When school employees are permitted to use their work computers for personal purposes, they are entitled to a reasonable expectation of privacy. While the exact scope of that privacy right is not entirely clear, the adoption by schools of an acceptable use of technology policy applicable to staff members is one factor that courts will consider in determining the extent to which employees' privacy rights should be protected.
Many schools provide teachers with laptops or computers owned by the school for work-related uses, and permit them to use the laptops or computers for incidental personal uses. The legal issue that arises is whether a staff member has an expectation of privacy with respect to personal information he or she uses or accesses on the school's computer and, if so, what steps a school can take to monitor and inspect a staff member's personal use of the computer.
In the 2012 Supreme Court of Canada decision R. v. Cole1, the Supreme Court found that a high school teacher could reasonably expect a measure of privacy in his personal information stored on a work-issued laptop. The use of the laptop was governed by the school board's Policy and Procedures Manual, which allowed for incidental personal use of the school board's information technology, and provided that email correspondence was private, but did not address other types of files. Use of the laptop was also governed by the school's Acceptable Use Policy, which warned users not to expect privacy in their files. At issue was the seizure of a folder on the teacher's laptop containing nude pictures of an underage student. The Supreme Court found that even taking into account the relevant workplace policies, the employee expected a measure of privacy in his personal information on the laptop, but that it was a diminished expectation of privacy.
The Supreme Court considered the school board policy governing employee use of technology in assessing the "totality of the circumstances" to determine whether privacy is a reasonable expectation in the particular situation. Ironically, the Court found that the school's policies weighed both for and against the reasonable expectation of privacy: for, because the policy permitted use of the laptop for personal use, and against, because the policy deprived the teacher of exclusive control and access to the personal information recorded on the computer.
The findings in the case suggest that acceptable use policies may not be determinative, but they will still be important in determining the scope of the employee's privacy rights. It does not appear that the policies in question were as robust as might have been expected (not addressing the privacy of data other than email, for example). Accordingly, schools should develop comprehensive acceptable use policies that are specifically applicable to teachers and other staff members, and not just to students.
The acceptable use policy should specifically provide that staff members do not have a reasonable expectation of privacy in their use of the school's computer, and in any data or messages stored on the computer or accessed or sent by the computer. It should also provide that the school may inspect the computer at any time with or without notice to the employee, including inspecting the content of any messages sent by the staff member. It is also advisable to include a statement that staff members should use their own personal devices not connected to the school's computer systems if they wish to access data or communicate privately.
In addition to addressing the staff members' rights of privacy, an acceptable use of technology policy applicable to staff members should generally address:
- Obligations on staff members to use the technology in a lawful manner;
- Examples of conduct that violates the policy;
- Whether the staff member is permitted to install software on the school computer;
- Prohibition on copyright infringement;
- Prohibition on disclosure of passwords;
- Responsibility of staff members for content of messages sent;
- Limitations on the rights of staff members to use the computer (this may include a prohibition on using the computer for spamming or business activities unrelated to the school);
- Rights of the school to revoke the staff member's access to the school information services network;
- Consequences for violation of the policy, which should include termination of employment and notification of law enforcement officials.
Schools should also have acceptable use policies governing the use of technology by students. While there will be overlap in the content of the policies, schools should adopt two separate policies: one for students and one for staff. There are sufficient differences in the relationship between a school and its students and a school and its employees that two separate policies are advisable.
Footnote
1. [2012] S.C.J. No. 53.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
