THE EMPLOYERS' EDGE
Supreme Court of Canada Finds Reasonable Expectation of Privacy for Employees on Employer-Issued Technology
In our April 19, 2011 blog we addressed the Ontario Court of Appeal’s decision in R. v. Cole, a decision which provided some guidelines to employers on the monitoring of the use of employer-owned technology by employees. This morning, the Supreme Court of Canada (the “SCC”) released its decision in R. v. Cole, allowing the appeal and providing further clarification on employees’ reasonable expectations of privacy in respect of personal information stored on employer-issued computers.
Mr. Cole was a high school teacher who was charged with possession of child pornography and the unauthorized use of a computer after a technician found nude photographs of an underage female student on his employer-issued laptop. The technician advised the school board and made copies of the photographs and other data. The principal handed the laptop and copies of the data to the police. The police reviewed the materials without a warrant and arrested Mr. Cole.
At trial, Mr. Cole asked the court to exclude the evidence obtained by the police because his Charter rights were violated. The court agreed with Mr. Cole and excluded the materials. On summary conviction appeal the court reversed the trial judge’s decision, finding no Charter breach. The Court of Appeal set aside that decision and excluded some, but not all of the materials, and ordered a new trial.
On a further appeal to the SCC, the majority of the Court (Abella J. dissenting) found that although the school board had the lawful authority to seize and search Mr. Cole’s laptop, that same lawful authority did not extend to the police. However, although the SCC found that the materials were illegally seized and searched, it concluded that the admission of the materials would not bring the administration of justice into disrepute, and therefore the evidence should not be excluded. The SCC sent the matter back to trial.
Of interest to employers is the SCC’s discussion of an employee’s reasonable expectation of privacy with respect to data stored on employer-issued computers. The Court found that Canadians enjoy a constitutional entitlement to privacy in personal information stored on computers if the information is meaningful, intimate and touching on one’s biographical core. This is true whether the computers are personally-owned or employer-issued.
While workplace policies and practices may diminish an individual’s expectation of privacy in respect of a work computer, the SCC noted that they do not remove the expectation entirely. The reasonable expectation of privacy depends on the materials at issue, whether the user actually expected privacy with respect to the materials and whether it was reasonable for the user to expect privacy.
In Mr. Cole’s case, the SCC determined that personal data was at issue and that Mr. Cole expected privacy with respect to the data, otherwise he would not have browsed the internet and stored personal materials on the laptop. In determining whether it was reasonable for Mr. Cole to expect that the materials would remain private, the Court noted that the more personal and confidential the information stored, the more reasonable the expectation of privacy. Although the school board’s policy asserted ownership over the hardware and the data stored on it, and Mr. Cole was advised by the school board not to expect privacy in files stored on the school board’s laptop, the ownership of the property is not determinative of objective privacy expectations. The “operational realities”, or customs of the school as a workplace allowed Mr. Cole to use his work-issued laptop for personal purposes, essentially modifying the school board’s policies. The SCC concluded that Mr. Cole had an objective reasonableness to expect privacy with respect to the data stored on his work-issued computer, although that expectation of privacy was a bit diminished in light of the school’s policies.
The message the SCC is sending to employers is that having a policy with respect to technology use is not enough. What courts will look at is what actually takes place at the workplace on a day-to-day basis. If an employer allows for “some personal use”, then employees would have a reasonable expectation of privacy with respect to personal information stored on employer-issued hardware, including files stored, internet browsing history and metadata. However, if a strict policy of computer use is accompanied by a strict application of it, employees are less likely to have a reasonable expectation of privacy to personal information that may be stored on the employer’s computers. Allowing or even just condoning personal use and storage of data on work computers, even to a limited extent, may create such an expectation that is likely to be upheld by decision makers.
Please Note: This blog has been prepared as an informational service for our clients and other interested parties. It is not intended to constitute legal advice, a complete statement of the law or opinion on any subject. Although we endeavour to ensure the accuracy of the content, no one should act upon the information provided without a thorough examination of the law after the facts of a specific situation are fully considered.