Canada - Reasonable Expectations of Privacy in Workplace Computer

By Paul E. Broad, Hicks Morley

The Supreme Court of Canada has issued a significant decision regarding workplace privacy. In R. v. Cole, it unanimously held that employees have a diminished, but reasonable, expectation of privacy in personal information stored on an employer-issued computer. Employers may continue to access information stored on their work systems for their legitimate purposes, though they should now use more thorough and detailed policy to establish a clear management right.

BACKGROUND

Cole is about a teacher charged with having pornographic images of an underage student on his employer-issued laptop computer. A member of his school board’s IT staff discovered the images after noticing irregular network traffic during routine maintenance.

The board provided the police with the computer and a disc that included the teacher’s temporary Internet files. The police searched the computer and disc without obtaining a warrant.

The police charged the teacher with possession of child pornography and unauthorized use of a computer. The teacher argued that the evidence on the computer was obtained in violation of his right to be free from unreasonable search and seizure as guaranteed by section 8 of the Canadian Charter of Rights and Freedoms and sought to have the evidence excluded.

The Court of Appeal for Ontario held that the teacher was protected by section 8 because he had a diminished, but reasonable, expectation of privacy in the contents of his employer-issued computer. It then held that the actions of the school board (which it assumed was bound by the Charter) were reasonable but the actions of the police were not. The Court ordered evidence obtained from the police search to be excluded from evidence at trial under section 24(2) of the Charter as its admission would bring the administration of justice into disrepute.

THE SUPREME COURT’S DECISION ON REASONABLE EXPECTATION OF PRIVACY

The Supreme Court of Canada affirmed the Ontario Court of Appeal’s finding that the teacher had a diminished, but reasonable, expectation of privacy in the contents of his employer-issued computer. The majority (6-1) allowed the appeal, holding that the Court of Appeal had improperly excluded evidence under section 24(2) of the Charter.

The Supreme Court’s expectation of privacy finding is principled and broad. There were flaws with the school board’s policy framework that the Court does not treat as significant. To the contrary, it recognizes that the school board’s policy and “technological realities” deprived the teacher of exclusive control, but that privacy protection was still warranted given the teacher’s personal use, which generated information that was “intimate” and revealing of the teacher’s “biographical core.” Promulgating more strict or absolute policy is therefore not a means to eliminate the expectation of privacy recognized in Cole. A reasonable expectation of privacy would not likely subsist in the face of an absolute prohibition on personal use, but the Court itself hinted at the difficulty in enforcing such policy by specifying that an expectation of privacy would prevail when personal use is “reasonably expected.”

Although the Court’s expectation of privacy finding is principled and broad, the Court stressed the competing factors governing the privacy interest at stake and suggested that the expectation is very limited. It said, for example, that the board’s policy and the technological realities of its work system diminished the teacher’s expectation of privacy but “did not eliminate it entirely.” It also took account of the limited nature of the teacher’s expectation of privacy in deciding against the exclusion of evidence obtained through the unlawful police search.

The diminished nature of the privacy expectation is important because it will allow for the eventual recognition of a broader employer right of access. The scope of such a right is an issue that the Court expressly “left for another day,” but the Court did gratuitously affirm the Court of Appeal’s finding that the teacher’s employer had acted reasonably – i.e., within its implicit right to access information in conducting system maintenance and within its implicit right to conduct a reasonable investigation in order to maintain a safe school environment.

Though the Court bases the latter right as corresponding to a principal’s duties under the Ontario Education Act, its reasoning could easily apply to workplaces in general. In speaking of this right, the Court refers to its 1998 school case called M. (M.R.), which establishes a very flexible search standard (based on reasonableness in all the circumstances) suited to an organization entrusted with managing an “orderly environment.”

IMPLICATIONS FOR EMPLOYERS

In light of Cole, transparency about employer access to system information should be the new norm. Employers should immediately revisit their acceptable use policies to ensure that they:

·         Articulate all the purposes for which they access system information (e.g. to audit, to investigate, to conduct e-discovery, to analyze performance, to foster work continuity and so on)

·         Articulate the means by which they will access system information (e.g. through traffic analysis, through content analysis, by restoring deleted information and so on)

·         Explain that employees have a choice and tell employees, “If you require a private means of computing and sending communications, please use a personal device unconnected to our network.”

Cole makes clear that such policy will not eliminate the potential for employee privacy claims, but it is now essential in establishing a clear and broad management right to access work system information for legitimate purposes. There is nothing in Cole that suggests employers bound by the Charter or other employers will be fettered in asserting such a right despite the now-recognized employee privacy interest, but having thorough and detailed policy and implementing the policy through periodic communications is now key. The days of resting on a simple “no expectation of privacy” disclaimer are now clearly over.