Last Friday, the Supreme Court of Canada (the “SCC”) released the much anticipated decision in R. v. Cole. The decision reveals a protectionist attitude toward the privacy rights of employees in the workplace, at least when it comes to state involvement. Regrettably, the SCC declined the invitation to make any finding with respect to the private employer’s right to monitor employee computer use. The decision is nevertheless useful in identifying some of the factors a court might consider in determining whether an employee in the private sector has a reasonable expectation of privacy when using his/her employer’s computers, and what an employer can do to diminish that expectation.
Mr. Cole was a high school teacher. He was provided with a laptop computer owned by the school. While performing regular maintenance on the school network, it was discovered that Mr. Cole had downloaded nude photos of a female student from her school computer account. The laptop was seized by the principal of the school. Upon further investigation of the laptop, it was discovered that Mr. Cole had also viewed and downloaded highly inappropriate content from various Internet pornographic sites. The school’s technician made two discs of the inappropriate material and an image of the hard drive, which were then delivered to the police. The police viewed the contents of the computer and discs without first obtaining a search warrant. Mr. Cole was charged with possession of child pornography and unauthorized use of a computer.
The Decision of the SCC
Although Canadians have a reasonable right to privacy on their personal computers, the question has remained open whether that right extends to personal information on their employer's computer. In this case, the Court held that such an extended right can exist. Although it permitted the evidence to be admitted at a new criminal trial in this case, the Court left open the questions of when evidence might be excluded and - for employers - when their interests trump an employee's privacy rights.
In order to determine whether privacy is a reasonable expectation in a particular situation, the court held that the “totality of the circumstances” had to be examined.
Working against Mr. Cole’s expectation of privacy, the SCC acknowledged that the school had policies which stated that emails remained private, but were subject to access under limited circumstances (the policies were silent with respect to other uses of the computers), that all data on the computers remained the property of the school, and that it was known that the school had the technological capabilities to monitor computer use. The SCC nonetheless found that Mr. Cole had a legitimate expectation of privacy in the use of his employer’s computer.
The SCC noted that policies of the employer which state that the employee has no expectation of privacy are a factor to be considered in determining whether an employee’s right to privacy has been diminished, but they are not determinative in light of the sensitive and intimate nature of the personal information that may be stored on those computers. In finding that Mr. Cole had an objectively reasonable expectation of privacy with respect to his use of the computer, the SCC relied heavily on the fact that employees were permitted to make personal use of the computers. The SCC stated that the nature of the data viewed and stored by Mr. Cole was found to be “information that is meaningful, intimate, and organically connected to his biographical core,” and therefore, warranted an expectation of privacy.
Similarly, the fact that the school owned the computers was found to be a factor to consider, but again, not a determinative one.
Although the SCC held that Mr. Cole had a reasonable expectation of privacy in the use of his work laptop, it was a diminished expectation of privacy when compared to the use of a personal computer.
It must be noted that the decision was made within the context of a criminal proceeding dealing primarily with the protections afforded against unlawful state intrusion. Mr. Cole conceded on appeal that the search of the computer by the school was not unlawful and therefore, the SCC made no finding with respect to an employer’s right to monitor the use of its computers by employees. However, the Court of Appeal did find that the evidence obtained by the school was done so lawfully. This bodes well for employers who wish to assert the right to monitor employee computer use, within reason.
Earlier this year, the Court of Appeal recognized a new tort called “intrusion upon seclusion” which is tantamount to invasion of privacy. That case dealt with one employee’s access to another employee’s banking records via the employer’s computer system. It would appear from these two recent decisions that our courts are willing to find that privacy is an important right worthy of protection, even in the workplace. Although R. v. Cole is decided within the criminal context, private sector employers should take the following points from the decision:
- The fact that the employer owns the equipment does not automatically negate an employee’s expectation of privacy with respect to the use of that equipment
- Policies remain extremely important, but may not be determinative in establishing that an employee has no expectation of privacy
- In order to give more weight to policies, they should be detailed, and identify whether an employee has any expectation of privacy with respect to each type of use i.e. email, internet searches, downloading, social media, etc.
- Employees should be made aware of the technological capabilities of the employer to monitor computer use
- Employers should consider whether to restrict personal use of the company owned computers in order to reduce an employee’s expectation of privacy
- Employers should be judicious in monitoring employee computer use, and limit it to circumstances where there are reasonable grounds to suspect that the employee is engaging in misconduct