sent to MG LLP through blogs or otherwise may not be protected by solicitor-client privilege.
MG LLP periodically provides materials on our services and developments in the law to interested persons. For permission to reprint articles or blogs, please contact firstname.lastname@example.org.