McCague Borlack LLPLitigation Boutique, GLOBAL Litigation Law Firm

 

 

 

Articles and Publications

April 9, 2013

Privacy and Employer-Issued Computers in the Workplace:

A Review of R v Cole (2012 SCC 53)

First presented at an Employment Law Seminar

The Supreme Court of Canada (“SCC”) recently considered the extent to which employees have a reasonable expectation of privacy over personal files kept on employer-issued laptops.

Background

Mr. Cole was a high school teacher who was permitted to use a work-issued laptop for personal uses, such as Internet browsing.

While performing maintenance services on the school's computers, a technician found nude and partially nude photographs of a female student in a hidden folder on Mr. Cole's laptop.

The technician notified the principal, who instructed the technician to copy the nude photographs onto a compact disc. The principal seized the laptop, and school board technicians then copied Mr. Cole's temporary Internet files to a second compact disc. The laptop and both compact discs were given to the police. The following day, the police attended at the school and, without a warrant, reviewed their contents and created a mirror image of the hard drive for forensic purposes.

Mr. Cole was charged with possession of child pornography and unauthorized use of a computer, pursuant to s. 163.1(4) and s. 342.1(1) of the Criminal Code (RSC 1985, c C-46).

Trial and Summary Conviction Appeal Court Decision

At trial, the judge excluded all of the evidence pursuant to ss. 8 and 12 of the Canadian Charter of Rights and Freedoms (“the Charter”), which provide that an individual is protected against unreasonable search and seizure, and that no individual should be subjected to cruel and unusual treatment. The summary conviction appeal court reversed the decision, concluding that there was no breach of s.8 of the Charter.

"...the search and seizure of the laptop and all of its contents by the principal and school board was both authorized by law and was reasonable."

Court of Appeal Decision—Reasonable Expectation of Privacy over Personal Files

The Court of Appeal set aside the summary conviction appeal court's decision and excluded the compact disc containing the temporary Internet files, the laptop and the mirror image of the hard drive. It concluded that the search and seizure of the laptop and all of its contents by the principal and school board was both authorized by law and was reasonable. As for the police search, the Court concluded that as Mr. Cole had no reasonable expectation of privacy over the nude photographs, he had no legal basis to attack the search and seizure.

However, Mr. Cole had a continuing reasonable expectation of privacy over the laptop and the disc containing the temporary Internet files. The seizure of this material by his employer did not bestow the police with the same authority to access Mr. Cole's personal Internet files. As a result, the Court of Appeal excluded the laptop and the mirror image of its hard drive, as well as the compact disc containing the temporary Internet files, pursuant to s. 24(2) of the Charter, which provides that a court of competent jurisdiction may determine whether or not the infringement of the Charter right was “appropriate and just”, given the circumstances.

SCC Decision—Reasonable Expectation of Privacy, but Infringement Justified

The SCC concurred with the Court of Appeal's finding that the police infringed Mr. Cole's rights against unreasonable search and seizure, finding that he had a reasonable, although diminished, expectation of privacy for the personal files kept on his employer-issued laptop. Further, the SCC confirmed that the authority held by Mr. Cole's employer to seize and search the laptop did not furnish the police with the same authority. Nevertheless, the SCC did not exclude any of the evidence, pursuant to s. 24(2) of the Charter.

The SCC determined that privacy in the workplace is a matter of “reasonable expectations.” Whether or not Mr. Cole had a reasonable expectation of privacy over the information contained on his laptop depended on the “totality of the circumstances.”

Like most private employers, the use of work-issued laptops at Mr. Cole's school was governed by employment contracts and policies. The Policy and Procedures Manual governed Mr. Cole's laptop usage. The Manual permitted incidental personal use of employer-issued laptops. It also stipulated that teachers' email correspondence remained private, but subject to access by school administrators in certain conditions. The Manual stated that “all data and messages generated on or handled by board equipment are considered to be the property of the school board.”

