Employees may have a “reasonable expectation of privacy” on their work-issued computers, Supreme Court of Canada rules
By Christina Hall
The Supreme Court of Canada released its eagerly awaited decision in R. v. Cole, 2012 SCC 53 on October 19, 2012. In the decision, the Court held that employees may have a reasonable, though diminished, expectation of privacy in personal information stored on their work computers – at least where the personal use of such devices is permitted or reasonably expected by employers. This reasonable expectation of privacy is protected by the Canadian Charter of Rights and Freedoms (the “Charter”).
The Facts
Mr. Cole was an Ontario high-school teacher. In addition to his regular teaching duties, he was responsible for policing the use by students of their networked laptops. To this end, he was supplied with a laptop owned by the school board and he was given domain administration rights on the school’s network. This allowed him to access the hard drives of students’ laptops. Mr. Cole was also permitted to use his laptop for incidental personal purposes, which he did. He often browsed the Internet and stored personal information on the laptop’s hard drive.
Mr. Cole’s difficulties began when a school technician, performing maintenance activities on the school’s network, found a hidden folder on Mr. Cole’s laptop that contained nude photographs of a high school student. The technician reported his findings to the school principal who seized the laptop and handed the information over to the police. The police reviewed the information contained on the hard drive without first obtaining a search warrant. They proceeded to charge Mr. Cole with possession of child pornography and unauthorized use of a computer.
The Charter Issue
At the outset of his criminal case, Mr. Cole challenged the admissibility of the evidence obtained by the police from his laptop. Specifically, he argued that his right to be free from unreasonable search and seizure, enshrined in section 8 of the Charter, had been infringed when the police reviewed the evidence from his laptop without having first obtained a search warrant. A threshold issue became whether Mr. Cole had a reasonable expectation of privacy in the contents of his work-issued laptop.
The Analysis
In determining this threshold issue, the Court stated that it was required to consider the “totality of the circumstances”. In doing so, the Court concluded that the subject matter of the police search was the informational content of the laptop’s hard drive and Internet files. The Court further commented that Mr. Cole’s direct interest and subjective expectation of privacy in this informational content could be inferred from his use of the laptop to browse the Internet and to store personal information on the hard drive. Thus, the remaining question was whether Mr. Cole’s subjective expectation of privacy was objectively reasonable.
In this regard, the Court noted that Internet-connected devices reveal a person’s specific interests, likes and propensities, which fall at the very heart of the “biographical core” of personal information protected by section 8 of the Charter. Furthermore, the written policies and practices of the school board permitted Mr. Cole to use his work-issued laptop for personal purposes. On the other hand, the school board had been clear that it owned both the hardware in question and the data stored on it. In addition, the school board’s policies and technological reality deprived Mr. Cole of exclusive control over – and access to – the personal information he chose to record on his laptop. That is, the contents of his hard drive were available to all other users and technicians with domain administration rights.
The Decision
After considering the “totality of the circumstances”, the Court concluded that although Mr. Cole’s privacy interest in his laptop was diminished by ownership issues, workplace policies and various operational realities, these factors did not eliminate an otherwise objectively reasonable expectation of privacy in the contents of his work-issued laptop. As a result, the examination of the laptop by the police, without a warrant, violated Mr. Cole’s rights under section 8 of the Charter. However, despite this violation, the Court ultimately concluded that it would not be proper to exclude the evidence obtained from Mr. Cole’s laptop.
Implications of R. v. Cole for Employers
The Court has confirmed in R. v. Cole that employees may have a reasonable expectation of privacy in the personal information stored on their work-issued computers. However, it is important to bear in mind that this “reasonable expectation of privacy” arises only in relation to an individual’s Charter-protected right to be free from unreasonable search and seizure by the state. In fact, the Court specifically commented in its decision that it would leave for another day “the finer points” of an employer’s right to monitor computers issued to employees.
Therefore, despite concerns about the possible implications of this case for employers in the private sector, (not subject to the Charter) the decision in R. v. Cole will be of little practical relevance other than the insight it provides into the Court’s views of the scope of personal privacy. However, the decision does confirm some “best practices” for private sector employers – namely that they would be well-advised to implement clear workplace rules and policies that address any permitted personal use by employees of work-issued computers and devices, outline any conduct that is prohibited when employees are using such devices and indicate whether the employer reserves a right to access and/or monitor employees’ use of such devices.
For more detailed information, please follow the link for our article.
For more about privacy law, see our AccessPrivacy website.