A case involving Sudbury high school computer teacher, Richard Cole, has made national headlines after the Ontario Court of Appeal recently recognized his right to privacy in the personal information stored in his work-issued laptop.
This case has been described as having significant implications for employers who permit employees to use their work laptops, smart phones and other technology for personal purposes. However, the analysis in the R v Cole1 ("Cole") decision focused on the question of whether the employee had a reasonable expectation of privacy in the laptop within the context of determining if his employer or the police conducted an unreasonable search or seizure under the Canadian Charter of Rights and Freedoms (the "Charter"). In this case Cole's employer was the school board, and therefore the employer's actions were subject to the Charter.
Unlike the school board, private employers are not subject to the Charter. Therefore the findings in Cole would not be directly applicable in a civil lawsuit between an employee and a private employer. Nevertheless given the unsettled state of the law respecting workplace privacy, the Cole case provides useful insight into the approach that courts may take toward employee privacy rights as the law in this area continues to develop.
Cole was charged with possession of child pornography and unauthorized use of a computer under the Criminal Code, after the school's computer technician remotely accessed the contents of his laptop and found nude sexually explicit images of a grade 10 student on the hard drive. The computer technician advised the principal, who directed the technician to copy the images onto a disc and required that Cole surrender his laptop. The school board's technician copied the photographs and internet files onto a disc and provided them to the police along with the laptop. The police conducted a further search of the computer without a warrant, on the basis that the school board owned the computer and provided authorization for the search.
findings of the Ontario Court of Appeal
The Court of Appeal found that Cole had a reasonable expectation of privacy in the laptop that was owned by his employer and issued for employment purposes. The Court reasoned that Cole was granted exclusive use of the laptop including during weekends and vacations, had a password to exclude others from the laptop, was permitted to use the laptop for personal purposes and did use the laptop for such purposes.
In determining that the employee had a reasonable expectation of privacy in the computer, the Court considered it relevant that the employer did not have a clear, unambiguous policy stating that it could generally monitor and search teachers' laptops. The Court further found that:
- the employee's reasonable expectation of privacy in the laptop was modified by the fact that he knew the employer's technician could and would access the computer for the purpose of maintaining the technical integrity of the school's information network
- to the extent that the employer did have policies applicable to teachers' usage of the laptops, such policies were modified by convention
- the search of the laptop by the school's principal and the school board was authorized and reasonable based on their obligation to ensure the health and safety of students under applicable law (i.e., the Education Act). Although this finding is specific to the school environment, by analogy, it is possible a court could find that employers are authorized to monitor technology for the purposes of ensuring a safe workplace, free from violence and harassment, under occupational health and safety and human rights laws
- since the photographs were taken from the school's network, using the school's computer and were the subject of the privacy interest of a student, Cole had no personal privacy interest in the data
lessons for employers
As noted above, the Cole case does not have direct implications for employers in the private sector who are not subject to the Charter.
However this case could be indicative of an increasing trend in the courts to recognize individuals' rights to privacy and protection of their personal information. Therefore employers would be well advised to ensure that they have clear, unambiguous policies respecting searching and monitoring employees' use of the technology that is provided for business purposes. At a minimum such policies should address:
- appropriate and inappropriate usage of computers and other technology
- the employer's right to access technological devices and the reasons for such access
- the fact that employees should not have any expectation of privacy in technology and equipment provided by the employer for business purposes
It is also crucial that employers ensure that employees are aware of technology policies and consistently enforce such policies.
Employers who follow the steps outlined above should be well positioned to respond to privacy claims by employees, as the law respecting workplace privacy continues to evolve.