The Supreme Court of Canada has recently issued a decision (R. v. Cole) that impacts the existing understanding of the 'expectation of privacy' in the content of information on computers used by employees.
The concept of a reasonable expectation of privacy has its origins in the power of authorities, usually police, to search or conduct surveillance without first obtaining a search warrant. Stated very simplistically it means that the more likely an average person would view an area or an activity as private, the greater the likelihood that a warrant will be required for a non-consensual intrusion into that area or activity.
Historically the ownership of property was considered quite important in the determination of whether a reasonable expectation of privacy existed. For example, a person's desk or locker at work, which is generally owned by the employer, had a much lower expectation of privacy than their car, their gym bag or their home. Many employers had cameras – both exposed and covert – deployed in areas where employees could be seen while working and have their activities captured on video.
Procedural protections against searches and surveillance have been gradually imported into the relationship between employers and employees, particularly in the context of the ability of the employer to use evidence against employees in disciplinary matters. The strengthening of privacy rights through legislation and general awareness has contributed to the requirement to balance those rights with the rights of an employer to manage their workplace. While employers do not need a warrant to do a locker search or to hire a private detective to follow an employee, courts and arbitrators will now generally require the employer to prove that a reasonable basis for the search or surveillance existed before doing so. This is a similar concept to "probable cause" in criminal law.
Most employers, whether public or private sector, have computer usage policies which advise employees that information accessed and\or stored on the employer's network and hardware is the property of the employer and may be viewed by the employer. Until the decision in R. v. Cole, most employers (and their lawyers) were confident that the ownership of the hardware and the network, in conjunction with these types of policies, would be sufficient to take away, or render unreasonable, employee expectations of privacy in content.
While this decision is in the context of a criminal prosecution, the subject matter of the charges was pornographic material downloaded by a teacher and stored on a laptop that had been issued to him by his employer, a school division. Although the laptop was owned by the school division, and connected for the most part to the employer's network, teachers were expressly told that they could take their laptops home and use them for personal business. The employer had a computer usage policy which provided that the school board owned "all data and messages" on their equipment, and warned that "users should not assume that files stored on network servers or hard drives of individual computers will be private."
The Supreme Court ruled on the admissibility of this evidence, which required an examination of whether the teacher had a reasonable expectation of privacy in respect of personal internet browsing and downloading. A previous Supreme Court decision in 2010 confirmed that individuals have such an expectation of privacy on their own personal computers. This new decision extends that expectation of privacy – with some provisos – to workplace computers as long as personal use is permitted or reasonably expected.
Although the Court considered the fact that the employer owned the hardware, this was not found to be a determining factor in defining the right of privacy. It stated that the "totality of the circumstances" must be reviewed, which included the employer's policies and practices relating to computer usage and monitoring. The Court decided that the teacher had a "reasonable but diminished expectation of privacy in his Internet browsing history and the informational content of his work-issued laptop."
What does this mean for employers?
The ruling is expected to have the result of enhancing the privacy rights of employees in general, which in turn may lead to the exclusion of evidence in either arbitrations or civil court cases if that evidence is obtained in violation of those rights.
Employers should:
- Revisit computer usage policies to specify all potential reasons for which the employer may exercise access to information (e.g. to investigate, to audit, to analyze performance, for electronic discovery purposes) and the methods by which that access may occur;
- Explain to employees (using login notices and otherwise) that if they require a private means of internet access and communication, they should only do that using a personal electronic device not connected to the employer's network;
- Ensure that computer usage policies and actual practices are consistent and clear with respect to personal usage of employer hardware. It is likely not practical or enforceable to completely bar personal usage in most workplaces;
- Be aware that accessing personal information stored by an employee on an employer computer to justify disciplinary action may require "probable cause" in much the same manner as doing a physical search of a locker or desk, or initiating surveillance of an employee's actions.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
