For various reasons, employers have a need to monitor or
investigate employee use of work computers. How far can that
monitoring or investigation go with respect to personal information
stored on workplace computers? Last year the Supreme Court of
Canada released a decision in the criminal law context where an
employee's expectation of privacy in personal information
stored on workplace computers was diminished by workplace policies,
practices and customs. I asked my colleague Kate Dearden to
briefly discuss the R. v. Cole case and its
impact on organizations.
Question: Can you provide a brief description of the
facts of this case?
Kate: Yes. A teacher at a school,
Cole, was issued a laptop computer by his employer, a school
board. Cole was permitted to use the laptop for work-related
purposes and incidental personal purposes. A school board
technician was performing maintenance activities by remote access
when he discovered a hidden folder of files on Cole's
laptop. The folder contained explicit photos of a female
student at the school, which Cole is alleged to have intercepted
from the student electronically. The technician informed the
school principal, who directed the technician to copy the contents
of Cole's laptop onto a CD, including copies of the photos,
personal photos and Internet browsing history, which were provided
to police along with Cole's laptop. The police conducted
a search and charged Cole with possession of child pornography and
unauthorized use of a computer. The preliminary issue in the
criminal case was whether the evidence obtained by police was
legally obtained, and therefore admissible.
Note that the employer had an information technology policy that
stipulated that e-mails remained private, but could be accessed by
school administrators under certain conditions, including for
maintenance. The policy stated that "all data and
messages" on the employer's equipment were considered to
be the employer's property.
Question: Why is the decision significant to workplaces
Kate: The Supreme Court specifically
stated that Cole did not challenge the initial inspection of the
laptop by the technician in the context of routine
activities. The Supreme Court said it would "leave for
another day the finer points of an employer's right to monitor
computers issued to employees". That being said, the
Supreme Court's comments about personal information stored on
work computers is a new development. Historically, employers
have typically relied on ownership of property and workplace
computer policies to justify surveillance and searches of computer
systems. In R. v. Cole, the Supreme Court
considered the nature of personal information stored on workplace
computers. Such personal information can contain details of
financial, medical and personal situations. It specifically
noted that Internet-connected devices "reveal our specific
interests, likes, and propensities, recording in the browsing
history and cache files the information we seek out and read,
watch, or listen to on the Internet". Accordingly,
personal information stored on work computers where personal use is
permitted "exposes the likes, interests, thoughts, activities,
ideas, and searches for information" of an individual.
Despite the likely existence of personal information on workplace
computers, the Supreme Court stated that the "operational
realities" of a workplace, such as policies, practices and
customs, may diminish an employee's expectation of privacy in
personal information, although it cannot remove the expectation
Question: What should organizations be considering in
light of this decision?
Kate: Organizations should limit the
personal information stored on work computers. They can do so
by having clear policies, practices and customs relative to
personal use and storage of personal information on work-issued
computers. Such policies should be enforced consistently and
reviewed periodically. Also, they should assess the
"operational realities" of the workplace to understand
whether permitted or condoned personal use could interfere with an
employer's legitimate need to search its devices.
Question: This decision involved a laptop. Would
there be a similar decision if it, for example, involved an
employer-issued smart phone?
Kate: The Supreme Court did not address
an employee's expectation of privacy in other computer devices
such as smart phones. It also did not address whether
employees have a reasonable expectation of privacy in personal
information in the form of text messages, photos and personal
e-mail accounts. Given the ease with which personal and
private information can be mingled on these devices, the issue of
an employee's reasonable expectation of privacy is likely to
become a more complex issue and one yet to be fully considered by
Under the Income Tax Act, the Employment Insurance Act, and the Excise Tax Act, a director of a corporation is jointly and severally liable for a corporation's failure to deduct and remit source deductions or GST.
Under the Income Tax Act, the Employment Insurance Act, the Canada Pension Plan Act and the Excise Tax Act, a director of a corporation is jointly and severally liable for a corporation's failure to deduct and remit source deductions.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).