Employer ownership of technology ‘diminishes’ but doesn’t eliminate privacy of employee information
The Supreme Court of Canada has found employees should expect some level of privacy when it comes to personal information on workplace technology, but that expectation is tempered somewhat if the employer owns the equipment.
Richard Cole was a high school teacher criminally charged with possession of child pornography — among other things — after photographs of a nude underage female student were discovered on his work laptop. Cole had been provided with the laptop and held domain administration rights as a supervisor of a laptop program for students. He had access to the networked hard drives of the students’ laptops, and thereby came into possession of the photos.
The school board’s Policy and Procedures Manual governed Cole’s laptop use. The manual permitted personal use of the computer, but prohibited the storage of sexually explicit material. The manual further deemed “all data and messages generated on or handled by board equipment” to be the property of the school board. Evidence further suggested that the school’s acceptable use policy, warning students not to expect privacy in respect of files placed on their laptops, also applied to teachers. In fact, the school principal had advised staff at several meetings that whatever rules applied to students also applied to staff. The manual did not, however, provide for the search of computers, nor did it address the issue of privacy except to state that administrators could open private email to address the network’s health or if inappropriate use was suspected. When such action was required, the manual stated that the user’s permission would first be sought. Cole’s laptop was protected by his password.
Incriminating photos found during maintenance check
While performing maintenance of the school’s network, a computer technician found the photographs in question on Cole’s computer and remotely made a CD copy of them. The school board eventually obtained the laptop and made a CD copy of Cole’s temporary internet files. The laptop and the discs were given to the police, who conducted a review of the items without a warrant. One question before the Supreme Court was whether Cole had a reasonable expectation of privacy that prohibited this seizure and search.
The court’s analysis reviewed the “totality of circumstances” of Cole’s workplace and involved an objective assessment of his subjective expectations. After ruling that Cole’s privacy interest and expectation “(could) be readily inferred from his use of the laptop to browse the Internet and to store personal information on the hard drive,” the court examined whether Cole’s subjective expectation of privacy was objectively reasonable. The court then held that “computers that are used for personal purposes, regardless of where they are found or to whom they belong,” contain private information falling at the heart of our constitutionally protected “biographical core,” particularly in cases where the computer is used to browse the Internet. Workplace policies, practices, and customs “are relevant to the extent that they concern the use of computers by employees,” the court held, stating “these ‘operational realities’ may diminish the expectation of privacy that reasonable employees might otherwise have in their personal information.” Nonetheless, ownership and policies, “even as modified by practice,” are not determinative.
The court ultimately found that Cole’s privacy expectation was supported by “written policy and actual practice that permitted him to use his work-issued laptop for personal purposes.” However, his expectation was “diminished” by the school board’s ownership of the laptop, workplace policies and practices, and the technology in place at the school. Ultimately, the court found that Cole’s privacy was constitutionally protected and had been violated by the police. Applying charter jurisprudence, the court went on to find, however, that the evidence obtained by the police was admissible.
Importantly, the court’s decision arose in a criminal context in which allegations of state intrusion upon constitutional protections attract significant scrutiny. The decision’s impact on private employment relationships and related civil disputes is not entirely clear and therefore should not be exaggerated. As Cole did not challenge the initial inspection of his laptop by school board officials, the court left for “another day the finer points of an employer’s right to monitor computers issued to employees.” It remains to be seen whether the invasion of an employee’s privacy will affect the admissibility of evidence that otherwise establishes cause for dismissal, particularly in a case such as this involving egregious and unlawful misconduct.
Policies outlining use of technology can clarify things
Nevertheless, R. v. Cole does provide employment lawyers and their clients with some guidance to the balancing act in which a court will likely engage when reviewing workplace privacy rights. Conflicting policies and practices led the court to find in Cole’s favour. Thus, where the protection of employer interests is concerned, the implementation of workplace policies describing acceptable and prohibited use of workplace technology, strict limitations on privacy, and circumstances of monitoring employees would be well-advised, as would consistent and regular enforcement of such policies. See R v. Cole, 2012 CarswellOnt 12684 (S.C.C.).
