The Supreme Court of Canada's long-awaited decision in R v Cole1 – a case involving a high school teacher caught with nude photographs of an underage female student on his school board-issued laptop – has confirmed that employees can expect a reasonable level of privacy in connection with personal information stored on workplace computers.
While the Court's analysis in this case centered on an individual's right to freedom from unreasonable search and seizure by police and public sector employers under section 8 of the Canadian Charter of Rights and Freedoms (the "Charter"), and is therefore only directly applicable to public sector employers, the Court's decision nevertheless offers valuable insight into the approach Canadian courts may take when faced with privacy issues.
reasonable expectation of privacy
At issue before the Court was whether information extracted from the laptop of the accused, Robert Cole, could be admitted into evidence. Charged with possession of child pornography and the unauthorized use of a computer contrary to the Criminal Code, Cole alleged that the police had conducted an unreasonable search pursuant to the Charter because a warrant was never obtained.
The Court explained that an unauthorized search is unreasonable when an individual has a reasonable privacy interest in the object or subject matter being searched. Whether an individual has a reasonable privacy interest is a matter of that individual's reasonable expectations. In order to determine these expectations, one must look at the "totality of the circumstances" which, in Cole's case, included a number of conflicting factors that both supported and diminished his reasonable expectation of privacy. For example, the Court noted the following factors which supported Cole's privacy expectations:
- the school board's Policy and Procedures Manual (the "Manual") expressly permitted incidental personal use of the school board's information technology;
- the Manual specified that teachers' e-mail correspondence remained private; and
- the school board permitted laptop users to password-protect their laptops.
The Court also noted that, generally speaking, an employee's expectation of privacy in workplace computers can be inferred from the employee's use of that computer to do things like surf the internet and store personal information. Indeed, using a workplace computer in this manner causes the computer to retain information that is "meaningful, intimate, and organically connected" to the user's biographical core (including financial, medical and other personal information).
On the other hand, the Court noted that there were also a number of factors that had a diminishing effect on Cole's expectation of privacy:
- the Manual stipulated that all data generated on or handled by school board-issued equipment would be considered the exclusive property of the school board;
- the school's Acceptable Use Policy (the "Policy") restricted the range of acceptable uses for laptops and warned users not to expect privacy in connection with the files saved on workplace hard drives; and
- the school's principal met with teachers on an annual basis in order to explain the Policy and remind teachers that it was applicable to them.
Looking at the totality of the circumstances, the Court held that Cole's expectation of privacy was objectively reasonable in this case and that his right to freedom from unreasonable search and seizure had been violated.
In reaching this conclusion, the Court explicitly stated that neither ownership of the computer nor the existence of a technology usage policy is determinative of an employee's reasonable expectation of privacy. The Court will always consider other factors that might augment privacy expectations, including whether the employer permits or expects some degree of personal use by employees – be it expressly or impliedly.
application to employers
At the Court of Appeal level, the lawfulness of the employer's actions was also considered.2 However, Cole did not appeal the finding that his employer's actions were reasonable. Therefore, the Supreme Court stated that it would "leave for another day the finer points of an employer's right to monitor computers issued to employees".
lessons for employers
As noted above, the Court's decision in R v Cole will not directly impact employers in the private sector who are not subject to the Charter. Nevertheless, there are a number of lessons to be learned from this case by employers wishing to both limit the expected level of privacy in workplace computers and shield themselves from potential invasion of privacy claims by employees (which is increasingly important given the Ontario Court of Appeal's recent recognition of the tort of intrusion upon seclusion in Jones v Tsige).3 For instance, employers are well advised to adopt clear, unambiguous policies respecting the use, searching and monitoring of work-issued technology. At a minimum such policies should address:
- appropriate and inappropriate usage of computers and other technology;
- the employer's right to access technological devices and the reasons for such access;
- the fact that employees should not have any expectation of privacy in technology and equipment provided by the employer for business purposes; and
- the fact that employees may not use work-issued technology for personal use.
It is also imperative that employers ensure that employees are made aware (and reminded) of technology policies and consistently enforce such policies.