Publications

Ontario Court of Appeal Finds Reasonable Expectation of Privacy in Work Computer

Published:

May 6, 2011

In March 2011, the Ontario Court of Appeal found that an employee had a limited expectation of privacy in the contents of a work computer. The decision reinforces that employers should have a computer use policy, and the policy should make clear:

•Data on employees’ workplace computer is not private;

•The employer can monitor and search all material on employees’ workplace computers including e-mail, internet traffic and the hard drive; and

•Any restrictions on the employer’s right to search or when the employer will engage its right to search the employees’ workplace computer.

In R. v. Cole, the issue was whether an employee held a reasonable expectation of privacy in the contents of an employer-owned laptop assigned exclusively to him, and if so, whether the search of the laptop by his employer or by police violated his right to be free from unreasonable search and seizure under the Canadian Charter of Rights and Freedoms (“Charter”).

FACTS

Cole was a high school teacher. His employer issued him a laptop to use for his job. While performing his duties, Cole found nude pictures of a student on another student’s e-mail account on the network and copied them to his laptop’s hard drive. Later, the employer’s computer technician noticed a large amount of activity between Cole’s laptop and the employer’s server. Concerned, he remotely accessed Cole’s hard drive to perform a virus scan and verify system integrity and found a hidden folder containing the pictures, which the technician believed were of an under-aged student.

The technician took a screenshot of the pictures, confirmed they were of a student and reported it to the principal. The principal reconfirmed the pictures depicted a student, asked the technician to copy them onto a CD (“Disk 1”), and told him not to discuss it with anyone. The principal next asked Cole to return his laptop and provide his password. A second technician subsequently accessed and searched Cole’s laptop, copied its temporary internet files containing images and files from Cole’s online internet browsing history, and put them on a second CD (“Disk 2”). The employer later gave the laptop and both CDs to the police; without a search warrant, the police searched the laptop and CDs and arrested Cole.

Cole asked the Court to exclude the evidence from the laptop and the CDs on the basis the police had infringed his Charter right to be free from unreasonable search and seizure because he had a reasonable expectation of privacy in the laptop contents. The Ontario Court of Justice agreed and the police appealed to the Superior Court of Justice, which found the evidence should be admitted because Cole had no reasonable expectation of privacy in the work laptop.

REASONABLE EXPECTATION OF PRIVACY IN A WORK COMPUTER

The case went to the Ontario Court of Appeal. This Court considered the following factors in determining whether Cole had a reasonable expectation of privacy in the contents of his work laptop:

• Although the employer owned the laptop, Cole had exclusive use and possession of it and access was protected with a password he chose;

• All employees kept personal information, including bank account numbers and financial data, on their computers and the employer allowed them to use it for personal use and to take it home during weekends and vacation;

• The employer’s computer-use policy provided that all data and messages generated on school equipment was considered the employer’s, not the employee’s, property and that employees were to use laptops only for business activities, but permitted “incidental” personal use;

• Significantly, however, the policy did not provide for employer monitoring or search of the computer, and was silent about employee privacy except as it related to email (where it said

e-mail could be opened but permission would be normally sought first). In contrast, students were required to sign-off on a more extensive policy that explicitly provided for searches and alerted students that the contents were not private.

The Court concluded Cole had a subjective expectation of privacy (he personally thought the laptop contents were private), which was also objective and reasonable. However, the Court found users generally understand that workplaces and businesses employ technicians to service and maintain their networks and that they have access to computers to ensure the system’s integrity and thus the employee’s privacy expectation was modified to this extent. The Court decided the technician’s initial search and its results (Disk 1) did not violate Cole’s privacy and were admitted in the criminal proceeding, but both the search of Disk 2 and of his laptop did violate his privacy, and excluded their contents.

COMMENTARY

It is important to note this case was not an employment dispute, but a criminal trial, and the decision concerned whether the evidence the employer discovered and provided to police could be used in that criminal trial. Furthermore, since it involved police action, the Charter (including the right to free from unreasonable search and seizure) was engaged; Charter rights are only directly engaged where there is government action, such as by the police, or in some cases where the employer is a governmental body; the Charter is not typically a factor in employer – employee disputes. However, the decision does have broader implications in employee discipline matters where a right to privacy does or may exist, such as in provinces with privacy legislation, federally regulated employers or in unionized workplaces.

