Employees in Canada retain some reasonable expectation of privacy in personal data stored on an employer-supplied laptop, even where workplace policies and practices provide that all information stored or generated on such devices is the property of the employer, says the Supreme Court of Canada. However, the implications of this criminal law case remain unclear for private sector employers.
In its judgement in R. v. Cole, on appeal from a decision of the Ontario Court of Appeal, the Court considered the case of an Ontario high-school teacher, on whose school board-supplied laptop a school technician found nude images of a student. The technician copied the photos in question onto a disk for the school's principal, who seized the laptop and informed police, who took possession of the laptop and disks, then examined their contents. The police did not obtain a warrant before seizing the equipment or examining the contents.
For employers, it is important to note that the real focus of the decision is on criminal law: the guarantee in the Canadian Charter of Rights and Freedoms against unreasonable search and seizure and the failure of police to obtain judicial authorization before accessing the laptop in question -- not on the rights or powers of private sector employers to audit employee use of company equipment. In fact, the majority decision explicitly notes that it leaves "for another day the finer points of an employer's right to monitor computers issued to employees."
However, notwithstanding this Charter focus, the decision may nonetheless provide important guidance to private sector employers as well.
In its judgement, the Supreme Court drew an important distinction between the search and seizure of the laptop by school officials, and its subsequent search and seizure by police. The Court found that school officials had a statutory duty to maintain a safe school environment, and therefore, by necessary implication, a reasonable power to seize and search a board-issued laptop. However, while it found that the school was legally entitled to inform the police of its discovery, this entitlement, and the lawful authority of the employer to seize the device, did not extend to provide authorization to the police to examine the contents of the laptop – an act that is prima facie unreasonable without prior judicial authorization.
By analogy, private sector employers would also have clear duties to maintain safe, non-discriminatory workplaces, and to protect the interests of their workforce and shareholders generally – and may therefore also have reasonable powers of search and seizure to protect these interests, as well as the legal authority to advise law enforcement authorities of employee device usage that may be in breach of law. However, language in the ruling suggests that such authority by employers may extend only to content and behaviour that is reasonably connected to these objectives; not necessarily to all personal data that may be contained on an employer supplied device or network.
The case also underlines the importance of employers having clear, documented polices for the use of workplace computers and networks, particularly if employees are permitted some personal use, as well as communications and compliance programs to regularly remind employees of these policies. For the purposes of a Charter analysis, the Supreme Court found that such policies and practices served to diminish, but not eliminate, the reasonable expectation of privacy that an employee would otherwise have in personal content stored on an employer-supplied computer. From the perspective of Canadian private sector privacy laws, such policies help to establish the requisite knowledge and consent of employees to the collection, use and disclosure of their personal information.
Finally, although the Court stresses that device ownership is not a determining factor in assessing the reasonable expectation of privacy that an employee may have on stored personal data, the Court's decision may nevertheless have important implications for the increasing trend toward "Bring Your Own Device", whereby employers allow employees to use their own devices for work purposes and to access employer networks. If employees retain even a diminished expectation of privacy in personal data stored on an employer-supplied device, employees who own the devices they use for work purposes might enjoy an even higher expectation of privacy in such stored information.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
