For various reasons, employers have a need to monitor or investigate employee use of work computers. How far can that monitoring or investigation go with respect to personal information stored on workplace computers? Last year the Supreme Court of Canada released a decision in the criminal law context where an employee's expectation of privacy in personal information stored on workplace computers was diminished by workplace policies, practices and customs. I asked my colleague Kate Dearden to briefly discuss the R. v. Cole case and its impact on organizations.
Question: Can you provide a brief description of the facts of this case?
Kate: Yes. A teacher at a school, Cole, was issued a laptop computer by his employer, a school board. Cole was permitted to use the laptop for work-related purposes and incidental personal purposes. A school board technician was performing maintenance activities by remote access when he discovered a hidden folder of files on Cole's laptop. The folder contained explicit photos of a female student at the school, which Cole is alleged to have intercepted from the student electronically. The technician informed the school principal, who directed the technician to copy the contents of Cole's laptop onto a CD, including copies of the photos, personal photos and Internet browsing history, which were provided to police along with Cole's laptop. The police conducted a search and charged Cole with possession of child pornography and unauthorized use of a computer. The preliminary issue in the criminal case was whether the evidence obtained by police was legally obtained, and therefore admissible.
Note that the employer had an information technology policy that stipulated that e-mails remained private, but could be accessed by school administrators under certain conditions, including for maintenance. The policy stated that "all data and messages" on the employer's equipment were considered to be the employer's property.
Question: Why is the decision significant to workplaces across Canada?
Kate: The Supreme Court specifically stated that Cole did not challenge the initial inspection of the laptop by the technician in the context of routine activities. The Supreme Court said it would "leave for another day the finer points of an employer's right to monitor computers issued to employees". That being said, the Supreme Court's comments about personal information stored on work computers is a new development. Historically, employers have typically relied on ownership of property and workplace computer policies to justify surveillance and searches of computer systems. In R. v. Cole, the Supreme Court considered the nature of personal information stored on workplace computers. Such personal information can contain details of financial, medical and personal situations. It specifically noted that Internet-connected devices "reveal our specific interests, likes, and propensities, recording in the browsing history and cache files the information we seek out and read, watch, or listen to on the Internet". Accordingly, personal information stored on work computers where personal use is permitted "exposes the likes, interests, thoughts, activities, ideas, and searches for information" of an individual. Despite the likely existence of personal information on workplace computers, the Supreme Court stated that the "operational realities" of a workplace, such as policies, practices and customs, may diminish an employee's expectation of privacy in personal information, although it cannot remove the expectation entirely.
Question: What should organizations be considering in light of this decision?
Kate: Organizations should limit the personal information stored on work computers. They can do so by having clear policies, practices and customs relative to personal use and storage of personal information on work-issued computers. Such policies should be enforced consistently and reviewed periodically. Also, they should assess the "operational realities" of the workplace to understand whether permitted or condoned personal use could interfere with an employer's legitimate need to search its devices.
Question: This decision involved a laptop. Would there be a similar decision if it, for example, involved an employer-issued smart phone?
Kate: The Supreme Court did not address an employee's expectation of privacy in other computer devices such as smart phones. It also did not address whether employees have a reasonable expectation of privacy in personal information in the form of text messages, photos and personal e-mail accounts. Given the ease with which personal and private information can be mingled on these devices, the issue of an employee's reasonable expectation of privacy is likely to become a more complex issue and one yet to be fully considered by the courts.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
