In a recently released decision, The Court of Appeal for Ontario concluded that employees may have a reasonable expectation of privacy when using a computer provided by their employer for work-related purposes. The Court’s decision in R. v. Cole arose in relation to criminal charges against a teacher (Cole) for possession of child pornography. During a system maintenance review, the school board’s computer technician discovered nude photographs of an underaged female, whom the technician believed to be a student of the school. These images were stored on a laptop computer that had been provided to Cole by the school board for work-related purposes. The technician advised school administration of this discovery, and the laptop was seized and searched by the school board. The school board provided police with the laptop and discs containing Cole’s Internet browsing history and copies of the images in question. The police searched the laptop and the discs without a warrant. The trial judge excluded all of the evidence seized from the laptop and the discs, finding that Cole had a reasonable expectation of privacy in the contents of the laptop, and, accordingly, police required a warrant to conduct a search. The trial judge’s decision was overturned on appeal to a judge of the Superior Court of Justice, who concluded that Cole did not have a reasonable expectation of privacy in the contents of the laptop. The Court of Appeal was then called upon to decide this issue.
Why Should Employers Pay Attention to this Decision?
As noted above, the Court of Appeal’s decision arose in relation to a criminal proceeding. Accordingly, the Court was called upon to consider whether the school board and/or the police breached Cole’s right, under section 8 of the Charter of Rights and Freedoms, to be free from unreasonable search and seizure. The Court assumed, for the purposes of its decision, that the school board was subject to the Charter. As such, the Court’s analysis of the school board’s conduct does not have direct application to private-sector employers, who are not subject to the Charter. However, the Court’s analysis provides some helpful insight regarding the Court's approach to the issue of whether an employee has a reasonable expectation of privacy in the workplace. Specifically, this decision provides a helpful reminder of the importance of having clear and unambiguous policies regarding the use of company internet and email systems, workplace computers (including lap-tops computers) and other electronic devices provided to employees for work-related purposes, and of the limitations on an employer’s ability to control the use of its email and internet systems, computers and other electronic devices.
In this case, the Court of Appeal concluded that Cole had a "limited" reasonable expectation of privacy in the personal use of the laptop provided to him by the school board. Although the laptop was owned by the school board, issued for employment purposes and had access to the school network, the school board had granted teachers permission to use their laptops for personal use (including storing personal information on the hard drive) and teachers employed passwords to exclude others from gaining access to laptops. The school board had not implemented a clear and unambiguous policy to advise teachers that their laptops were subject to general or random monitoring and/or search. Accordingly, the evidence seized from the laptop (other than the images of the underaged student) and the disc containing Cole’s internet browsing history was not admissible at trial. The Court found that Cole’s reasonable expectation of privacy was "limited" because he did not have a reasonable expectation of privacy with respect to access to the hard drive of his laptop by the school board’s technician for the limited purpose of maintaining the technical integrity of the school board’s information network and laptop. Given that this was the context in which the technician discovered the images of the underage student and provided them to police, those images were admissible at trial.
Do Employees Have a Reasonable Expectation of Privacy in the Workplace?
The Court of Appeal concluded that employees may have a reasonable expectation of privacy in relation to computers provided to them by their employers, which may be "limited" in certain circumstances. Whether or not such an expectation exists, and if so, the extent of that expectation, is to be determined on the totality of the circumstances in each case. The factors that will generally be considered when determining whether an employee has a reasonable expectation of privacy, and the extent of that reasonable expectation, include the following:
- Who has possession or control of the property or place that is searched?
- How is the property or item used?
- How is access, including the right to admit or exclude others from the place or property, regulated?
- What is the individual’s subjective expectation of privacy?
- Is that expectation reasonable, from an objective perspective?
The Court of Appeal noted the following factors in concluding that Cole had a reasonable expectation of privacy in relation to the contents of the laptop:
- Cole had exclusive possession of the laptop and took steps to protect it using a password;
- The school board had provided explicit permission for the laptop to be used for personal use in its written policy;
- Teachers had permission to take the laptops home on evenings, weekends and summer vacation;
- There was no evidence that the board actively monitored teachers’ use of their laptops; and
- Perhaps most importantly, there was no clear, unambiguous policy permitting the school board to monitor or search teachers’ laptops. The school board’s policy did not advise that information stored on the laptop was subject to search and did not address monitoring, except in relation to e-mail.
What Can Employers Learn from this Decision?
Most employers will not be subject to a Charter analysis regarding the search of employees’ computers. It is likely however that courts, arbitrators and administrative tribunals will consider the Court of Appeal's reasoning in this case when addressing issues of privacy in the workplace. While ownership of the property in question has historically been considered to be a significant factor in determining whether a reasonable expectation of privacy exists, it appears that going forward, ownership may only be a starting point of the analysis. Accordingly, it is extremely important that employers take additional steps to limit any reasonable expectation of privacy that employees may have in relation to workplace internet and email systems, computers and other electronic devices provided to them for work-related purposes. To that end, employers should:
- implement a clear and comprehensive policy regarding employees’ rights to access and use data and computer systems and equipment. This should include a very clear statement regarding the privacy of data that might be located on a computer or network and clearly state the reasons for which the employer might access that information;
- ensure that employees acknowledge that they’ve read, understand and agree to abide by the policy. This can frequently be done on the electronic device itself, and should be set to regenerate at a regular interval where an employee has to acknowledge acceptance;
- clearly advise employees that copies of employer-owned data remain the employer’s property regardless of where they are stored; and
- clearly state any limitations that are desired regarding personal use — for example, regarding unlawful activity or offensive materials.
The policy, like all policies, should be carefully drafted, periodically reviewed and updated as required. Employers should also conduct regular monitoring to ensure compliance with the policy. All employees, including supervisors, should be held to the same standard and violations should be dealt with in a consistent manner.