In its recent decision of R. v. Cole, 2012 S.C.J. No. 53, the Supreme Court of Canada held that employees who use employer-provided computers may have a reasonable expectation of privacy where personal use is permitted by the employer or reasonably expected. This expectation of privacy would, however, depend on the totality of the circumstances and could be diminished depending on the workplace policies and practices of the employer.
Facts
Cole was a high school teacher. In addition to his teaching duties, he was responsible for policing the use of the networked laptops of the students. The school board had provided Cole with a laptop for his work and permitted him to also use it for personal purposes. The use of the laptop was subject to the school board’s Policy and Procedures Manual, which stated that teachers’ e-mail correspondence would be private but could be subject to access by school administrators in certain situations. There was no clear and unambiguous policy that the laptops provided to teachers by the school board would be subject to general or random monitoring and searching. However, the Policy and Procedures Manual stated that “all data and messages generated on or handled by board equipment are considered to be the property of the [school board]”.
A technician performing maintenance activities on Cole’s laptop found a hidden folder with nude and partially nude photographs of an underage female student. The technician copied the photographs onto a disc and informed the principal of what he had found. The laptop was seized and school board technicians copied the temporary internet files onto a second disc. The laptop and the two discs were then handed over to the police. The police reviewed the contents of the laptop and the discs without a warrant and created a mirror image of the hard drive for forensic purposes.
Case history
Cole brought a preliminary application to have the laptop-related evidence excluded on the basis that it violated his right to privacy under the Canadian Charter of Rights and Freedoms, as he had a reasonable expectation of privacy in the contents of the laptop and the police had obtained the information without a warrant. The trial judge agreed and refused to admit the laptop-related evidence. On appeal, the Superior Court of Justice disagreed and held that Cole did not have a reasonable expectation of privacy in the contents of the laptop.
When the matter went before the Ontario Court of Appeal, the Court of Appeal set aside the Superior Court’s decision and held that Cole had a limited reasonable expectation of privacy in the use of the laptop. The Court of Appeal held that the evidence seized from the laptop, except for the photographs of the student on the first disc, was inadmissible because the school board did not have a clear and unambiguous policy that school board-issued laptops would be subject to monitoring and search. The photographs taken by the technician were, however, admissible, because Cole did not have a reasonable expectation of privacy with regard to maintenance work that had to be done on the laptop by the school board for the purpose of maintaining the integrity of the school board’s network. The Court of Appeal also ordered a new trial.
Supreme Court decision
On appeal to the Supreme Court of Canada, the Supreme Court allowed the Crown’s appeal and set aside the Court of Appeal’s order excluding the evidence seized from the laptop.
The Supreme Court stated that the question of whether Cole had a reasonable expectation of privacy depended on the “totality of the circumstances”. In this regard, two of the four questions that the Court said needed to be answered were: (a) did Cole have a subjective expectation of privacy in the data; and (b) was the subjective expectation of privacy objectively reasonable having regard to the totality of the circumstances?
The Court concluded that Cole did have a subjective expectation of privacy in the informational content of his laptop and that this could be inferred from his use of the laptop to browse the Internet and to store personal information on the hard drive. In determining whether the subjective expectation was objectively reasonable, the Court stated that on a balance, the totality of the circumstances supported the objective reasonableness of Cole’s subjective expectation of privacy. However, the ownership of the laptop by the school board, the workplace policies and practices, and the technology in place at the school, diminished Cole’s privacy interest in his laptop. Based on this diminished expectation of privacy in the contents of the laptop, the Court concluded that although the non-consensual examination and seizure of the laptop was an unauthorized search and seizure within the context of the criminal law and the Charter, the admission of the evidence would not bring the administration of justice into disrepute and should not be excluded.
Because Cole did not challenge the initial inspection of the laptop by the technician in the context of routine maintenance activities, the Court noted that it would leave for another day “the finer points of an employer’s right to monitor computers issued to employees”.
Lessons for Employers
R. v. Cole is a criminal law case and the Supreme Court’s decision regarding an employee’s expectation of privacy in the use of an employer-provided computer is in the context of unreasonable search and seizure and Charter rights. Also, private sector employers are not subject to the Charter. Nevertheless, this decision and the Supreme Court’s reasoning will provide guidance to arbitrators, courts and tribunals when they are called upon to determine employee privacy rights in the workplace.
The decision in R. v. Cole reinforces the need for employers to have a clear and unambiguous policy with regard to the use of employer-provided computers and other electronic equipment and the data on such equipment. The policy should state that while the employer respects the privacy of its employees, employee privacy does not extend to the use of employer-provided computers and other equipment, e-mail communications, Internet usage and any data stored on company equipment. The policy should make it clear that Internet and e-mail use may be monitored from time to time without prior notice being given to the employees and that the employer will periodically access the computers and other equipment to ensure compliance with the policy.
Employers need to ensure that every employee reads and acknowledges the policy and agrees to abide by it. This should not be just a one-time sign off because employees could easily forget the terms of the policy. Consequently, employees should be reminded of the policy intermittently and asked to re-read, re-acknowledge and sign off on the policy at least once a year. If the policy is updated, it should be brought to the attention of employees immediately and they should be asked to sign off on the updated policy.
Finally, the policy should also clearly state the penalties for breach and the employer must deal with any breaches quickly, firmly and uniformly. It is always advisable to seek legal counsel if the circumstances warrant termination of employment or police involvement.
