Employee Privacy Rights at Work: An Update

/in /by

In previous newsletters we have reported on the progress of R. v. Cole, a criminal prosecution case that was set to define an employee’s privacy rights with respect to personal information stored on a work-issued computer.

Cole was a high-school teacher whose school had provided him with a laptop computer to facilitate his duties. While a school board technician was performing maintenance activities on this laptop, explicit images of an underage female student were found. The technician reported this to the principal who seized the laptop, downloaded its contents onto a compact disc and turned both laptop and disc over to police.

Cole was charged with possession of child pornography and unauthorized use of a laptop. The Ontario Court of Appeal had held that his privacy rights were breached and the contents of the laptop were inadmissible at trial. The prosecution appealed.

The Supreme Court of Canada recently issued a pivotal ruling with consequences for employment law. While this Court overturned the Court of Appeal in holding that the laptop and its contents were admissible for other reasons, it maintained that where an employer provides an employee with a computer, for which the employee is permitted to carry-on incidental personal activities, the contents of that computer are protected with a reasonable expectation of privacy.

To arrive at this conclusion, the Court had to decide a number of issues. Of most importance to employers is whether the accused had a reasonable expectation of privacy for a work-issued computer.

The Court found that a privacy interest existed where a reasonable and informed person would expect privacy, given the totality of the circumstances. In this case, an expectation of privacy was derived from the way Cole used the laptop, saving personal data to its hard drive and using it to browse internet sites of personal interest. These activities generated information that was both meaningful and intimate to Cole’s person.

The Court then looked at whether this expectation was reasonable. To determine this, the Court referenced other cases which have established that:

  • the closer the subject matter of the alleged search lies to the biographical core of the personal information, the more there is a reasonable expectation of privacy. As previously mentioned, Cole’s usage generated meaningful and intimate information.
  • ownership of property is a relevant consideration but is not determinative of whether one ought to expect privacy. Use of the school board’s work-issued laptops were governed by their Policy and Procedures Manual which stated that “all data and messages generated on or handled by board equipment are considered to be the property of [the school board]”.
  • the context in which personal information is placed on an employer-owned computer is significant. Operational realities, policies and customs are not determinative on their own. The court held that when personal use is permitted, or reasonably expected, the employee has a reasonable expectation of privacy. The school board’s Policy and Procedures Manual allowed for incidental personal use of the board’s information technology. The policy stipulated that teachers’ email correspondence remained private, but subject to access by school administrators if specified conditions were met. Also, the school’s Acceptable Use Policy not only restricted the usage of laptops for the students and teachers, but also warned users not to expect privacy in their files.

The principal’s access was uncontested because of the statutory duty under s. 256 of Ontario’s Education Act to maintain a safe school environment, and, by necessary implication, a reasonable power to seize and search a school-board issued laptop. The school board technician in fulfilling his work duties also had the same power.

However, the lawful authority of the accused’s employer to seize and search the laptop did not furnish the police with the same power. In order for the police to have legally searched the laptop, they needed to obtain a search warrant. The Court found that there had been a violation of s. 8 of the Canadian Charter of Rights and Freedoms. The fact that the principal handed these materials over to the police was insufficient to waive the employee’s rights as only the employee can waive his rights to Charter protections.

This case has several implications for Canadian employers:

  • It stands for the proposition that employees have an expectation of privacy on the information generated through use of work-issued equipment where personal use is permitted. As previously stated, policies governing company-owned devices are important. It is also important to make employees aware of these policies in order to reduce their expectation of privacy;
  • This rule is tempered by a need to consider the total circumstances where realities like ownership, password protection, organizational policies and customs may reduce the privacy expectation to tilt the analysis in the other direction; and
  • Where the employer is within its rights to access such information, that information may be excluded from arbitration or civil suits where the employer improperly grants access to third parties. Furthermore, when such personal information is accessed for legal proceedings, the employer must be cautious that no laws are violated in the process.