In the recent decision
R. v. Cole, released on October 19, 2012, the Supreme Court of
Canada (SCC) indicated that employees may reasonably expect privacy
in the information contained on their work computers, at least
where personal use is permitted or reasonably expected.
The decision does not address an employer's right to monitor
personal information on work computers: it was made in a criminal
Canadian Charter of Rights and Freedoms (Charter) context, and
the SCC expressly said that it would "leave for another day
the finer points of an employer's right to monitor computers
issued to employees." Nonetheless, the decision provides
important guidance in this developing area.
The accused, Mr. Cole, was a high school teacher with a school
board-issued laptop. He was permitted to use the laptop for
incidental personal purposes, and he used it to browse the internet
and store personal data on the hard drive. He also was responsible
for policing student use of school networked laptops, and so was
permitted access to the hard drives of student laptops.
School board policy: a) allowed incidental personal use of
laptops; b) stated that teachers' email correspondence was
private, subject to certain conditions; c) stated that all data and
messages generated or handled by board equipment were the property
of the school board and d) warned users not to expect privacy in
While performing maintenance activities, a school board
technician found a hidden folder containing nude and partially nude
photographs of a female student on Mr. Cole's laptop. The
principal was informed, and the photographs were copied to a CD.
The principal seized the laptop, and school board technicians
copied temporary internet files onto a second CD. The laptop and
both CD's were turned over to the police, who took an image of
the hard drive and reviewed all of the materials without a warrant.
Mr. Cole was charged with possession of child pornography and
unauthorized use of a computer.
The trial judge excluded all of the computer material pursuant
to Section 8 and Subsection 24(2) of the Charter as being
improperly seized without a warrant. The Ontario Court of Appeal
set aside that decision and excluded all of the computer material,
except the CD with the photographs of the student.
The SCC allowed admission of all of the computer material and
ordered a new trial. It found that warrantless access of the
information on Mr. Cole's computer was a Charter breach by the
police, but that, under the circumstances, the admission of the
evidence would not bring the administration of justice into
disrepute, whereas its exclusion would have a marked, negative
impact on the truth-seeking function of the criminal trial
Factors in Considering an Employee's Reasonable
Expectation of Privacy on a Work Computer
The SCC noted that Mr. Cole had a direct interest and subjective
expectation of privacy in the information content of his work
computer, given his use of the laptop to browse the internet and
store personal information on the hard drive.
In assessing whether Mr. Cole's expectation was objectively
reasonable, the SCC noted some points of relevance in considering
an employee's reasonable expectation of privacy:
The closer the subject matter lies to the "biographical
core" of personal information, the more this factor will
favour a reasonable expectation of privacy.
Computers that are used for personal purposes, and especially
those connected to the internet, will reveal private information at
the heart of the "biographical core" of personal
information, which is protected by the Charter.
Written policies are relevant, but not determinative of a
person's reasonable expectation of privacy. One must consider
the totality of circumstances in order to determine whether privacy
is a reasonable expectation, including the policies, practices and
customs or "operational realities," of the workplace, to
the extent that they concern the use of computers by
Conclusion and Recommendations
While a reasonable expectation of privacy on a work computer was
recognized by the SCC, it also noted that expectation can be
diminished by operational realities, including policies.
recognize that allowing personal use of work computers may
accord employees an expectation of some privacy and consider the
risks specific to the position and workplace;
ensure written policies are clearly stated, regularly
communicated and are consistent with the actual use and practices
permitted by the employer in the workplace;
if policies state that information is reviewed or monitored,
follow through and ensure this is actually done; and
promptly and consistently deal with any breaches of
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).