When does an employee have a 'reasonable expectation' of privacy?

A recent Supreme Court of Canada (SCC) trial decided in the favour of two Ontario teachers whose private communication had been viewed, recorded and shared them with the school board, which used the screenshots to issue reprimands.

The decision, York Region District School Board v. Elementary Teachers’ Federation of Ontario, overturns an arbitrator’s decision dating back to 2015, when the teachers’ union filed a grievance against the disciplinary action, saying the teachers’ right to privacy at work had been violated.  

A judicial review by a Divisional Court upheld the arbitrator’s decision, then the Court of Appeal unanimously allowed the union’s appeal, finding that the principal’s viewing of the teacher’s laptop was a violation of Section 8 of the Canadian Charter of Rights and Freedoms.

Lack of laws means employers are responsible for making the rules

The decision hinged on whether the teachers, who had been communicating on a cloud-based, password-protected platform but on a school laptop, could have had a “reasonable expectation” of privacy.

“In Ontario, there is no general privacy legislation that applies to the employer-employee relationship of a provincially-regulated company, or for a charity for that matter,” says David Canton, technology and privacy law lead for Harrison Pensa in London.

“Now, what we're seeing is the provincial government has, over the last couple of years, put in a smattering of little bits and pieces of privacy legislation, in the Working for Workers Acts … it's very much dependent on the facts, and there's a bunch of privacy holes that aren't covered, technically.”

Because of this “constitutional gap”, Canton says, employers need to be very clear about their employee privacy policies. Most employers treat the employer-employee relationship as one that is highly confidential, but there is no statute that makes it mandatory: “the private legislation applies to how you treat your customers. There's really no legislation that applies to how that entity treats its employees.”

Vague employee privacy policies open to interpretation

Too-vague policies can be a problem, says Puneet Tiwari, partner at Levitt Sheikh in Toronto.

For example, in Ontario, most employers are mandated to inform employees if they are being monitored. But the law is not clear on how specific the policies need to be, and it doesn’t rule out monitoring – just the lack of communication about it.

“If the employee thinks that they're not being monitored 100% of the time, and that when they log in and they check their own email there, they think it's private, then that right to privacy exists,” says Puneet.

“Here, the principal went in and kind of snooped around … there is a right to privacy from wandering eyes, or from an overzealous principal who might be snooping around. But if it's either inadvertently shared, or shared within some other context for an investigation, it's fair game.”

Court’s view on reasonable expectation of privacy

The SCC decision examined when an employee might have reasonable expectation of privacy, finding that the employer guides that expectation through its policies.

“Inevitably, the reasonable expectation of privacy takes its colour from context,” the decision read. “Thus, the employer’s operational realities, policies and procedures may affect the reasonableness of an employee’s expectation of privacy. […]  the storing of personal information on a computer owned by the employer and the existence of a policy stating that data so stored belongs to the employer would tend to diminish the reasonable expectation of privacy. On the other hand, permitting employees to use work laptops for personal purposes would weigh in favour of the existence of a reasonable expectation of privacy.”

In York, the principal said he touched the mouse of the teacher’s laptop while he was in her classroom, and that the computer opened to the cloud-based program and the messages. He was already aware of the “log”, which was kept by two teachers in relation to complaints about a third.

The principal stated he didn’t believe the teachers should have had a reasonable expectation of privacy, because the log was kept on a school board laptop which was left open and accessible.

“It's kind of fuzzy where that line is on reasonable expectation of privacy,” says Canton.

“If I happen to have my Facebook page or TikTok or LinkedIn open on a work computer, at the time the employer happened to be looking at it for some reason, is it then fair game? I would suggest that, based on this case, it probably is not fair game, that there would be a reasonable expectation of privacy there.”

Drafting employee privacy policies and corporate style

Since employee privacy laws are still largely unaddressed at the provincial level, Canton continues, it’s important for employers to determine what approach is suitable for their organisation.

Generic policies can be easier to understand and to draft, but can be open to interpretation, he explains, while more detailed policies can also be risky.

“If you get too detailed, then the risk is that if you miss something, or there's a situation that comes up that isn't covered in the detail, then that can come back to haunt you too,” he explains. “You have to sort of decide what your corporate style is of drafting these kinds of policies, and where you want to land on that.”

Privacy laws are becoming more “prescriptive,” Canton says, with new legislation on the way that would replace parts of the current Personal Information Protection and Electronic Documents Act (PIPEDA).

Bill C-27, if passed, won’t fill all of the “constitutional gaps,”he continues. “But these privacy laws in general can even get more prescriptive and specifying more detail and requiring More detail in things like privacy management programs and things like that. So I think it's,

I think over time, it may shift a little bit towards the employee side compared to what it is now.

I think it's going to like, who knows how long, but I think the privacy laws are tending to be coming a little more prescriptive than they used to be, as opposed to just general principles.