Supreme Court of Canada opines on employee expectations of privacy on company-provided laptop
By Stuart Rudner
Last week, the Supreme Court of Canada released its decision in R. v. Cole, a case about a high school teacher charged with possession of child pornography that was found on his school-provided laptop. So what does the decision mean for employers and their right to search or review the data on the equipment they own?
There is some disagreement among employment lawyers about the impact of this decision upon employers’ rights to monitor and discipline their employees. Some, such as Ottawa employment lawyer Sean Bawden, a fellow blogger whom I hold in high regard, has opined that:
"What that decision in Cole stands for, I would submit, is that employers have the right to access the technology that they provide to their employees, for the purposes of updating or maintaining that technology — but that simply because employers are permitted to use that technology does not entitle them to ‘snoop’ through their employee’s personal affairs."
My view is somewhat different. While the decision in Cole confirms the employee’s expectation of privacy, albeit a diminished one, the entire decision must be read in context: A criminal proceeding considering the protections afforded against the unlawful intrusion of the state. Specifically, the analysis was not whether the employer had the right to review the contents of the laptop, but whether the police had such a right and, ultimately, whether their findings could be as evidence in the criminal prosecution. The analysis was based upon the impact of section eight of the Charter of Rights and Freedoms.
As a result, in my opinion, this case has not changed the rights of employers. However, it does have the potential to. The court’s conclusions are not necessarily binding on future courts considering employment law issues, but they may be persuasive. And the court’s conclusions do suggest that an employee may have an expectation of privacy with respect to personal information even if:
•it is stored on company-owned equipment
•there are policies in place confirming that the employer owns the equipment and all information stored on it
•there are policies in place warning that employees should have no expectation of privacy.
In Cole, the school had provided the employee with a laptop to use in teaching communication technology and in supervising a laptop program for students. Ironically, he was responsible for “policing” student use of laptops. During routine maintenance, one of the school’s computer technicians found nude images of a Grade 10 student on the hard drive. The principal directed the technician to copy the images and the Internet files from Cole’s web surfing history. The copies and the laptop were turned over to the police, who searched them without a warrant. Cole was charged criminally, and the sequence of court decisions demonstrates the uncertainty in the law:
- The trial judge refused to admit the files found on the laptop into evidence as they had been obtained without a warrant contrary to section eight of the Charter of Rights and Freedoms.
- The Court of Appeal held the disc containing photos was admissible as Cole had no expectation of privacy.
- The Supreme Court of Canada found there was a diminished expectation of privacy and section eight had been breached, but that the evidence should be admitted into evidence nonetheless.
With respect to the comments made by the Supreme Court in reaching its decision, some of the more relevant ones include:
•The court left no doubt in R. v. Morelli… that Canadians may reasonably expect privacy in the information contained on their own personal computers. In my view, the same applies to information on work computers, at least where personal use is permitted or reasonably expected.
•While workplace policies and practices may diminish an individual’s expectation of privacy in a work computer, these sorts of operational realities do not in themselves remove the expectation entirely.
•Cole expected a measure of privacy in his personal information on the laptop. Even taking into account the relevant workplace policies, this expectation of privacy was reasonable in the circumstances. It was, however, a diminished expectation of privacy in comparison with the privacy interest considered in Morelli ― which, unlike this case, involved a personal computer that belonged to Morelli and was searched and seized in his home.
•The lawful authority of his employer — a school board — to seize and search the laptop did not furnish the police with the same power.
•Whether Cole had a reasonable expectation of privacy depends on the “totality of the circumstances”. The “totality of the circumstances” test is one of substance, not of form. Four lines of inquiry guide the application of the test: (1) an examination of the subject matter of the alleged search; (2) a determination as to whether the claimant had a direct interest in the subject matter; (3) an inquiry into whether the claimant had a subjective expectation of privacy in the subject matter; and (4) an assessment as to whether this subjective expectation of privacy was objectively reasonable, having regard to the totality of the circumstances.
•Computers that are used for personal purposes, regardless of where they are found or to whom they belong, “contain the details of our financial, medical, and personal situations”.
•While the ownership of property is a relevant consideration, it is not determinative.
•Even as modified by practice, however, written policies are not determinative of a person’s reasonable expectation of privacy.
Given that the issue to be decided by the court was whether Cole’s section eight rights had been breached, my view remains that this decision was not intended to impact employment law principles directly.
As Justice Fish wrote for the Court: “I leave for another day the finer points of an employer’s right to monitor computers issued to employees.”
That said, some of the analysis of expectation to privacy may be relevant to future consideration of employer rights in employment law matters that do not involve police seizures and criminal prosecutions. If so, an employer’s right to search its own equipment may, and I stress the word “may,” not be as strong as many of us have previously thought.
In the meantime, I continue to recommend what I always have — that employers implement and enforce clearly-worded policies that warn employees not to expect that any information stored on corporate equipment is private. They should consider whether to authorize personal use at all, and they should monitor usage.
As someone once said recently, employers should make it clear to employees that “if you don’t want us to see it, don’t put it on our computer.”