Privacy Law Update

On Friday, October 19, 2012, the Supreme Court of Canada issued its decision on R. v. Cole.  [If you would like to read the full case, please refer to the following link to this Case]

BACKGROUND

The case involved a high school teacher who had stored a nude picture of an underage female student on his school-owned laptop computer.  Shortly after the IT administrator found the picture file when conducting a routine search for viruses, the teacher was required to hand over the laptop to the school principal.  The school then turned the laptop over to police, who subsequently charged the teacher with possession of child pornography.  No search warrant was obtained, because the computer belonged to the school, not the teacher.
 
In issue was whether the teacher had a reasonable expectation of privacy and whether the ownership of the laptop was sufficient to conduct a search and seizure without a warrant (presumably in breach of the teacher’s Charter rights).

DECISION

The majority of the Supreme Court of Canada decided that both home and workplace computers that are used for personal purposes contain information “that is meaningful, intimate, and touching on the user’s biographical core.” On that basis, employees should be able to expect some reasonable degree of privacy when personal use of employer-owned computers is allowed.

The Court noted that while ownership of the computer is a “relevant consideration”, that does not fully decide the issue of an employee’s expectation of a right to privacy.  Similarly, while the employer’s workplace policies on employee use of the employer’s computers, networks and email may also be relevant, these policies would only diminish (but not eliminate) an employee’s reasonable expectation of privacy.  On that basis, a “reasonable though diminished expectation of privacy is nonetheless a reasonable expectation of privacy.” 

The following excerpts provide important comments from the Supreme Court of Canada around the employer-employee privacy issues (Note: underlines provided for emphasis only, and do not appear in the original decision):

“The context in which personal information is placed on an employer-owned 
computer is nonetheless significant.  The policies, practices, and customs of the 
workplace are relevant to the extent that they concern the use of computers by 
employees.  These “operational realities” may diminish the expectation of privacy 
that reasonable employees might otherwise have in their personal information.”

“Even as modified by practice, however, written policies are not determinative of a 
person’s reasonable expectation of privacy.  Whatever the policies state, one must 
consider the totality of the circumstances in order to determine whether privacy is 
a reasonable expectation in the particular situation.”

In this case, the operational realities of Mr. Cole’s workplace weigh both for and 
against the existence of a reasonable expectation of privacy.  For, because written 
policy and actual practice permitted Mr. Cole to use his work-issued laptop for 
personal purposes.  Against, because both policy and technological reality deprived 
him of exclusive control over — and access to — the personal information he chose 
to record on it.

 As mentioned earlier, the Policy and Procedures Manual stated that the school 
board owned “all data and messages generated on or handled by board equipment". 
Moreover, the principal reminded teachers, annually, that the Acceptable Use Policy 
applied to them.  This policy provided that “[t]eachers and administrators may 
monitor all student work and e-mail including material saved on laptop hard 
drives”, and warned that “[u]sers should NOT assume that files stored on network 
servers or hard drives of individual computers will be private”.

The “totality of the circumstances” consists of many strands, and they pull in 
competing directions in this case.  On balance, however, they support the objective 
reasonableness of Mr. Cole’s subjective expectation of privacy.

 The nature of the information in issue heavily favours recognition of a 
constitutionally protected privacy interest.  Mr. Cole’s personal use of his work-
issued laptop generated information that is meaningful, intimate, and organically 
connected to his biographical core.  Pulling in the other direction, of course, are the 
ownership of the laptop by the school board, the workplace policies and practices, 
and the technology in place at the school.  These considerations diminished Mr. 
Cole’s privacy interest in his laptop, at least in comparison to the personal 
computer at issue in ‘Morelli’, but they did not eliminate it entirely.

 The fact that the school board had acquired lawful possession of the laptop for its 
own administrative purposes did not vest in the police a delegated or derivative 
power to appropriate and search the computer for the purposes of a criminal 
investigation.

CONCLUSION

It is clear that employers who have comprehensive workplace policies and practices that reserve the right to ‘search’ employer-owned computers, emails and networks for improper activities or content remains a crucial requirement for justifying any electronic ‘searches.’  However, it is only relevant and not determinative of the employee’s reasonable expectation of privacy when personal use of internet, email and computer equipment or networks are permitted through either practice or policy.  Employers should review and update their workplace policies and practices to ensure that they are compliant with the latest approach by the courts.

[Note:  this case dealt with the application of the Charter of Rights and Freedoms arising from a criminal investigation involving search and seizure by the police. Generally, non-government organizations are not subject to the Charter’s reach, so much of the discussion in the case around the employee’s Charter rights would not apply. Many of the comments about employees’ privacy rights are in this context, and may have limited application to your particular situation.  If you are unsure whether your organization falls within the normal reach of the Charter of Rights and Freedoms, you should seek legal advice.]

The Labour and Employment Practice Group at McDougall Gauley LLP regularly advises clients on the establishment and administration of organizational policies that include use of the employer’s computers, networks and email systems.