Employees May Have Limited Reasonable Expectation of Privacy In Work Computer
Published:
November 28, 2012
On October 19, 2012 the Supreme Court of Canada (SCC) decided a teacher criminally charged with possession of child pornography and unauthorized use of a computer had a reasonable – though diminished – expectation of privacy in Internet files containing pornographic images on his work-issued laptop computer. The Court found that the employer’s workplace policies, procedures and technology did reduce employees’ privacy expectations, but did not eliminate it. On balance, the “totality of the circumstances” supported the objective reasonableness of the teacher’s expectation of privacy in the Internet images, although he had no expectation of privacy in the nude pictures of a student stored on the laptop. The police had thus breached the teacher’s right to be free from unreasonable search and seizure under section 8 of the Charter of Rights and Freedoms (Charter) when it searched the computer without a warrant. Despite this, the Court found the evidence should be admitted in the teacher’s criminal trial.
Based on this decision, employers wishing to eliminate or severely limit employees’ expectation of privacy in their use and contents of work-issued laptops and other electronic devices must:
- Promulgate policies covering use of e-mails and social networking in the workplace, clearly stating that no personal usage is permitted and that the employer will monitor all employee usage.
- Rigorously implement these policies, including ensuring employees are well aware of and fully understand them, and stringently enforce the policy by monitoring and auditing usage as warranted.
The Case
In R. v. Cole, Mr. Cole was a high school teacher employed by a School Board.
The Laptop. The Board issued him a laptop computer, but retained ownership of it.
The Policies. The Board’s Policies and Procedures Manual allowed employees – like Mr. Cole – to use its computers for incidental personal use. The Manual stipulated that teachers’ e-mail correspondence remained private, but was subject to access by school administrators if specified conditions were met. The Manual did not address privacy in other types of files, but did state that “all data and messages generated on or handled by board equipment are considered to be the property of the school board”. The Acceptable Use Policy – written for and signed by students – also applied to teachers; this policy restricted the acceptable uses of school laptops, but also warned users not to expect privacy in their files. Mr. Cole’s laptop computer was password protected, but users and technicians with administration rights could access it. The school knew that its teachers kept a great deal of personal information on their computers; Mr. Cole kept personal photos, financial records, tax records and information about property he owned on the laptop.
The Search. While performing routine maintenance on Mr. Cole’s laptop computer, a technician found a hidden folder containing nude and partially nude photos of an underage female student. The technician notified the school principal and copied the photos to a CD. The principal seized the laptop, and a second technician copied the temporary Internet files containing pornographic images to a second disc. The employer then handed the laptop and both discs over to the police. The police, without a warrant, viewed the images and created a mirror image of the hard drive for the purposes of their criminal investigation. The police subsequently charged Mr. Cole criminally with possession of child pornography and unauthorized use of the employer’s computer.
The Expectation of Privacy Argument. In his defence, Mr. Cole argued that he had a reasonable expectation of privacy in the contents of the laptop computer, and that by searching his laptop without a warrant the police had breached his right to be free from unreasonable search and seizure as protected by section 8 of the Charter. Mr. Cole argued that because of this breach, admitting any evidence obtained from the warrantless search into the criminal proceedings would “bring the administration of justice into disrepute”, and that the Court should therefore exclude such evidence as required by section 24 of the Charter.
Trial & Appeal Decisions
At the trial, the Court agreed that Mr. Cole had a reasonable expectation of privacy in the contents of his work-issued laptop computer; thus, the warrantless search violated his section 8 Charter right to be free from unreasonable search and seizure. Furthermore, the trial Court decided the evidence should be excluded under section 24 of the Charter. Accordingly, the trial Court dismissed the charges against Mr. Cole. The Crown appealed this decision to the Ontario Court of Appeal.
The Ontario Court of Appeal excluded some, but not all, of the evidence. Since the trial Court had excluded all of the evidence and dismissed the charges, the Court of Appeal ordered a new trial. Mr. Cole appealed the Court of Appeal’s decision to the Supreme Court of Canada.
Supreme Court of Canada
The issue before the Supreme Court of Canada was whether Mr. Cole had a reasonable expectation of privacy in the Internet images such to trigger the protection granted under section 8 of the Charter. In the course of considering the search and seizure by (1) the police, and (2) the employer School Board, the Court made the following notable pronouncements on employees’ privacy expectations in relation to employer-issued computers:
- Computers that are reasonably used for personal purposes – whether in the workplace or the home – contain information that is meaningful, intimate and touching on the user’s biographical core.
