Technology has become central to the workplace, with employers regularly providing employees with access to computers and other devices for use in the course of work and employment activities. Personal use of these devices often becomes incidental, especially as the boundaries between the workplace and home blur. As a result, questions arise over who really owns the personal information generated on these workplace devices and the extent of an employee’s privacy rights over any personal information stored on these devices.
The recent Supreme Court of Canada decision of R. v. Cole indicates that an employee’s personal information, even if stored on computers owned by an employer, may attract a reasonable expectation of privacy.
R v. Cole and unreasonable search and seizure
Richard Cole was a high-school teacher who also supervised the use of the school’s networked laptops by students. He was given a laptop, owned by the school board but for his exclusive use, to allow him to carry out this role.
The school board had a policy which allowed employees to use work computers for personal use, while stating that all data and messages generated on or handled by the school board’s equipment would be considered the property of the school board. While conducting maintenance on Mr. Cole’s board-issued laptop, a school board technician found photographs of a partially nude underage female student stored on the laptop. The principal was informed of the photographs and the photographs were copied onto a disc and provided to the police. A police officer, relying on the consent of the principal and the fact that the laptop’s owner was the school board, then conducted a warrantless search of the laptop.
The main issue before the Supreme Court was whether Mr. Cole’s Charter rights were violated by the warrantless search conducted by the police officer contrary to section 8 of the Canadian Charter of Rights and Freedoms. The Court found that while the principal had a statutory duty to maintain a safe school environment and the reasonable power to seize and search the school-issued laptop, the police officer did not. The police officer required judicial authorization to perform the search, either in the form of a warrant or with the consent of Mr. Cole. The consent of the principal was not enough for the purposes of a criminal investigation.
Recognition of an employee’s reasonable expectation of privacy
The implications of R v. Cole are not limited to the Supreme Court’s findings related to the warrantless search of an employee’s employer-owned computer by a police officer. The Supreme Court also addressed the nature of an employee’s personal information stored on a workplace computer. The decision confirmed that employees do have a reasonable expectation of privacy with respect to information stored on workplace computers.
This finding related to an employee’s reasonable expectation of privacy is a departure from previous cases dealing with an employee’s use of workplace computers. In 2009, the Alberta Court of Appeal in Poliquin v. Devon Canada Corporation unequivocally stated that employees do not have a reasonable expectation of privacy with respect to the information stored on a workplace computer. The court in that case found that an employee’s workplace is not their home and although an employer permits limited personal use of workplace computers, the employer may place terms and conditions on that personal use.
R v. Cole has changed the blanket presumption that an employee cannot have a reasonable expectation of privacy with respect to information stored on a workplace computer. Instead, an employee’s reasonable expectation of privacy depends on the policies, practices and customs governing the use of workplace computers.
Employer policies no longer determinative
The majority of the Supreme Court in R. v. Cole stated that a policy on the use of workplace computers may be instructive, but is not determinative when assessing whether the personal information is private. Where an employer’s policies state that the information generated on a workplace computer is not private but nevertheless permits personal use of the device, an employee may be able to claim privacy rights over the information generated by the employee’s personal use of the device. Other factors must be considered including the employer’s actual practice and the type of information generated. Where the information generated from the personal use is “meaningful, intimate, and organically connected to the person’s biographical core” there will be a reasonable expectation of privacy.
Employees’ personal information and invasion of privacy
The implications of recognizing an employee’s reasonable expectation of privacy with respect to personal information generated through the use of workplace technology are not fully understood.
In provinces such as British Columbia, Manitoba, Newfoundland and Labrador, and Saskatchewan, legislation exists that allows individuals to bring an action in the courts for damages related to an invasion of their privacy. This legislation applies where an individual has a reasonable expectation of privacy.
Earlier this year, the Ontario Court of Appeal confirmed that “intrusion upon seclusion” was a cause of action that would attract a civil remedy in Ontario, essentially allowing individuals to sue for invasion of privacy even though there is no provincial privacy legislation recognizing this type of civil action. The Ontario Court of Appeal stated that where a defendant’s conduct is intentional, and the defendant invaded a plaintiff’s private affairs in a manner that a reasonable person would regard as “highly offensive causing distress, humiliation or anguish,” a plaintiff would be entitled to damages for the invasion of privacy.
The R v. Cole decision potentially opens the door for employees to successfully sue employers for invasion of privacy in the workplace. As technology continues to erode the clear distinction between the home and the workplace, this additional protection for employees may be seen as a positive and responsive development addressing the changing reality of the workplace and workplace technology. It also indicates that employers should turn their minds to privacy rights before accessing personal information that may be stored on workplace computers and other devices.
Iler Campbell LLP is a law firm serving co-ops, not-for-profits, charities, and socially-minded small business and individuals in Ontario.
Note: Pro Bono provides legal information designed to educate and entertain readers. But legal information is not the same as legal advice — the application of law to an individual’s specific circumstances. While efforts are made to ensure the legal information provided through these columns is useful, we strongly recommend you consult a lawyer for assistance with your particular situation to obtain accurate advice.