Last week the Supreme Court of Canada held that employees may have a reasonable expectation of privacy in information stored on workplace computers.

In R. v. Cole, 2012 SCC 53, Mr. Cole was charged with possession of child pornography. Mr. Cole, a high school teacher, had found nude photographs of an underage female student in another student’s school email account, and had saved those photographs to the hard drive of his school-issued laptop. The photographs were discovered when routine system maintenance was conducted by a computer technician at the school. The technician notified the principal, copied the photographs onto a CD, and made an additional CD containing a record of Mr. Cole’s internet files. The following day, a police officer took possession of the laptop and the two CDs. At the police station, a mirror image of Mr. Cole’s laptop hard drive was created, and both the laptop and the mirror image were sent for forensic investigation. At no time did the police officer involved in the investigation obtain a warrant to search and seize the hard drive or the information contained on the CDs.

The Supreme Court held that Mr. Cole had a reasonable expectation of privacy to the information stored on the hard-drive and the CDs, even though they were owned by his employer. By using his workplace computer to store personal photos, financial records, tax records, information about a property he owned, and his internet browsing history, Mr. Cole had demonstrated both a direct interest in and a subjective expectation of privacy in the information stored on his laptop. The Supreme Court held that Mr. Cole’s subjective expectation of privacy to this information was objectively reasonable.

The Supreme Court held that Mr. Cole’s subjective expectation of privacy was objectively reasonable because the subject matter of the police search fell close to a biographical core of personal information about him. A biographical core of personal information is information which an individual in a free and democratic society would wish to maintain and control from dissemination to the state, including information which tends to reveal intimate details of the lifestyle and personal choices of the individual. The information stored on the laptop was exactly this kind of information, as it revealed the details of Mr. Cole’s personal and financial situation was well as his interests, likes and propensities. The information on the laptop therefore weighed in favour of the objective reasonableness of Mr. Cole’s expectation of privacy.

Further, the Supreme Court held that Mr. Cole’s subjective expectation of privacy was objectively reasonable on the ground that the operational realities in which Mr. Cole made use of his laptop did not clearly establish that he did not have a reasonable expectation of privacy. Although school board policy provided that the hardware and the information stored on that hardware was the property of the school board, the policy alone was not determinative of whether a reasonable expectation of privacy existed. Further, although the school board stated that information and email stored on school-owned laptops may be monitored, only students were required to sign a policy stating their acknowledgement and agreement. Additionally, despite that Mr. Cole understood that school technicians could access information stored on the laptop, he was provided with a password and controlled access to the laptop. The Court held that the operational realities in which Mr. Cole made use of his laptop diminished his privacy interest, but did not eliminate it.

The Supreme Court found that the police had violated that Mr. Cole’s reasonable expectation of privacy in conducting an unreasonable search and seizure of his laptop, contrary to theCharter of Rights and Freedoms (“Charter”). While the school board had a duty to maintain a safe school environment, and thus had a reasonable power to search and seize a school-issued laptop, this reasonable power to search and seize for the school’s own administrative purposes did not give the police a power to search and seize the laptop for a criminal investigation, even though the school board gave the police its consent to search the laptop.

The Supreme Court’s analysis concerns the reasonableness of the search and seizure conducted by the school board and by the police under the Charter. As such, the decision does not directly apply to private-sector employers who are not subject to the Charter. As the Supreme Court stated, questions concerning an employer’s right to monitor and search workplace computers were left for another day.

However, practically speaking, the Supreme Court’s analysis in R. v. Colewill no doubt be heavily relied upon by a court or tribunal called on to determine if an employer violated an employee’s privacy by monitoring or searching a workplace computer. Employers should therefore consider taking the following steps:

1. Develop or revise workplace policies to ensure that employees do not have a reasonable expectation of privacy with regard to information stored on employer-provided electronic devices. The policy should be signed by employees, and should state that the employee understands that he or she does not have a reasonable expectation of privacy, and that he or she agrees to abide by the policy.
2. Ensure that workplace policies clearly state that the employer may access information stored on employer-issued electronic devices.
3. Ensure that workplace policies clearly state the limitations on an employee’s use of employer-issued electronic devices. For example, a policy may state that the employee is not to use a workplace computer to create, download or store unlawful information or images. A policy may also prohibit employees from storing personal information on employer-owned computers, including photographs and financial information. But since some personal use of workplace computers is likely inevitable, as an alternative workplace policy may require employees to expressly agree that storage of personal information, use of passwords, and exclusive use of an employer-owned electronic device does not give an employee any reasonable expectation to privacy.