Canada: Ontario Court Rules Employee Using Work Computer Has Privacy Rights

Copyright 2011, Blake, Cassels & Graydon LLP

Originally published in Blakes Bulletin on Labour & Employment, April 2011

Employers should take notice of a recent ruling from the Ontario Court of Appeal that recognizes the privacy rights of employees using work computers. In R. v. Cole, the Court held that a teacher had a reasonable expectation of privacy in the personal use of his work laptop, and ultimately excluded certain electronic evidence obtained by the police through a warrantless search. While this was a criminal case in which the Canadian Charter of Rights and Freedoms applied to both the employer which was a school board, and the search and seizure by police, the decision has implications for privacy rights in other contexts.

The Ruling in R. v. Cole

The appellant, a high school teacher, was charged with possession of child pornography and unauthorized use of a computer contrary to sections of the Criminal Code. A computer technician employed by the school accessed the appellant's laptop, owned by the school, as part of his responsibility for monitoring and maintaining the integrity and stability of the school network. The technician accessed a hidden folder on the appellant's hard drive which contained nude, sexually explicit images of an underage student at the school. He advised the principal, who directed the technician to copy the images onto a disc and required the appellant to give him the laptop. A school board official searched the laptop and copied temporary Internet files from the appellant's surfing history into another disc. The two discs and the laptop were turned over to the police, who searched them without a warrant.

The Court held that the appellant had a reasonable expectation of privacy in the personal information stored in the hard drive of his work laptop. Although the laptop was owned by the school and issued for employment purposes, the school board gave teachers possession of the laptops, explicit permission to use the laptops for personal use and permission to take the laptops home on evenings, weekends and summer vacation. The teachers did in fact use the laptops for personal use, employed passwords to exclude others, and stored personal information on their hard drives. There was no clear and unambiguous policy to monitor, search or police the teachers' use of their laptops. For its teachers, the school board's policy only dealt with email and emphasized that attempts would be made to request permission if access was required.

The appellant's reasonable expectation of privacy was only modified to the extent that the appellant knew that his employer's technician could and would access the laptop as part of his role in maintaining the technical integrity of the school's network. In other words, the appellant had no expectation of privacy with respect to this limited type of access, and the appellant's Charter rights against unreasonable search and seizure were therefore not engaged as a result of the search by the technician employed by the school board.

The Court also held that the warrantless police search and seizure of the appellant's laptop and the disc containing temporary Internet files breached the appellant's privacy rights under s. 8 of the Charter, which sets out the right against unreasonable search and seizure. The resulting evidence was excluded under s. 24(2) of the Charter. The Court specifically noted that the appellant had a privacy interest in his personal Internet browsing history and what it revealed about his personal predilections and choices. Finally, the appellant's s. 8 Charter rights were not breached as a result of the searches and seizures by the principal and the school board because these were implicitly authorized by law (under the Education Act), and reasonable.

Relevance of R. v. Colefor Employers

For employers, the lesson to be learned from Cole is that it is important to have clear and unambiguous information technology and privacy policies, which provide that email, Internet usage, hard drives of company computers and other uses of company technology systems, may be monitored by the employer.

Although the policy should clarify that employees should have no expectation of privacy when using company equipment, network or other information technology systems, this statement alone may not be sufficient to provide unfettered monitoring privileges and the ability to disclose the information collected to third parties. Employers, particularly those who are in Canadian jurisdictions that have comprehensive privacy legislation, should notify the employees of the purposes for which monitoring will be conducted and the uses that will be made of information collected. A company policy that permits personal use of work computers but makes it clear that the employer may access the computer to monitor for illegal, obscene or otherwise inappropriate content, and that information may be turned over to the police if the commission of a crime is suspected, will impact the scope of an employee's reasonable expectation of privacy. Such a policy would likely provide significant leeway to monitor computers for this type of conduct. Training and an employee acknowledgement that the policy was read and understood would also be advisable to ensure that employees are aware of the relevant policy.

Employers should also be aware that conventions and customary use by employees may be relevant. In Cole, the Court held that, to the extent that a school agreement on laptop usage signed by students also applied to teachers, it was modified by "convention and usage of the teachers' laptops". The Court considered it relevant that other teachers also used their computers to store sensitive personal information, such as banking and financial information, and that they had the right to keep the laptop in their possession and protect access to the computer by their own password. Where the employer is aware of and condones significant personal use of company computers, it seems that an employee will be more likely to establish a reasonable expectation of privacy.

Conclusion
As the Court states in Cole, prior to this decision, there was no clear appellate authority on the issue of privacy in a workplace computer. The Court's decision arose in the context of an appeal as to whether Mr. Cole's right to be free from unreasonable search and seizure under the Charter had been infringed. The Charter applies only to governmental authorities, police and public-sector employers, and not to the vast majority of Canadian employers. Nonetheless, the Court's analysis of an employee's reasonable expectation of privacy could have broader implications. Privacy law continues to develop in Canada and employers would do well to ensure that their employee policies are regularly updated to keep up with the ever-changing legal landscape.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.