Ontario Court of Appeal Clarifies Employee Privacy Rights at Work

The Ontario Court of Appeal recently released its judgment in R. v. Cole, in which it set out employee’s privacy rights with respect to personal information stored on a work computer.

A school board had launched an investigation after noticing that there was a high level of activity between a teacher’s work computer, which had been provided to the teacher by the board, and the board’s server. A member of the board’s IT group accessed the teacher’s computer remotely to perform a virus scan and, while doing so, came across explicit photographs of a young student.

The technician reported the matter to the school principal and took a “screen shot” of what he had found. The principal asked the technician to save a copy of the screen shot and the photographs to a disc. The board obtained the laptop from the teacher and made a copy of the computer’s temporary internet files, copying them to a second disc.

The discs and computer were provided to the police as part of their investigation. In conducting the search (without a warrant), the police created a “mirror image” of the computer’s entire hard drive.

As a result of the police investigation, the teacher was charged with possession of child pornography and unauthorized use of a computer. In his defence, the teacher argued that evidence should be excluded under section 8 of the Canadian Charter of Rights and Freedoms, which protects individuals from unreasonable search and seizure.

The Court, presuming that the Charter applied to the school board, held that, even though the computer was owned by the board, the teacher had a reasonable expectation of privacy with respect to the contents of the laptop. The Court explained that the teacher was in exclusive possession of the laptop, that permission was given to teachers to use the laptop for personal use, and that the laptop could be taken home on evenings, weekends, and for summer vacation. In addition, there was no clear policy with respect to the monitoring or searching of teachers’ laptops. While the school board’s policy on computer use did include a warning with respect to searches of e-mail communications, there were no warnings regarding other information that might be stored on the computer or on the board’s network.

Concluding that the board’s IT technician had stayed within “an implied right of access,” the Court held that the school board had not violated section 8 of the Charter. In determining whether a search is properly authorized in the absence of a policy specifically granting authorization, the Court found that the test is whether the search was conducted for a purpose consistent with proper systems administration.

Based on the above test, the Court concluded that, when the IT technician took a screen shot, he created copies of the information discovered during the initial investigation. The Court found the actions of the IT technician reasonable due to the general obligation of the technician to ensure the health and safety of the school’s students. The secondary search, wherein temporary internet files were copied, was also found to be reasonable.

With respect to the police investigation, however, the Court found that there had been unreasonable search and seizure under section 8 of the Charter. The teacher’s reasonable expectation of privacy with respect to the contents of the laptop and the invasive nature of the search were the basis of the Court’s determination. The evidence uncovered by the police search was therefore excluded, while the screen shot and photographs gathered by the school board were deemed admissible.

This decision highlights the importance of computer-use policies and procedures that outline the employer’s right to monitor and control employees’ personal content and usage of company-owned devices, such as laptops, blackberries and iPhones. Through such policies and procedures, employers have the ability to limit employees’ privacy expectations. These policies and procedures should be brought to the attention of employees at the time of their hire and periodically during the employment relationship. Many employers have also created a screen shot which appears at each log-on warning employees regarding the monitoring of the company computer.