Employers often provide employees with computers, tablets and smart phones to use while performing their duties. These are usually intended to fulfill their job responsibilities, but personal activities sometimes occur – checking personal email, online shopping and banking, posting on Facebook or just surfing the net. This causes personal information to end up on the device. If the device is owned by the employer, does the employee have any expectation of privacy over that information?
The Supreme Court of Canada has decided that an employee had a reasonable expectation of privacy in the personal use of his work laptop. The case is R. v. Cole. It’s a criminal law case and not an employment or labour law decision but it will likely affect those areas of law.
Cole was an Ontario high school teacher. He had a school issued laptop he used for both teaching classes and supervising a student laptop program. While supervising the laptop program he was able to remotely access data stored on student computers connected to the school’s network. With this capability he accessed a student’s data and discovered nude photographs of another student. He saved those photos on his work laptop along with other pornographic photos obtained from the internet. The school’s computer maintenance technician found the files on the laptop in the course of routine maintenance and virus scanning.
The technician brought it to the attention of the principal. The two of them proceeded to copy the data from Mr. Cole’s computer to compact discs. They turned the computer and discs over to the police who viewed the files to determine if the images constituted child pornography. The police carried out this search on the understanding that the computer belonged to the school and that there was consent to the search. Mr. Cole had not consented to the search and a warrant had not been obtained for the search of “his” computer. After Cole was charged with possession of child pornography, he brought a Charter challenge claiming his Section 8 rights to be free of unreasonable search and seizure were violated.
In 2010 the Supreme Court had ruled Canadians could reasonably expect privacy in the information contained on their own personal computers. That case, R. v. Morelli, involved an individual’s personal computer which was searched and seized in his home. The Cole case extended that expectation to workplace computers but the expectation is diminished. The Court ruled “that Canadians may reasonably expect privacy in information…on work computers, at least where personal use is permitted or reasonably expected. Computers that are reasonably used for personal purposes – whether found in the workplace or the home – contain information that is meaningful, intimate, and touching on the user’s biographical core. Vis a vis the state, everyone in Canada is constitutionally entitled to expect privacy in personal information of this kind.”
The Court said that workplace policies may diminish the expectation of privacy but they would not remove it entirely. “Whatever the policies state one must consider the ‘totality of the circumstances’ in order to determine whether privacy is a reasonable expectation in the particular situation.” In assessing the expectation of privacy the “operational realities” must be considered – those realities included a policy and actual practice within the school permitting the personal use of the laptop, the ownership of the laptop by the school and a policy and technological reality that deprived Cole of exclusive control over the personal information he chose to record on the laptop.
The Court found Cole had a reasonable expectation of privacy over the information contained on his workplace computer and that his Charter rights had been infringed with the warrantless search and seizure of his work laptop. But it admitted the evidence anyway, concluding that doing so would not bring the administration of justice into disrepute.
For employers the case is a cautionary reminder – ensure your policies and practices on the use of workplace computers are reasonable, be sure employees know that you will be monitoring their use and clearly identify the reasons you may need to access personal information on computers you own but are provided to them for their exclusive use. In addition, before accessing an employee’s personal information on a workplace device confirm you have reasonable grounds to access the information and that doing so would not contravene any applicable privacy legislation.