- Therefore, employees may reasonably expect privacy in the information contained on these computers, at least where personal usage is permitted or reasonably expected.
- While workplace policies and practices may diminish an individuals’ expectation of privacy in a work computer, these sorts of operational realities do not in themselves remove the expectation entirely.
- While the ownership of the computer is a relevant consideration, it is not determinative.
- It is necessary to consider the “totality of the circumstances” to determine whether privacy is a reasonable expectation in the particular situation.
The Police. Applying this “totality of the circumstances” test to the warrantless police search and seizure, the Court decided that, based on all of the facts, Mr. Cole had a subjective expectation of privacy in the Internet files containing pornographic images on his laptop; furthermore, the Court decided that even taking into account the applicable workplace policies, his subjective expectation was objectively reasonable. The Court decided that Mr. Cole had a diminished, but reasonable, expectation of privacy in the laptop and its contents and the police had thus unlawfully seized this evidence. The Court must therefore exclude it from consideration under section 24 of the Charter if its admission would negatively affect the administration of justice. Here, the Court determined the exclusion of the evidence would have a marked negative impact on the truth-seeking function of the criminal trial process. Thus, the evidence should not be excluded; since it had been, the Court ordered a new trial.
The Board. In the Board’s case, however, the Court found the Board was authorized to seize the laptop as it did under its statutory duty to maintain a safe school environment; thus its search and seizure of the laptop was not challenged. Furthermore, Mr. Cole had no privacy interest in the nude photos of the student; thus there was no legal basis on which to challenge the Board’s creation of the disc containing them, or the search and seizure by the police of the disc to which they were copied. The SCC noted, however, that the Board could not transfer this authority to the police, nor could it waive Mr. Cole’s section 8 Charter right on his behalf.
Comment
The Context. It’s important to bear in mind that the Court’s decision, and in particular its discussion of “reasonable expectation of privacy”, in this case are in the context of a Charter challenge to the admissibility of evidence for the purposes of a criminal investigation and the protection against unreasonable search and seizure under section 8 of the Charter. A person’s Charter rights only come into play directly where there is a government action, like by the police – as was the case here – or, in some cases, where the employer is a government body. Thus, the Charter is not typically a factor in employee-employer disputes. Despite this, the Court’s decision does have broader relevance to both the subjective and objective test for determining the reasonableness of an employee’s expectation of privacy. This issue can arise in disciplinary matters or civil actions in the context of the employment relationship. For example:
- If an employer is conducting a workplace investigation, and violates an employee’s reasonable expectation of privacy in the course of the investigation, the personal information the employer obtains may be excluded as evidence in an arbitration or civil action.
- Where workplace policies allow limited personal use of employer-owned computers but also indicate that the employer may access and monitor usage, arbitrators may seek to balance the rights of the parties by requiring that employer access to employee personal information stored on workplace computers be reasonably necessary for management of employees or investigation of probable employee misconduct.
The Take-Aways. R. v. Cole also highlights that although an employer has very clearly written and articulated policies on computer usage and IT systems in place to support its policies, if it agrees to provide employees with computers and allows even minimal personal use, it will be difficult to establish an employee has no expectation of privacy over the personal information contained on the computer. Therefore, if an employer wishes to severely limit or eliminate any expectation of privacy in information an employee may hold in relation to the employee usage of work issued laptops or electronic devices, or the contents of them, we recommend employers be:
- Clear in policies that these devices are not for personal use, that usage will be monitored by the employer, and that employees should not expect privacy regarding any information stored on them.
- Thorough and direct in communications with employees respecting the policy and the issue generally.
- Relentless in following the practice of monitoring/auditing employee usage where warranted.
Please contact your McInnes Cooper lawyer or any member of our Privacy, Data Protection & Cyber Security Team @ McInnes Cooper to discuss this topic or any other legal issue.
McInnes Cooper has prepared this document for information only; it is not intended to be legal advice. You should consult McInnes Cooper about your unique circumstances before acting on this information. McInnes Cooper excludes all liability for anything contained in this document and any use you make of it.
© McInnes Cooper, 2012. All rights reserved. McInnes Cooper owns the copyright in this document. You may reproduce and distribute this document in its entirety as long as you do not alter the form or the content and you give McInnes Cooper credit for it. You must obtain McInnes Cooper’s consent for any other form of reproduction or distribution. Click here to request our consent.
