Reasonable Expectations: SCC Considers Employee Privacy in the Workplace
In many industries, the need of employers to ensure their employees remain connected and available has become hypercritical over the years. To address this need, many employers have found it advantageous to provide their employees with their own work-issued computers or smart phones and it is commonly understood that such devices will be used for both business and personal purposes. Despite the prevalence of this practice, the extent of rights an employee maintains in information generated through personal use but stored on work-issued devices has remained somewhat of an open question. Indeed, as more biographical core information is being stored on work-issued devices, the line between what remains private and what remains property of the employer becomes increasingly blurred.
Fortunately, the Supreme Court of Canada (SCC) recently weighed in on the issue and provided some guidance as to privacy rights in the workplace in the much anticipated decision of R v. Cole which was released in October of this year. Although a criminal court case, privacy rights struck at the core of the judgment and the SCC confirmed that employees have a reasonable expectation of privacy in the information contained on their work-issued computers even in the face of employment policies stating otherwise.
In this case, Mr. Cole, a high school teacher, was given a laptop for work which he was permitted to use (and did in fact use) for incidental personal purposes.
During a scheduled maintenance of Mr. Cole’s computer, a technician found a hidden folder which contained partially nude photos of a young female student.
The technician, after notifying the principal of this discovery, copied the pictures onto a CD. The laptop together with the duplicate CD was then handed over to the police who, in turn and without a warrant, reviewed the materials and made copies thereof. Mr. Cole was subsequently charged with possession of child pornography and unauthorized use of a computer. At issue in the case was whether the police required a warrant to legally obtain the information on Mr. Cole’s computer and, if so, whether the failure to procure such a warrant required the exclusion of the unconstitutionally obtained evidence. The police argued that a warrant was unnecessary because they relied on the school board’s representation that it was the owner of the computer and its data and was therefore able to consent to the search and seizure of the evidence in question.
At trial, the court excluded all the evidence on grounds of violating sections 8 and 24(2) the Canadian Charter of Rights and Freedoms (the Charter) and, with the prosecution not being able to offer any additional evidence, the charges were dismissed. On appeal, this decision was reversed and then later reversed again by the Ontario Court of Appeal (OCA) which agreed with the trial court’s decision to exclude all the unconstitutionally obtained evidence. This matter was then appealed to the SCC which was tasked with considering three issues including whether the OCA erred in concluding that Mr. Cole had a reasonable expectation of privacy in his employer-issued work computer.
In considering the questions on appeal, the SCC began with an overview on the law of privacy in the employment context. Justice Fish, writing for the majority, stated that “[p]rivacy is a matter of reasonable expectations. An expectation of privacy will attract Charter protection if reasonable and informed people in the position of the accused would expect privacy .” Fish J. went on to state that this reasonable expectation of privacy must be assessed in view of the totality of the circumstances and that four lines of inquiry guide the application of this test:
an examination of the subject matter of the alleged search;
a determination as to whether the claimant had a direct interest in the subject matter;
an inquiry into whether the claimant had a subjective expectation of privacy in the subject matter; and
an assessment as to whether this subjective expectation of privacy was objectively reasonable, having regard to the totality of the circumstances.
In the present case, the SCC noted that the subject matter requiring its consideration was “informational privacy” and, thus, the court’s application of the remaining prongs of the totality of circumstances test must be predicated on this determination. In considering the other lines of inquiry, the SCC found that direct and subjective expectation of privacy in the informational content of Mr. Cole’s computer was easily inferred from Mr. Cole’s use of his work-issued laptop to browse the net and store personal information on the hard drive. In evaluating the last prong of the test, Fish J. stated that there is no definitive list of factors that must be considered but that existing jurisprudence may help inform the analysis. In this regard, Fish J. summarized the law and noted that “[t]he closer the subject matter of the alleged search lies to the biographical core of personal information, the more this factor will favour a reasonable expectation of privacy. Put another way, the more personal and confidential the information, the more willing reasonable and informed Canadians will be to recognize the existence of a constitutionally protected privacy interest .”
The SCC then considered scenarios where an expectation of privacy would be heightened such as in the case where computers – whether personal or work-issued – are used to browse the Internet. Fish J. stated that the expectation of privacy is more pronounced in these cases as “[i]nternet-connected devices reveal our specific interests, likes, and propensities, recording in the browsing history and cache files the information we seek out and read, watch or listen to on the Internet.” Accordingly, “[t]his sort of private information falls at the very heart of the “biographical core” protected by section 8 of the Charter.”
Despite the fact that internet browsing might attract a greater expectation of privacy in certain cases, the SCC recognized that there are counterbalancing factors which might diminish this expectation. These factors include the existence and robustness of employer policies and procedures governing the ownership and use of work issued computers. In the present case, the school board did have such a policy in place and it was communicated to Mr. Cole and other teachers on an annual basis. Of note to the SCC was that the policy and procedures manual stipulated that the administrators would have access to the information stored on the computers, that the computers were the property of the school board and that all data and messages stored on the computer were also the property of the school board. Although the SCC found that these “operational realities” may diminish the expectation of privacy that a reasonable employee might otherwise have in their personal information, they did not entirely eliminate it. Again, in each case, a totality of the circumstances test must be undertaken to determine whether such reasonable expectation of privacy legitimately exists.
Ultimately, the SCC held that Mr. Cole had a reasonable expectation of privacy in the information he stored on his work computer and, as a result, the police ought to have obtained a warrant prior to the search and seizure of such material. Despite the Charter breaches that were found, the SCC determined that the unconstitutionally obtained evidence was nevertheless admissible on the grounds that the exclusion of the material would have a marked negative impact on the truth-seeking function of the criminal trial process .
Although this case involved state action invoking Charter review, the decision is one of importance to employers generally because it provides a window into how courts will likely consider and assess workplace privacy rights claims in the absence of state involvement in the future. Moreover, based on how the SCC examined the school board’s policies and procedures in this case and adjusted the expectation of privacy level accordingly, it is evident that these types of employer policies matter and will come under scrutiny in a judicial review. A carefully drafted policy which addresses, among other things, device and data ownership rights, access issues and disciplinary measures could considerably protect an employer’s right to monitor an employee’s work-issued device and take corrective action in the face of non-compliance. Employers should therefore, in consultation with counsel, review their policies and procedures relating to work-issued computers and smart devices to ensure that they don’t inadvertently raise the privacy expectation bar.
The content of this article is intended to provide general information for the reader and is not intended as advice or an opinion to be relied upon in relation to any particular circumstance. For specific applications of the law to a particular set of circumstances, the reader should seek professional advice.
Nadia Somani practices in the areas of corporate finance, securities and corporate law with McLean & Kerr LLP, a law firm based in Toronto.