Is an employee entitled to privacy over e-mail and other data created and stored on a computer used for work purposes? What rights does an employer have to access that information? The answer to these questions depends on whether the employee has a reasonable expectation of privacy over the information stored on a given computer.
What Is A Reasonable Expectation Of Privacy?
Two criteria must be established to show a reasonable expectation of privacy. First, an employee must have a subjective expectation of privacy, which is usually demonstrated through steps taken to protect the information in question. Second, the employee's expectation of privacy must be objectively reasonable.
Determining whether the subjective and objective criteria are present involves asking key questions such as:
- Who owns the physical equipment on which the data is
stored?
- Has the data been transferred to the employer's
system or network or to third parties?
- Does the employer have an information management/employer
access policy in place?
- How is the data arranged on the computer? Is employer
data segregated from other material on the employee's
personal computer?
- Has the employee attempted to password-protect his or her
computer and/or selected files?
Employer's Ownership Of The Computer
An employer's ownership of a computer used by an employee for work purposes is a strong factor militating against an employee's reasonable expectation of privacy over data stored on that computer, even over data generated by incidental personal use. Several Canadian arbitrators have ruled that employees who use an employer system to send and receive e-mail messages and to post messages on discussion boards have no right to privacy. In one of these cases, the arbitrator stated that an employee could not expect to have any right of privacy when using the employer's e-mail and Internet facilities.
Ownership is such a significant factor that in one case an arbitration board held that where a terminated employee had used the employer-owned laptop both at home and at work to access an independent Internet-based e-mail service (Hotmail), any reasonable expectation of privacy over his Hotmail e-mail account was trumped by the employer's right to search its own property.
Employer Policies
Another significant factor in determining if a reasonable expectation of privacy exists is whether an employer has a policy governing e-mail and Internet use or not. In one case, the existence of an employer's policy against the use of the e-mail system for unacceptable purposes, and a clear log-on warning that the system would be monitored in accordance with such policies, were found to undermine an employee's expectation of privacy.
Employee's Ownership Of The Computer
If the employee owns the computer personally but uses it for work purposes, does a reasonable expectation of privacy exist with respect to the data stored on that computer? In Canada, the answer to this question is unclear.
In the US, certain decisions have favoured an employer's right of access where an expectation of privacy is not objectively reasonable. For example, there was no reasonable expectation of privacy over the files stored on an individual's own laptop, which had been connected to a military base network with a shared drive. Similarly, there was no reasonable expectation of privacy over the information stored on an employee's computer, where an employee voluntarily brought his own computer to work to use for work purposes and took no steps to password-protect the data.
McCarthy Tétrault Notes:
Many employers wish to monitor employee use of computers and networks for a variety of reasons, including preventing the collection and dissemination of illegal material (such as child pornography) and preventing employee theft of time associated with prolonged personal use of the Internet and the employer's e-mail network.
Given the uncertainty of the law in Canada, employers should implement clear-cut and comprehensive policies governing their right to access data and systems. If an employer does not want an employee to have a reasonable expectation of privacy over any data found on a computer, then this should be clearly stated. Employees should be required to acknowledge that they have read, understood and agreed to abide by the policies.
Employers should also make clear that copies of employer-owned data remain the employer's property regardless of where the data is stored.
Finally, employers may manage employee privacy expectations over information stored on laptops by providing company laptops to employees for offsite work and capitalizing on their ownership of the equipment.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.