Introduction
Workplace privacy is one of the fastest evolving areas in employment law. Last month, the Ontario Court of Appeal recognized for the first time, an employee’s right to privacy in the personal information they store on workplace computers. While the case was a criminal proceeding, the principles laid down by the Court are applicable to employment law. Employers will want to carefully consider the decision in R. v. Cole, 2011 ONCA 218 when drafting their computer use policies.
Facts
Cole was a high school teacher who taught computer science. He was provided a laptop by the school board (the “Board”) and had supervisory responsibilities over the school’s computer network which allowed him to access data stored on student computers connected to the network. In the course of his supervisory duties, Cole had accessed a student's email account and found nude photographs that his underage girlfriend, also a student at the school, had sent. Cole copied them onto his own computer and stored them in a hidden file.
One of the Board's IT technicians noted a high level of connection to the school server from Cole's computer and thought that it might be caused by a virus. In examining the usage, the technologist remotely accessed Cole's history of Internet access and one of his drives. The technologist found the hidden folder. Thinking that it might contain a dangerous file that could destabilize the school's network, he opened it, uncovering the nude images of the young student.
The Board's technician copied the photographs onto a disc and notified the principal, who provided them to police with the computer. The police believed a search warrant was unnecessary since the computer was school property. Police viewed the material and charged Cole with possession of child pornography. Cole sought to have the evidence obtained from the computer excluded on the basis that it was obtained through an unreasonable search and seizure. At issue on appeal was whether Cole had a reasonable expectation of privacy in the contents of a work computer on which he was entitled to store personal information.
Findings
The evidence obtained from Cole’s computer was excluded from the trial. The Court found that Cole had a reasonable expectation of privacy in the laptop's hard drive and the personal information it contained.
In coming to the decision, the Court relied heavily on the computer use policy in place between the parties. Although the computer was owned by the Board, teachers were expressly permitted to use their computer for personal reasons, to store personal information on it, and to take it home during weekends and vacations.
Furthermore, there was no clear privacy policy relating to the laptops. The policy contained a general statement that the Board owned all of the data stored on the laptops and prohibited the use of the laptops to view inappropriate content, including sexually explicit material. However, the policy did not assert the right of the Board to search, monitor, or otherwise police the laptops, except for the purposes of maintaining the technical integrity of the school's information network.
The Court acknowledged that there is little authority on the issue of whether an individual has a reasonable expectation of privacy in his work computer. Although it was a work computer, owned by the Board, and issued for employment purposes, the Court agreed, for the reasons set out above, that Cole had a reasonable expectation of privacy in the computer and the personal information it contained. This expectation of privacy was modified to the extent that the Cole knew that the Board's technician could and would access the laptop as part of his role in maintaining the technical integrity of the school's information network. However, this was not sufficient to displace a reasonable expectation that otherwise would exist in the personal electronic information maintained on his laptop, except to that extent and for that limited purpose.
The technician’s search of Cole’s computer was reasonable because of his right of access to protect the integrity of the school's information network. However, the technician's discovery of the photographs during the course of his implied right of access did not change Cole's reasonable expectation of privacy in the contents of his laptop in relation to the police. The police did not have the right to search the laptop without obtaining a search warrant. Although the Board owned the laptop, they were not entitled to give police permission to search it. Cole’s Charter rights were breached.
What Employers Should Know
This case involves an important issue for employers. Employers often provide their employees with technology to help them perform their duties, whether it be a laptop, BlackBerry, or other device. Employers who do so should consider the following tips:
• Develop a clear and comprehensive policy- Ensure your computer and internet use policy is updated to regulate the use of all company owned equipment. A clear policy is critical both in terms of communicating your expectation to employees and in terms of controlling the reasonable expectation of privacy of employees.
• Consider prohibiting personal use- Ownership of the device is no longer determinative in assessing whether employees have a reasonable expectation of privacy. Allowing employees to use their devices for personal use now creates a reasonable expectation of privacy that could hinder an employer’s ability to properly manage its workplace.
• Address privacy concerns- As this decision demonstrates, an employee’s reasonable expectation of privacy can be diminished or eliminated through a properly worded policy. Consider adding to your policy a warning that employees have no expectation of privacy in their use of workplace technology. Include a warning to employees that the employer reserves the right to monitor their use of technology. We encourage you to contact your Shields O’Donnell MacKillop lawyer if you have any questions about workplace privacy or need assistance in drafting an effective computer use policy.