In the recent decision R. v. Cole, released on October 19, 2012, the Supreme Court of Canada (SCC) indicated that employees may reasonably expect privacy in the information contained on their work computers, at least where personal use is permitted or reasonably expected.

The decision does not address an employer’s right to monitor personal information on work computers: it was made in a criminal law and Canadian Charter of Rights and Freedoms (Charter) context, and the SCC expressly said that it would "leave for another day the finer points of an employer’s right to monitor computers issued to employees." Nonetheless, the decision provides important guidance in this developing area.

Facts

The accused, Mr. Cole, was a high school teacher with a school board-issued laptop. He was permitted to use the laptop for incidental personal purposes, and he used it to browse the internet and store personal data on the hard drive. He also was responsible for policing student use of school networked laptops, and so was permitted access to the hard drives of student laptops.

School board policy: a) allowed incidental personal use of laptops; b) stated that teachers’ email correspondence was private, subject to certain conditions; c) stated that all data and messages generated or handled by board equipment were the property of the school board and d) warned users not to expect privacy in their files.

While performing maintenance activities, a school board technician found a hidden folder containing nude and partially nude photographs of a female student on Mr. Cole’s laptop. The principal was informed, and the photographs were copied to a CD. The principal seized the laptop, and school board technicians copied temporary internet files onto a second CD. The laptop and both CD’s were turned over to the police, who took an image of the hard drive and reviewed all of the materials without a warrant. Mr. Cole was charged with possession of child pornography and unauthorized use of a computer.

The trial judge excluded all of the computer material pursuant to Section 8 and Subsection 24(2) of the Charter as being improperly seized without a warrant. The Ontario Court of Appeal set aside that decision and excluded all of the computer material, except the CD with the photographs of the student.

The SCC allowed admission of all of the computer material and ordered a new trial. It found that warrantless access of the information on Mr. Cole’s computer was a Charter breach by the police, but that, under the circumstances, the admission of the evidence would not bring the administration of justice into disrepute, whereas its exclusion would have a marked, negative impact on the truth-seeking function of the criminal trial process.

Factors in Considering an Employee’s Reasonable Expectation of Privacy on a Work Computer

The SCC noted that Mr. Cole had a direct interest and subjective expectation of privacy in the information content of his work computer, given his use of the laptop to browse the internet and store personal information on the hard drive.

In assessing whether Mr. Cole’s expectation was objectively reasonable, the SCC noted some points of relevance in considering an employee’s reasonable expectation of privacy:

• The closer the subject matter lies to the "biographical core" of personal information, the more this factor will favour a reasonable expectation of privacy.
• Computers that are used for personal purposes, and especially those connected to the internet, will reveal private information at the heart of the "biographical core" of personal information, which is protected by the Charter.
• Written policies are relevant, but not determinative of a person’s reasonable expectation of privacy. One must consider the totality of circumstances in order to determine whether privacy is a reasonable expectation, including the policies, practices and customs or "operational realities," of the workplace, to the extent that they concern the use of computers by employees.

Conclusion and Recommendations

While a reasonable expectation of privacy on a work computer was recognized by the SCC, it also noted that expectation can be diminished by operational realities, including policies.

Employers should:

• recognize that allowing personal use of work computers may accord employees an expectation of some privacy and consider the risks specific to the position and workplace;
• ensure written policies are clearly stated, regularly communicated and are consistent with the actual use and practices permitted by the employer in the workplace;
• if policies state that information is reviewed or monitored, follow through and ensure this is actually done; and
• promptly and consistently deal with any breaches of policy.