Employees in Canada retain some reasonable expectation of
privacy in personal data stored on an employer-supplied laptop,
even where workplace policies and practices provide that all
information stored or generated on such devices is the property of
the employer, says the Supreme Court of Canada. However, the
implications of this criminal law case remain unclear for private
In its judgement in R. v. Cole, on appeal from
a decision of the Ontario Court of Appeal, the Court considered
the case of an Ontario high-school teacher, on whose school
board-supplied laptop a school technician found nude images of a
student. The technician copied the photos in question onto a
disk for the school's principal, who seized the laptop and
informed police, who took possession of the laptop and disks, then
examined their contents. The police did not obtain a warrant
before seizing the equipment or examining the contents.
For employers, it is important to note that the real focus of
the decision is on criminal law: the guarantee in the Canadian Charter of Rights and Freedoms
against unreasonable search and seizure and the failure of police
to obtain judicial authorization before accessing the laptop in
question -- not on the rights or powers of private sector employers
to audit employee use of company equipment. In fact, the
majority decision explicitly notes that it leaves "for another
day the finer points of an employer's right to monitor
computers issued to employees."
However, notwithstanding this Charter focus, the
decision may nonetheless provide important guidance to private
sector employers as well.
In its judgement, the Supreme Court drew an important
distinction between the search and seizure of the laptop by school
officials, and its subsequent search and seizure by
police. The Court found that school officials had a statutory
duty to maintain a safe school environment, and therefore, by
necessary implication, a reasonable power to seize and search a
board-issued laptop. However, while it found that the school
was legally entitled to inform the police of its discovery, this
entitlement, and the lawful authority of the employer to seize the
device, did not extend to provide authorization to the police to
examine the contents of the laptop – an act that is prima
facie unreasonable without prior judicial authorization.
By analogy, private sector employers would also have clear
duties to maintain safe, non-discriminatory workplaces, and to
protect the interests of their workforce and shareholders generally
– and may therefore also have reasonable powers of search and
seizure to protect these interests, as well as the legal authority
to advise law enforcement authorities of employee device usage that
may be in breach of law. However, language in the ruling
suggests that such authority by employers may extend only to
content and behaviour that is reasonably connected to these
objectives; not necessarily to all personal data that may be
contained on an employer supplied device or network.
The case also underlines the importance of employers having
clear, documented polices for the use of workplace computers and
networks, particularly if employees are permitted some personal
use, as well as communications and compliance programs to regularly
remind employees of these policies. For the purposes of a
Charter analysis, the Supreme Court found that such
policies and practices served to diminish, but not eliminate, the
reasonable expectation of privacy that an employee would otherwise
have in personal content stored on an employer-supplied
computer. From the perspective of Canadian private sector
privacy laws, such policies help to establish the requisite
knowledge and consent of employees to the collection, use and
disclosure of their personal information.
Finally, although the Court stresses that device ownership is
not a determining factor in assessing the reasonable expectation of
privacy that an employee may have on stored personal data, the
Court's decision may nevertheless have important implications
for the increasing trend toward "Bring Your Own Device",
whereby employers allow employees to use their own devices for work
purposes and to access employer networks. If employees retain
even a diminished expectation of privacy in personal data stored on
an employer-supplied device, employees who own the devices they use
for work purposes might enjoy an even higher expectation of privacy
in such stored information.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).