There is generally a disconnect between employers and employees respecting an employee’s right to privacy in the workplace, and particularly in workplace computers and internet use: on one hand, employees feel their internet activity – even at work – is private and not the employer’s business; on the other, employers feel workplace computers are company property provided to perform company business, and employees should have no expectation of privacy. This disconnect becomes apparent when an employer believes an employee has misused her workplace computer, and the employer takes disciplinary action.

Generally speaking, the employer’s position is correct, except in provinces or areas of business where legislation or court or arbitral decisions have created a right to privacy. Federally regulated companies, and provincially regulated companies in British Columbia, Alberta and Quebec are subject to privacy legislation that applies to the employment relationship. Similarly, arbitrators often find a reasonable expectation of privacy in unionized workplaces, although judges have not been as quick to do so in

non-unionized workplaces.

R. v. Cole gives all employers some guidance on what to include in their computer use policies to reduce the chance a court or arbitrator will find that an employee has any privacy rights in his or her workplace computer, and upholding the employer’s right to monitor and search, and act on the results:

•Employers should have a clear and comprehensive computer use policy;

•That policy should make it clear that data on an employee’s workplace computer – including his or her e-mail, internet, and hard-drive – is not private;

•The policy should expressly state the employer can monitor and search any and all material on the employee’s computer; and

•The policy should clearly note the scope of, or restrictions on, the employer’s right to monitor or search, or when the right to search will be used.

Team Members ()

Publications ()

News ()

Pages ()

Services ()

Ontario Court of Appeal Finds Reasonable Expectation of Privacy in Work Computer

Published:

Share

Share

Related Services

Related Publications

5 Key COVID-19 Labour & Employment Litigation Learnings

3 Legal Tools to Help Foster a Diverse & Inclusive Workplace

Federal OHS Violence & Harassment Prevention: 10 Key Changes January 1, 2021

10 COVID-19 Workplace Vaccination Policy Tips

Tax Implications of Working from Home During COVID-19: 10 Employer FAQs

Atlantic Canada Minimum Wage Increases Effective April 1, 2021

10 Employer FAQs About Employee COVID-19 Testing & Vaccination

5 Key Privacy FAQs for Startups & Growing Businesses

Contracting Chaos: 5 Key 2020 Employment Contract Lessons

Waksdale v. Swegon North America Inc.: Cause for Termination Clause Concern

10 Ways Canada’s Consumer Privacy Protection Act (CPPA) Will Impact Privacy Practices

P.E.I. Workplace Harassment Prevention Obligations: 5 Key Regulatory Changes July 1, 2020

Matthews v. Ocean Nutrition Canada Ltd.: Employee Bonus Entitlement Lives On

Playing it Safe: Employer Obligations To Employees Working From Home

Uber Technologies Inc. v. Heller: One-Sided Standard Form Clauses May Be Unenforceable

Temporary Immigration Measures Make Hiring Temporary Foreign Workers Easier

Coping with COVID-19: Planning for Business Reopening

Coping with COVID-19: Employers’ Top 10 Immigration Law FAQs

Coping with COVID-19: New Requirements for Employer Relief

Atlantic Canada Minimum Wage Changes Effective April 1, 2020: More Than Wage Rates

Coping with COVID-19: (More) Employer FAQs

Coping with COVID-19: Employer FAQs

Amanda Nash in The Advisor by NLOWE | The Top 10 Employment Contract Terms

Atlantic Canadian Employees’ Rights & Employers’ Obligations at Election Time

5 Key Changes to N.L. OHS Workplace Violence & Harassment Prevention Obligations January 1, 2020

Managing Social Media @ Work: 3 Steps to an Effective Workplace Social Media Policy

5 Basics Every Startup & Growing Business Should Know About Employment Law

What the Privacy Commissioner’s New PIPEDA “Meaningful Consent” Guidelines Mean for Organizations

Atlantic Canada Minimum Wage Changes Effective April 1, 2019: In Like a Lamb

New N.B. Workplace Anti-Violence & Harassment Obligations April 1, 2019

Webinar | No Joking Matter: Complying with N.B. Workplace Anti-Violence & Harassment Requirements

