Is an employee entitled to privacy over e-mail and other
data created and stored on a computer used for work purposes?
What rights does an employer have to access that information?
The answer to these questions depends on whether the employee
has a reasonable expectation of privacy over the
information stored on a given computer.
What Is A Reasonable Expectation Of Privacy?
Two criteria must be established to show a reasonable
expectation of privacy. First, an employee must have a
subjective expectation of privacy, which is usually
demonstrated through steps taken to protect the information in
question. Second, the employee's expectation of privacy
must be objectively reasonable.
Determining whether the subjective and objective criteria
are present involves asking key questions such as:
Who owns the physical equipment on which the data is
Has the data been transferred to the employer's
system or network or to third parties?
Does the employer have an information management/employer
access policy in place?
How is the data arranged on the computer? Is employer
data segregated from other material on the employee's
Has the employee attempted to password-protect his or her
computer and/or selected files?
Employer's Ownership Of The Computer
An employer's ownership of a computer used by an
employee for work purposes is a strong factor militating
against an employee's reasonable expectation of privacy
over data stored on that computer, even over data generated by
incidental personal use. Several Canadian arbitrators have
ruled that employees who use an employer system to send and
receive e-mail messages and to post messages on discussion
boards have no right to privacy. In one of these cases, the
arbitrator stated that an employee could not expect to have any
right of privacy when using the employer's e-mail and
Ownership is such a significant factor that in one case an
arbitration board held that where a terminated employee had
used the employer-owned laptop both at home and at work to
access an independent Internet-based e-mail service (Hotmail),
any reasonable expectation of privacy over his Hotmail e-mail
account was trumped by the employer's right to search
its own property.
Another significant factor in determining if a reasonable
expectation of privacy exists is whether an employer has a
policy governing e-mail and Internet use or not. In one case,
the existence of an employer's policy against the use
of the e-mail system for unacceptable purposes, and a clear
log-on warning that the system would be monitored in accordance
with such policies, were found to undermine an
employee's expectation of privacy.
Employee's Ownership Of The Computer
If the employee owns the computer personally but uses it for
work purposes, does a reasonable expectation of privacy exist
with respect to the data stored on that computer? In Canada,
the answer to this question is unclear.
In the US, certain decisions have favoured an
employer's right of access where an expectation of
privacy is not objectively reasonable. For example, there was
no reasonable expectation of privacy over the files stored on
an individual's own laptop, which had been connected to
a military base network with a shared drive. Similarly, there
was no reasonable expectation of privacy over the information
stored on an employee's computer, where an employee
voluntarily brought his own computer to work to use for work
purposes and took no steps to password-protect the data.
McCarthy Tétrault Notes:
Many employers wish to monitor employee use of computers and
networks for a variety of reasons, including preventing the
collection and dissemination of illegal material (such as child
pornography) and preventing employee theft of time associated
with prolonged personal use of the Internet and the
employer's e-mail network.
Given the uncertainty of the law in Canada, employers should
implement clear-cut and comprehensive policies governing their
right to access data and systems. If an employer does not want
an employee to have a reasonable expectation of privacy over
any data found on a computer, then this should be clearly
stated. Employees should be required to acknowledge that they
have read, understood and agreed to abide by the policies.
Employers should also make clear that copies of
employer-owned data remain the employer's property
regardless of where the data is stored.
Finally, employers may manage employee privacy expectations
over information stored on laptops by providing company laptops
to employees for offsite work and capitalizing on their
ownership of the equipment.
The content of this article is intended to provide a
general guide to the subject matter. Specialist advice should
be sought about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
Unfortunately, reasonable accommodation for employees in the workplace continues to be the source of significant litigation and even today we continue to see outrageous examples of employers behaving badly.
We are now beginning to see reported cases involving charges and subsequent fines laid against employers for failing to provide information, instruction and supervision to protect a worker from workplace violence.
On October 13, 2016, the Supreme Court of Canada denied leave to appeal an Ontario Court of Appeal decision which ordered an employer to pay a former employee 37 months of salary and benefits following termination.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).