In R. v. Cole, 2012 SCC 53 (October 19, 2012), the Supreme Court of Canada held that employees may reasonably expect privacy in the information stored on their work-issued computers — at least where personal use is permitted or reasonably expected.
Background
Cole was a criminal case. The accused, a high-school teacher, was accused of having illegal content on his work laptop. His employer — the school board — owned the computer, but it had a policy that permitted staff to make personal use of their work-issued devices. The policy also warned — and teachers were reminded annually — that users should not expect to retain privacy in their files (other than email).
While performing systems maintenance, a school board technician discovered contraband on the accused's computer. The employer seized the laptop and gave it to the police. Without a warrant, the police searched the contents of the laptop and laid charges against the accused.
The trial judge excluded all of the computer evidence under s. 24(2) of the Canadian Charter of Rights and Freedoms (Charter). In his view, the police had breached the teacher's Charter right to be secure against unreasonable search and seizure. The Court of Appeal for Ontario similarly concluded that the teacher had a reasonable expectation of privacy and that the police had unlawfully interfered with this expectation. The Court excluded the laptop.
Though the Supreme Court of Canada allowed the appeal, holding that admission of the evidence would not bring the administration of justice into disrepute, the Court agreed that the teacher's right to be secure against unreasonable search and seizure had been violated. Justice Fish, for the majority, and Justice Abella, for the dissent, both agreed that the police breached s. 8 of the Charter when they searched the contents of the work computer.
Application to Employers
Although the majority expressly declined to address the "finer points" of an employer's right to monitor its employees' computer use, the Cole decision will impact how employers approach privacy on electronic devices and may foreshadow future developments in the law of personal privacy.
The centerpiece of Cole is the decision — the first of its kind from the Supreme Court — that an employee could have a reasonable expectation of privacy in the informational content on a work-issued laptop. This privacy interest exists independently of, and may survive, the employer's ownership of the computer.
According to the majority decision, workplace policies do not determine whether an employee has a constitutionally protected privacy interest. Though the employer's policy in Cole diminished the strength of the teacher's reasonable expectation of privacy, the policy did not eliminate it. The nature of the information on the teacher's work laptop weighed too heavily in favour of recognizing that the employee had a privacy interest. By using the laptop for personal purposes, the teacher generated personal content that lay "at the very heart of [his] 'biographical core'".
Furthermore, Cole tells us that an employer cannot unilaterally set policies that expunge its employees' privacy interests in work-issued devices. While the Supreme Court seems willing to take these sorts of policies into account, they are not considered conclusive. As Justice Fish wrote, "[w]hatever the policies state, one must consider the totality of the circumstances in order to determine whether privacy is a reasonable expectation in the particular situation..." (para. 53).
The conclusion that the teacher had a reasonable expectation of privacy meant that his right to be secure from unreasonable search and seizure was engaged. As a result, even though the employer was permitted to seize the laptop, the police still needed a warrant to search it. Justice Fish explicitly held that the employer had no power to consent to the search on behalf of its employee. The employer may own the computer and all of the surrounding IT infrastructure, but it still has no power to consent — on an employee's behalf — to a government search. Though Cole dealt with the police, this rule would likely apply equally to any other state investigatory agency, such as the Competition Bureau, that might wish to search work computers.
If government authorities seek to search or seize an employee's computer, the employer should consult counsel. Its employees may have a privacy interest in personal information stored on employer-owned devices.
The Tort of Invasion of Privacy
In addition to its impact on employers, Cole may also chart the course for the development of the tort of invasion of privacy that was recently recognized by the Court of Appeal for Ontario. For that tort to be established, the plaintiff must show that (a) the defendant acted intentionally; (b) the defendant invaded the plaintiff's private affairs or concerns without lawful justification; and (c) a reasonable person would regard the invasion as highly offensive.
The Supreme Court's willingness to recognize a privacy interest in personal information stored on work computers may give the new tort of invasion of privacy greater scope, potentially impacting the employee/employer relationship. It will be for future courts to develop "the finer points of an employer's right to monitor computers issued to employees" (para. 60) and the application of the tort of invasion of privacy to personal information stored on work computers.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
