Ontario Court of Appeal Finds Reasonable Expectation of Privacy in Work Computer
Published:
May 6, 2011
In March 2011, the Ontario Court of Appeal found that an employee had a limited expectation of privacy in the contents of a work computer. The decision reinforces that employers should have a computer use policy, and the policy should make clear:
•Data on employees’ workplace computer is not private;
•The employer can monitor and search all material on employees’ workplace computers including e-mail, internet traffic and the hard drive; and
•Any restrictions on the employer’s right to search or when the employer will engage its right to search the employees’ workplace computer.
In R. v. Cole, the issue was whether an employee held a reasonable expectation of privacy in the contents of an employer-owned laptop assigned exclusively to him, and if so, whether the search of the laptop by his employer or by police violated his right to be free from unreasonable search and seizure under the Canadian Charter of Rights and Freedoms (“Charter”).
FACTS
Cole was a high school teacher. His employer issued him a laptop to use for his job. While performing his duties, Cole found nude pictures of a student on another student’s e-mail account on the network and copied them to his laptop’s hard drive. Later, the employer’s computer technician noticed a large amount of activity between Cole’s laptop and the employer’s server. Concerned, he remotely accessed Cole’s hard drive to perform a virus scan and verify system integrity and found a hidden folder containing the pictures, which the technician believed were of an under-aged student.
The technician took a screenshot of the pictures, confirmed they were of a student and reported it to the principal. The principal reconfirmed the pictures depicted a student, asked the technician to copy them onto a CD (“Disk 1”), and told him not to discuss it with anyone. The principal next asked Cole to return his laptop and provide his password. A second technician subsequently accessed and searched Cole’s laptop, copied its temporary internet files containing images and files from Cole’s online internet browsing history, and put them on a second CD (“Disk 2”). The employer later gave the laptop and both CDs to the police; without a search warrant, the police searched the laptop and CDs and arrested Cole.
Cole asked the Court to exclude the evidence from the laptop and the CDs on the basis the police had infringed his Charter right to be free from unreasonable search and seizure because he had a reasonable expectation of privacy in the laptop contents. The Ontario Court of Justice agreed and the police appealed to the Superior Court of Justice, which found the evidence should be admitted because Cole had no reasonable expectation of privacy in the work laptop.
REASONABLE EXPECTATION OF PRIVACY IN A WORK COMPUTER
The case went to the Ontario Court of Appeal. This Court considered the following factors in determining whether Cole had a reasonable expectation of privacy in the contents of his work laptop:
• Although the employer owned the laptop, Cole had exclusive use and possession of it and access was protected with a password he chose;
• All employees kept personal information, including bank account numbers and financial data, on their computers and the employer allowed them to use it for personal use and to take it home during weekends and vacation;
• The employer’s computer-use policy provided that all data and messages generated on school equipment was considered the employer’s, not the employee’s, property and that employees were to use laptops only for business activities, but permitted “incidental” personal use;
• Significantly, however, the policy did not provide for employer monitoring or search of the computer, and was silent about employee privacy except as it related to email (where it said
e-mail could be opened but permission would be normally sought first). In contrast, students were required to sign-off on a more extensive policy that explicitly provided for searches and alerted students that the contents were not private.
The Court concluded Cole had a subjective expectation of privacy (he personally thought the laptop contents were private), which was also objective and reasonable. However, the Court found users generally understand that workplaces and businesses employ technicians to service and maintain their networks and that they have access to computers to ensure the system’s integrity and thus the employee’s privacy expectation was modified to this extent. The Court decided the technician’s initial search and its results (Disk 1) did not violate Cole’s privacy and were admitted in the criminal proceeding, but both the search of Disk 2 and of his laptop did violate his privacy, and excluded their contents.
COMMENTARY
It is important to note this case was not an employment dispute, but a criminal trial, and the decision concerned whether the evidence the employer discovered and provided to police could be used in that criminal trial. Furthermore, since it involved police action, the Charter (including the right to free from unreasonable search and seizure) was engaged; Charter rights are only directly engaged where there is government action, such as by the police, or in some cases where the employer is a governmental body; the Charter is not typically a factor in employer – employee disputes. However, the decision does have broader implications in employee discipline matters where a right to privacy does or may exist, such as in provinces with privacy legislation, federally regulated employers or in unionized workplaces.
There is generally a disconnect between employers and employees respecting an employee’s right to privacy in the workplace, and particularly in workplace computers and internet use: on one hand, employees feel their internet activity – even at work – is private and not the employer’s business; on the other, employers feel workplace computers are company property provided to perform company business, and employees should have no expectation of privacy. This disconnect becomes apparent when an employer believes an employee has misused her workplace computer, and the employer takes disciplinary action.
Generally speaking, the employer’s position is correct, except in provinces or areas of business where legislation or court or arbitral decisions have created a right to privacy. Federally regulated companies, and provincially regulated companies in British Columbia, Alberta and Quebec are subject to privacy legislation that applies to the employment relationship. Similarly, arbitrators often find a reasonable expectation of privacy in unionized workplaces, although judges have not been as quick to do so in
non-unionized workplaces.
R. v. Cole gives all employers some guidance on what to include in their computer use policies to reduce the chance a court or arbitrator will find that an employee has any privacy rights in his or her workplace computer, and upholding the employer’s right to monitor and search, and act on the results:
•Employers should have a clear and comprehensive computer use policy;
•That policy should make it clear that data on an employee’s workplace computer – including his or her e-mail, internet, and hard-drive – is not private;
•The policy should expressly state the employer can monitor and search any and all material on the employee’s computer; and
•The policy should clearly note the scope of, or restrictions on, the employer’s right to monitor or search, or when the right to search will be used.
