We use cookies to give you the best online experience. By using our website you agree to our use of cookies in accordance with our cookie policy. Learn more here.Close Me
Employees in Canada retain some reasonable expectation of
privacy in personal data stored on an employer-supplied laptop,
even where workplace policies and practices provide that all
information stored or generated on such devices is the property of
the employer, says the Supreme Court of Canada. However, the
implications of this criminal law case remain unclear for private
sector employers.
In its judgement in R. v. Cole, on appeal from
a decision of the Ontario Court of Appeal, the Court considered
the case of an Ontario high-school teacher, on whose school
board-supplied laptop a school technician found nude images of a
student. The technician copied the photos in question onto a
disk for the school's principal, who seized the laptop and
informed police, who took possession of the laptop and disks, then
examined their contents. The police did not obtain a warrant
before seizing the equipment or examining the contents.
For employers, it is important to note that the real focus of
the decision is on criminal law: the guarantee in the Canadian Charter of Rights and Freedoms
against unreasonable search and seizure and the failure of police
to obtain judicial authorization before accessing the laptop in
question -- not on the rights or powers of private sector employers
to audit employee use of company equipment. In fact, the
majority decision explicitly notes that it leaves "for another
day the finer points of an employer's right to monitor
computers issued to employees."
However, notwithstanding this Charter focus, the
decision may nonetheless provide important guidance to private
sector employers as well.
In its judgement, the Supreme Court drew an important
distinction between the search and seizure of the laptop by school
officials, and its subsequent search and seizure by
police. The Court found that school officials had a statutory
duty to maintain a safe school environment, and therefore, by
necessary implication, a reasonable power to seize and search a
board-issued laptop. However, while it found that the school
was legally entitled to inform the police of its discovery, this
entitlement, and the lawful authority of the employer to seize the
device, did not extend to provide authorization to the police to
examine the contents of the laptop – an act that is prima
facie unreasonable without prior judicial authorization.
By analogy, private sector employers would also have clear
duties to maintain safe, non-discriminatory workplaces, and to
protect the interests of their workforce and shareholders generally
– and may therefore also have reasonable powers of search and
seizure to protect these interests, as well as the legal authority
to advise law enforcement authorities of employee device usage that
may be in breach of law. However, language in the ruling
suggests that such authority by employers may extend only to
content and behaviour that is reasonably connected to these
objectives; not necessarily to all personal data that may be
contained on an employer supplied device or network.
The case also underlines the importance of employers having
clear, documented polices for the use of workplace computers and
networks, particularly if employees are permitted some personal
use, as well as communications and compliance programs to regularly
remind employees of these policies. For the purposes of a
Charter analysis, the Supreme Court found that such
policies and practices served to diminish, but not eliminate, the
reasonable expectation of privacy that an employee would otherwise
have in personal content stored on an employer-supplied
computer. From the perspective of Canadian private sector
privacy laws, such policies help to establish the requisite
knowledge and consent of employees to the collection, use and
disclosure of their personal information.
Finally, although the Court stresses that device ownership is
not a determining factor in assessing the reasonable expectation of
privacy that an employee may have on stored personal data, the
Court's decision may nevertheless have important implications
for the increasing trend toward "Bring Your Own Device",
whereby employers allow employees to use their own devices for work
purposes and to access employer networks. If employees retain
even a diminished expectation of privacy in personal data stored on
an employer-supplied device, employees who own the devices they use
for work purposes might enjoy an even higher expectation of privacy
in such stored information.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
An organization receiving personal information from a third party must ensure it has the individual’s consent prior to collecting, using or disclosing that individual’s personal information.
A discussion on a recent decision of the Alberta Office of the Information and Privacy Commissioner in which an adjudicator emphasizes the narrow scope of personal information that can be considered reasonable to collect, use, and disclose for the purpose of providing background checks.
Canada’s Federal Privacy Commissioner Jennifer Stoddart today released a position paper which offers a roadmap for modernizing Canada’s federal private-sector privacy law, Personal Information Protection and Electronic Documents Act (PIPEDA), so that it more effectively tackles current and future privacy issues.
The Federal Privacy Commissioner and the Provincial and Territorial Commissioners from all provinces and territories, except Quebec, have collaborated on a "Privacy Emergency Kit".
In a case that pitted privacy rights against the efficacy of class notification, the British Columbia Court of Appeal has come down squarely on the side of upholding privacy rights.
The Federal Privacy Commissioner and the Provincial and Territorial Commissioners from all provinces and territories, except Quebec, have collaborated on a "Privacy Emergency Kit".
M-Commerce Privacy & Security 