The Manual claimed ownership over the computer's hardware, as well as the data stored on it:

Information technology systems and all data and messages generated on or handled by board equipment are considered to be the property of [the board], and are not the property of users of the information technology.

"The Manual warned employees that teachers and administrators could monitor all work and emails, including material saved on the laptop hard drive."

The Manual warned employees that teachers and administrators could monitor all work and emails, including material saved on the laptop hard drive.

The school board also had an Acceptable Use Policy, which warned students, and implicitly teachers, to not expect privacy in their personal files on school laptops.

Nevertheless, despite these policies issued by the school board, the SCC found that Mr. Cole's expectation of privacy over the informational content of his computer was readily inferred from his use of his laptop for personal uses, such as browsing the Internet and storing personal information on the computer's hard drive.

In reaching this finding, the SCC focused on the “context” in which personal information is placed on employer-issued laptops. Notably, Justice Fish, in speaking for the majority, stated that written policies are not determinative of a person's reasonable expectation of privacy. Regardless of the employer's written policies, a court must consider the totality of the circumstances in order to determine whether privacy was a reasonable expectation, given the circumstances.

In Mr. Cole's case, the evidence weighed both for and against a reasonable expectation of privacy over the temporary Internet files. Mr. Cole had a reasonable expectation of privacy over his temporary Internet files because his employer allowed him to use the laptop for personal purposes. However, his employer's policy also denied him the exclusive control over and access to the personal information stored on the computer.  It is important to note that neither party disputed the fact that Mr. Cole had no reasonable expectation of privacy over the nude photographs.

Interestingly, Mr. Cole did not challenge the initial inspection of his laptop by the school technician during the course of routine maintenance activities. Further, the SCC agreed with the Court of Appeal that the principal had a statutory duty to maintain a safe school environment, which imbued implied powers of search and seizure of a school-issued laptop.

However, as for the police's powers of search and seizure, the SCC concluded that receipt of the computer from the school board did not afford the police with the right to conduct the search without a warrant. The temporary Internet files were, at all relevant times, subject to Mr. Cole's reasonable and subsisting expectation of privacy. 

In the end, the SCC determined that the admission of all of the evidence, including the temporary Internet files, would not bring the administration of justice into disrepute. The SCC based this conclusion on the basis that the “breach was not high on the scale of seriousness, and its impact was attenuated by both the diminished privacy interest and the discoverability of the evidence.”

Implications for Private Employers

Although this case focused on employee rights of privacy in the context of a criminal investigation, it raises pertinent questions for employers to consider. First, to what extent will written policies and procedures impact an employee's expectation of privacy over personal files kept on employer-issued laptops? Second, the SCC permitted disclosure of Cole's personal information following the police's search because its admission “would not bring the administration of justice into disrepute” and “the exclusion of the material would… have a marked negative impact on the truth-seeking function of the criminal trial process (paras. 96 to 97).

The SCC's analysis focused on the reasonableness of the police's collection and disclosure of Cole's personal information. Although it refrained from analyzing an employer's right to monitor an employee's computer, it did state the following:

the policies, practices, and customs of the workplace are relevant to the extent that they concern the use of computers by employees. These ‘operational realities' may diminish the expectation of privacy that reasonable employees might otherwise have in their personal information” (para. 52).

The SCC confirms that employers have the right to restrict employee privacy rights, but should an employer also have to demonstrate that the restriction on privacy is reasonable, given the circumstances? Third, in instances where employers expressly allow employees to use work-issued computers and electronic devices for personal use, should there be a restriction on the employer's ability to review personal files stored on the equipment?

The impact that Cole will have on private employers, outside of the criminal law context, remains to be seen.


TORONTO | OTTAWA | KITCHENER | BARRIE

416.860.0001 | mccagueborlack.com | Follow us on Twitter twitter

McCague Borlack LLP is a member of the Canadian Litigation Counsel, a nationwide affiliation of independent law firms. Through CLC's association with The Harmonie Group, our clients have access to legal excellence throughout North America, the U.K. and Europe.

clcnow.com | harmonie.org