Monitoring email, blogs and Internet usage by employers raises questions about expectations of privacy at work
Courts and adjudicators have recognized that employers have a legitimate interest in monitoring the workplace for productivity, security and protection of business interests. But there is a balance between the employer’s right to know about employees’ computer use and to manage the workplace and employee privacy rights in a work environment that is continually evolving and adapting to new forms of technology and electronic communications.
Privacy is increasingly recognized as an important value in society. The introduction of federal and provincial privacy legislation across Canada has changed the way many organizations do business. This legislation has also generated heightened concerns about the collection, use and disclosure of personal information. The issue is whether — and to what degree — employees are entitled to privacy in the workplace.
As a starting point, if an employer has expressly advised employees that any documents created, sent or received on its computer network are not treated as private and may be monitored or reviewed by the employer, then employees have no reasonable expectation of privacy. The employer may thus monitor usage and open or retrieve employee files stored upon the employer’s machines regardless of whether the files are personal or work-related.
It has also been recognized that the expectation for personal privacy is lower when employees use their employer’s email system, as opposed to communicating via private letter or private telephone conversation.
The Devon case
Most employers who provide computers for business purposes implement policies that limit personal use and prohibit inappropriate use. In 2009, the Alberta Court of Appeal emphasized the importance of employers adopting and enforcing these policies in its decision in Poliquin v. Devon Canada Corp.
Claude Poliquin was a long-time employee of Calgary-based oil and natural gas company Devon Canada, where he had supervisory responsibilities over other employees. Devon had a code of conduct that included a provision on appropriate computer use. The company permitted employees to use its computers for limited personal use, but specified the system “should not be used for sending pornographic, obscene, inappropriate or other objectionable messages or attachments via e-mail.” Poliquin acknowledged he had read, understood and accepted the terms in the code of conduct.
However, Poliquin violated the computer-use policy on several occasions by forwarding pornographic, derogatory and racist emails. Apart from these incidents, he was considered a valued employee and had received positive performance appraisals and exemplary performance ratings. Devon dismissed him for cause and the Alberta Court of Appeal upheld this decision.
In addition to observing limits on employees’ privacy in the workplace, the court acknowledged the right of employers to monitor computer usage and stated that “the workplace is not an employee’s home; employees have no reasonable expectation of privacy in their workplace computers.”
The court also acknowledged that an employee’s misuse of the employer’s computer system to access, receive and disseminate inappropriate materials could:
•Compromise the employer’s reputation in the community, as email messages forwarded from work computers often carry the organization’s signature and may be viewed as sent on behalf of the organization
•Adversely impact the work environment
•Diminish the productivity of the employee in question
•Expose the employer to lawsuits for failing to protect its employees from harassment or discrimination
•Introduce worms and viruses “through inappropriate accessing of pornographic or racist websites, or through receiving tainted material downloaded from these websites.”
In light of these significant risks, the court concluded “an employer is entitled not only to prohibit use of its equipment and systems for pornographic or racist purposes, but also to monitor an employee’s use of the employer’s equipment and resources to ensure compliance.”
Tips for employers
An effective email and Internet policy should include:
•A statement that the equipment is provided for business use.
•A statement that employees should have no expectation of privacy and the company may monitor and review the employee’s use, including opening email messages.
•Guidelines for acceptable personal use, which should contain a statement concerning the type and nature of content that constitutes inappropriate usage, including verbal abuse, defamation, sexually explicit or derogatory, racist, obscene or other offensive communications.
•A statement prohibiting any employee from receiving, viewing, accessing or sending any materials that are contrary to human rights legislation or the Criminal Code.
•A requirement that employees must comply with all copyright, patent and trademark rights, including a prohibition on any unauthorized downloading, transfer or other use of such material.
•A prohibition on the use of the electronic networks for the purposes of soliciting or otherwise advancing any personal business or activity of an employee, such as political or religious interests.
•Other rules or practices recommended by your IT manager to ensure the effective and safe functioning of the system (such as virus checks and password rules).
•A warning that employees will be subject to discipline up to and including termination of employment for violations of the policy.
Steps should be taken to ensure the policy is brought to employees’ attention and that in the event of an infraction, the employer can prove that the employee was aware of the policy. Proof may be obtained by having employees sign and return a copy of the policy, which is then kept in their personnel file, or by having employees perform an electronic acknowledgement when they log on, of which an electronic copy is preserved.
When it comes to the right to monitor email, social media and Internet usage in the workplace, the law is clearly on the side of employers. Courts and adjudicators have recognized limits on employees’ privacy in the workplace, and therefore employers have considerable judicial support regarding the expression “Big Brother is watching.”
For more information see:
•Poliquin v. Devon Canada Corp., 2009 CarswellAlta 903 (Alta. C.A.).
Tina Giesbrecht and Toni Eckes practice labour and employment law with McCarthy Tétrault in Calgary. Tina can be reached at (403) 260-3582 or [email protected]. Toni can be reached at (403) 260-3570 or [email protected].
-------------------------
Expectation of privacy for personal files?
Though Poliquin v. Devon Canada Corp. established limited privacy rights for employees when it comes to material on work computers, the Ontario Court of Appeal recently released a decision that may scale back an employer’s right to peek into employee files.
Sudbury, Ont., communications technology teacher Richard Cole was charged with possessing child pornography after numerous explicit images of an underage female student were found on his work laptop computer. Cole was responsible for checking out students’ emails and files on the school system and came across the images, which he copied onto the laptop he had been issued by the school.
A computer technician found the images on Cole’s laptop while doing maintenance and informed the school principal, who asked Cole to turn in the laptop for a search by a school board official. The official copied the Internet browsing history onto a compact disc and turned over the laptop and disc to police. After police searched the materials, Cole was charged.
The Court of Appeal agreed with Cole’s argument that his charter rights were violated by the police when it searched the files from his personal Internet browsing. However, the court found the images found by the school technician were acceptable as evidence because the technician’s search was part of normal maintenance procedure and not beyond reasonable expectations of privacy for the laptop. The technician also only searched and copied the images and didn’t delve further into Cole’s personal files.
