The Supreme Court of Canada has confirmed that employees have a reasonable expectation of privacy from state interference with information on their work computers, just as they do with their home computers, provided that personal use of the work computer is permitted or reasonably expected. The Court has, however, deferred the question of employers’ rights to monitor and access their employees’ use of technology.
The Court’s decision in R. v. Cole provides important guidance to employers regarding employees’ use of work-issued computers.
The Supreme Court’s Decision
The Cole case involved a high school teacher who was charged with possession of child pornography on the basis of information from his school-issued laptop. A computer technician doing maintenance on the school’s computer systems found sexually explicit images of an underage female student on the laptop. He copied them onto a disc and gave it to the principal, who also took the laptop. School board technicians then searched the laptop and copied temporary Internet files from the teacher’s web surfing history onto a disc. The discs and the laptop were turned over to the police, who searched them without a warrant and subsequently charged the teacher. The teacher challenged the search by police, but not the school, as an infringement of his Charter right to be free from unreasonable search and seizure.
The Court concluded that the teacher had a reasonable expectation of privacy in personal material stored on his work computer, albeit a "diminished" expectation having regard to the "totality of the circumstances." Rather than exclude the evidence, however, the majority of the Court held that it was admissible against him in the circumstances.
Key messages from the Court’s decision include the following:
- With respect to state interference, Canadians have a reasonable expectation of privacy in work computers and technology when personal use is permitted or expected by the employer.
In assessing the objective reasonableness of an employee’s expectation of privacy, “the totality of the circumstances” must be considered and weighed, and no single factor will be determinative. In this regard
- ownership of hardware and a workplace policy that permits access and monitoring do not, in themselves, entirely remove a reasonable expectation of privacy of employees, though these factors can diminish it;
- permitting personal use of employer technology and hardware tends to increase the reasonableness of an expectation of privacy; and
- the nature of the personal information at issue, including in this case Cole’s Internet browsing history, which the Court described as information that is “meaningful, intimate, and organically connected to his biographical core,” can enhance the reasonableness of the expectation of privacy.
Although the teacher had a reasonable but diminished expectation of privacy in the personal information stored on his computer, the principal and school board did not breach his privacy rights, because they had an implied power to search teachers’ work computers if they reasonably believed school safety to be at issue, by virtue of their duties under the Education Act. The school board’s lawful search did not, however, provide the police with the same authority. Nor was the school board’s consent to the police search of any consequence. The police ought not to have done a warrantless search.
Implications for Employers
It is important to note that the Court’s decision makes clear that even when an employer has policies in place and maintains ownership over devices used by employees, an employee may still have a reasonable expectation of privacy in personal information stored on those devices. As a result, employers wishing to ensure that their employees have no or a low expectation of privacy over information stored on work devices should consider other steps, including prohibiting technology for personal use, blocking access to websites used mainly for personal reasons and creating network architecture that prevents employees from saving information in non-public folders.
The Court’s decision underscores the importance of clear, consistently enforced workplace privacy policies. Employers wishing to monitor their employees’ use of their work computers should explicitly reserve the right to broadly monitor and search the computer, including employees’ private communications or personal information. Any prohibited uses should be specifically listed in the policy to put employees on notice.