What did you expect? Supreme Court of Canada’s highly nuanced “expectation of privacy” analysis in R. v. Jarvis

Immigration Law Compliance: 5 Key Best Practices for Human Resources Professionals

Privacy Interest in Personal Computer Contents: Supreme Court of Canada Confirms Ownership Isn’t 9/10 of the Law in R. v. Reeves

Collateral Damage: How Canada’s New Impaired Driving Penalties Will Impact Canadian Immigrants & Employers

10 Burning Employer FAQs About Cannabis @ Work

Webinar | 5 Key Immigration Law Compliance Best Practices for Human Resource Professionals

Sarah McInnes in workplace.ca | The Top 5 Immigration Law Facts Every HR Professional Should Know

Digital Privacy Act Mandatory Data Breach Response Obligations: 5 Key Focus Areas For Your Compliance Plan

The Digital Privacy Act: 5 FAQs About the Mandatory Data Breach Response Obligations Effective November 1, 2018

No Minimal Impact: Atlantic Canada’s 2018 Minimum Wage Increases

Extended Parental Leave in Atlantic Canada: What to Expect When Your Employee is Expecting

Webinar | 5 Workplace Policy Areas to Manage Marijuana Risks

Defining the Boundaries: Protecting Privacy & Privilege of Digital Content @ the Canadian Border

Medical Marijuana, Residual Impairment & The Duty to Accommodate in Re Lower Churchill Transmission Construction Employers’ Assn. Inc. and IBEW, Local 1620 (Tizzard)

The Global Talent Stream: 5 Practical Learnings About the Latest Immigration Star

Accommodating Mental Disability: 5 Practical Tips

N.S. Appeal Court puts a Lid on medical Pot: No health plan coverage & no workers compensation benefits in Canadian Elevator Industry Welfare Trust Fund v. Skinner & Skinner v. Nova Scotia (Workers’ Compensation Appeals Tribunal)

Webinar | #It’s Time: A 5-Step Sexual Harassment Risk Mitigation Strategy for Employers

More Valuable Than Money? The 5 Most Common Equity Compensation Plans

#It’s Time: A 5-Step Sexual Harassment Risk Mitigation Strategy for Employers

Be Diligent: 5 Practical Steps to Enforceable Workplace Policies

The Dope on Medical Cannabis Health Benefits: Key Considerations for a Coverage Strategy

How the Pros Get Into Canada: 5 FAQs About the NAFTA Professional Work Permit

The Legal Reality: Canadian Appeal Court decides “Virtual Presence” is enough for production order for user information against non-Canadian company in British Columbia (Attorney General) v. Brecknell

Denis Mahoney & Brittany Keating in the NLCA 2018 Construction Journal | Testing 1-2-3: The latest on drug & alcohol testing in safety-sensitive workplaces

Meghan Felt & David Nurse in the NLCA 2018 Construction Journal | The Atlantic Immigration Pilot: A test flight for the Newfoundland & Labrador construction industry

5 Helpful Holiday Hints for Human Resources

Protect Your Assets: 3 Best Practices for Intellectual Property (IP) Owners

No NAFTA? No Problem – For Temporary Business Travel, That Is

5 Employer “Family Status” Discrimination & Accommodation FAQs

Transformative Changes to Nova Scotia DB Funding Framework Possible

Relief is Here: N.S. Registered Defined Benefit Plans Get Temporary Solvency Funding Relief

Federal Human Rights Law: No Gender Identity or Expression Discrimination

Take Pride @ Work: 5 Ways Employers Can Support Gender Diversity

The Federal Court of Canada Puts the “Fair” in the Copyright Act’s “Fair Dealing” Exceptions in Canadian Copyright Licensing Agency v. York University

Jack Graham in Canadian Lawyer InHouse: Deconstructing the Workplace

Go Global @ Home: Supreme Court of Canada Confirms Global Order to Remove Internet Content in Google Inc. v. Equustek Solutions Inc.

Like it or Not: Supreme Court of Canada decides class action against Facebook can go ahead in B.C. – despite its terms of use in Douez v. Facebook, Inc.