Some expectation of privacy with workplace computers: SCC

Criminal ruling could have implications in civil context
By Sarah Dobson
|Canadian HR Reporter|Last Updated: 11/17/2012

The recent Supreme Court of Canada ruling of R v. Cole has generated a lot of talk around the issue of employee privacy when it comes to the personal use of workplace computers. While the decision was about employee rights when it comes to unlawful search and seizure by the state under the Canadian Charter of Rights and Freedoms, it has implications for private sector employers, according to legal experts.

Private employers don’t need to panic because the court made no comment with respect to their right to monitor an employee’s computer use, said Bettina Burgess, a senior associate at law firm Gowlings in Waterloo, Ont.

“That’s not to say, however, that employees are not going to use this decision or attempt to use this decision to enforce privacy rights against their private employer,” she said. “They might rely on the Cole decision to say, ‘Even though I’m at work and using my employer’s computer, because my employer has allowed me to use it for personal use, I have a heightened expectation of privacy.’”

Privacy commissioners, courts and arbitrators will import these charter values around privacy and search and seizure in evaluating how to deal with the collection and use of personal information when it affects employees’ rights, said Ryan Berger, a partner at law firm Bull Houser in Vancouver.

“The case will be instructive and helpful to courts and arbitrators on both sides when examining that and how that works. It is a clear case that’s talking about work-issued computers and there aren’t a whole lot of cases on that, certainly not that go as high up as this one,” he said.

The ruling involved Richard Cole, a high-school teacher in Sudbury, Ont., who was allowed to use a work-issued laptop computer for personal use.

A technician doing maintenance found a hidden folder containing nude photos of a female student, so the technician notified the principal and they then copied the photos and temporary Internet files onto CDs. These were handed over to police who, without a warrant, reviewed their contents and copied them.

Cole was charged with possession of child pornography and unauthorized use of a computer. However, the trial judge excluded all the computer material pursuant to the Canadian Charter of Rights and Freedoms.

But the Ontario Court of Appeal said the disc with the photos of the student was legally obtained and, therefore, admissible while the disc containing the temporary Internet files, the laptop and the copy of the hard drive were not.

As the trial judge had wrongly excluded this evidence, the court of appeal ordered a new trial.

Privacy may be expected

Computers that are used for personal purposes in the workplace contain information “that is meaningful, intimate and touching on the user’s biographical core,” said the six Supreme Court judges (one dissented). “This case involves highly revealing and meaningful information about an individual’s personal life — a factor strongly indicative of a reasonable expectation of privacy.”

Canadians may expect privacy in the information contained on these computers when personal use is permitted or expected, said the court, adding ownership of the property is a relevant consideration but “not determinative.”

While workplace policies and practices may diminish a person’s expectation of privacy in a work computer, “operational realities” do not remove the expectation entirely, it said.

“Whatever the policies state, one must consider the totality of the circumstances in order to determine whether privacy is a reasonable expectation in the particular situation.”

In this case, the police infringed Cole’s rights under the charter, said the Supreme Court, which ordered a new trial.

“The totality of the circumstances support the objective reasonableness of the accused’s subjective expectation of privacy.”

The issue of employee monitoring is still an open question that has not been decided, so don’t assume the employer has that right, said Frank Addario, founder of the Addario Law Group in Toronto and one of the lawyers representing Cole.

“That’s a big issue, as to whether or not you can give an employee an electronic device, encourage them to use it for personal purposes and then spy on them under the guise of technical maintenance,” he said. “That has to be litigated, sorted out by the courts and by arbitrators in the employment law context.”

But the issue has been reasonably well-settled in a couple of contexts, said David Fraser, a partner at law firm McInnes Cooper in Halifax. For example, in the employment and employment law context, regardless of how evidence is collected, it’s usually admissible in any proceeding relating to the dismissal or discipline of an employee.

In an arbitral jurisprudence where there’s a collective agreement, the way an investigation is carried out can have an impact on the admissibility of evidence in any sort of grievance arbitration, he said.

“The Supreme Court of Canada case is going to have a bigger impact in the labour law context than the employment law context.”

The ruling will be useful in jurisdictions with privacy laws related to the workplace, such as Alberta and British Columbia and federally, said Fraser.

“(It) provides ammunition that, depending on the circumstances, it’s not unreasonable for employees to expect privacy in devices and information they put on those devices.”

How should employers respond?

As a result of the Cole ruling, employers should carefully consider how they monitor employee computer use and whether it’s appropriate, said Burgess.

For example, it’s not recommended a team of employees review employees’ emails all day but it’s OK to investigate if there’s a reasonable suspicion a worker is engaging in misconduct, she said.

However, it’s advisable to tell the employee first, unless the investigation is going to be disrupted by doing so, said Burgess, adding surreptitious monitoring is more appropriate if an employee is engaged in serious illegal conduct, such as child porn, and in that case the police should also be involved.

Employers should look at developing appropriate policies and practices that are closely aligned to the circumstances of their workplace, said Berger.

“If the policy is out of touch with reality, a court’s not going to pay much attention to it. But if that policy is reinforced by actual practice and speaks to the expectations an employee might realistically have, then I think it will carry a lot of weight.”

Context is important in looking at how that policy is communicated and enforced, what control the employer has over the device and whether passwords are needed, said Fraser.

“This happens very often in Supreme Court of Canada cases — they will state the principles and state the factors, but won’t necessarily provide the formula by which those need to be applied in all cases, recognizing that everything is context-specific.”

Add Comment

  • *
  • *
  • *
  • *