Previously published in Law Times, 5 November, 2012.
In his classic novel 1984, George Orwell imagined a world where
Big Brother was always watching. Whether it be on the street or in
your own home, the government was being constantly vigilant in
monitoring the activities of all of its citizens. It was a
frightening and sober commentary on the potential reach of new
technologies.
In many ways, Orwell's vision has become reality. The
interconnectivity of the digital era not only allows each and every
one of us access to the world's libraries but also to view
satellite images of anywhere on Earth.
In this day of information overload and social media, is there any
room remaining for privacy? The Supreme Court of Canada, in its
recent decision in
R. v. Cole, has reaffirmed that there is.
In Cole, the court considered whether there was a reasonable
expectation of privacy for a computer found in the workplace.
Richard Cole was a high school teacher who was responsible for
policing the use by students of their own networked laptops. To
this end, the school board supplied Cole with a laptop computer it
owned.
One of the school technicians, while performing maintenance
activities on Cole's computer, discovered a hidden folder
containing nude and partially nude photographs of an underage
female student. The school administration then had the technician
make CDs containing the photographs as well as the temporary
Internet files showing the sites Cole had accessed. The board gave
the laptop and the two CDs to the police. The police reviewed the
computer and CDs without a warrant and charged Cole with possession
of child pornography and unauthorized use of a computer.
A motion was brought to exclude the computer evidence as being
contrary to s. 8 of the Charter of Rights and Freedoms. Cole,
unfortunately, did not challenge the initial inspection of the
laptop computer by the school technician and conceded that the
technician did not breach his s. 8 rights.
As a result, the court did not consider the question of an
employer's right to monitor computers issued to employees.
Nonetheless, the court noted that school principals had a statutory
duty to maintain a safe school environment and, by necessary
implication, a reasonable power to seize and search a school
board-issued computer if they had reasonable grounds to believe the
hard drive contained compromising photographs of a student. The
issue before the court was therefore restricted to whether the
police could use the computer and the information on it, obtained
without a warrant, in the prosecution of the criminal charges.
In considering whether Cole had a reasonable expectation of
privacy on his school-owned computer, the court considered the
policies and procedures of his employer. The board had a policy and
procedures manual that allowed for incidental personal use of the
computer and stipulated that teachers' e-mail would remain
private, although this was subject to access by school
administrators under certain conditions. The teacher could also
protect the computer with a password.
However, the policy stated that all data and messages generated on
or handled by board equipment are the board's property and not
that of the user. The board further had an acceptable use policy
that applied to teachers. That policy stated that administrators
might monitor all work and e-mail, including materials saved on the
hard drives.
The policy warned that users should not assume that files stored
on network servers or hard drives of individual computers would be
private.
Despite these warnings, policies, and procedures, the court held
that Cole still retained a reasonable expectation to privacy. The
court noted that the expectation of privacy was not as high as
information contained on a personal home computer and that
workplace policies and practices may diminish an individual's
expectation of privacy on a work device. Nonetheless, although the
expectation of privacy is lower, it still exists.
The court noted that the right to privacy is independent of
ownership of either the computer hardware or the software. It was
an informational privacy of the data or the content of the hard
drive. The court defined informational privacy as being the
"claim of individuals, groups or institutions to determine for
themselves when, how, and to what extent information about them is
communicated to others."
The court acknowledged that employers increasingly provide
computers for employees' exclusive use and that staff can and
often do use them away from the workplace. In this regard, it is
common practice for employees to use the computers for both
work-related and personal reasons. Furthermore, as people store
more data in the cloud and access it from both workplace and
personal computers, the ownership of the device or the data, far
from being determinative of the reasonable expectation of privacy,
becomes an increasingly unhelpful marker.
It becomes a factor to be considered in the diminishment of the
expectation as to privacy but it does not eliminate it.
In analyzing the extent of the right to privacy on a work
computer, the court determined that it was a question of balance.
In favour of privacy were the parts of the policy and actual
practice that permitted Cole to use his work-issued laptop computer
for personal purposes.
Against the expectation of privacy were the portions of the policy
and the technological reality of access by school technicians that
deprived Cole of exclusive control over and access to any personal
information he chose to save on the computer. On balance, the court
concluded that Cole had a diminished but extant reasonable
expectation of privacy.
The court also considered whether a third party, the school board,
could validly consent to a warrantless search or seizure of a
laptop issued to one of its employees. It specifically rejected the
doctrine of third-party consent as it was inconsistent with its
jurisprudence on first-party consent. As a result, the court
concluded that Cole did have a reasonable expectation of privacy
and, therefore, that a search warrant was necessary. As the police
conducted the search and seizure without a warrant, it violated his
s. 8 rights.
Cole, however, was not out of the woods. Noting his diminished
expectation of privacy and that the information on the hard drive
is "all highly reliable and probative physical evidence,"
the court allowed the admission of it under s. 24(2) of the
Charter. The court held that the admission of the evidence, despite
the violation of s. 8, would not bring the administration of
justice into disrepute and ordered a new trial.
The impact of this decision will be difficult to assess.
Permitting at least a diminished reasonable expectation of privacy
on work or employer-owned computers should give employers pause.
When considered in conjunction with the recent Court of Appeal case
creating a tort of intrusion upon seclusion, this case may well
give rise to new areas of potential exposure.
However, the competing interests of employers in preventing misuse
of electronic data or employees' duties will have to be
considered. But since the court specifically deferred the question
of whether the actual act of searching or monitoring the computers
by the employer contravened any privacy rights for another day, the
final chapter on this issue remains unwritten. The courts,
therefore, will continue to struggle with the boundaries of
appropriate expectations of privacy.
Nonetheless, one thing is perfectly clear: the courts remain
strongly opposed to the Orwellian future where privacy would be
non-existent.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.