Member Article

The Supreme Court of Canada decision in R v Cole, 2012 SCC 53 may have a significant impact on how employers manage the use of digital devices in the workplace. While a constitutional and criminal decision at its core, the case nevertheless recognizes the importance of employees’ reasonable expectation of privacy when using work computers and other digital devices.

In Cole, the accused was a high school teacher who was issued a laptop computer by his employer. He was permitted to use the computer for incidental personal purposes including internet browsing and storing personal information on the hard drive. While performing remote maintenance on Mr. Cole’s laptop, a technician found a hidden folder containing nude photographs of an underage female student and notified the school’s principal, who directed that the information be copied and eventually handed the information over to police.

The Supreme Court of Canada found that the police had violated Mr. Cole’s constitutional rights by obtaining the laptop from the school board and searching it without a warrant, which could have easily been obtained. Of greater interest to employers, however, are the Court’s comments regarding an employee’s reasonable expectation of privacy when using workplace computers.

Whether or not an employee has a reasonable expectation of privacy will depend on the “totality of the circumstances” which consists of four factors:

• the subject matter of the alleged search;
• whether or not the employee has a direct interest in the subject matter;
• whether or not the employee had a subjective expectation of privacy in the subject matter;
• and whether or not that expectation was objectively reasonable.

In Cole the Court concluded that an objectively reasonable expectation of privacy existed for the laptop. Although the Court noted certain factors against such an expectation of privacy including the presence of a School Board policy manual that expressly asserted ownership over all data contained on its computers and warned that “users should not assume that files stored on network servers or hard drives of individual computers will be private”, it found that those factors were not determinative.

In favour of a reasonable expectation of privacy, the Court noted the presence of a written and actual policy that allowed Mr. Cole to use the computer for personal purposes. Ultimately, however, the Court was most concerned with the nature and importance of the information that might be contained on a workplace computer used for personal purposes. In the Court’s view, information such as browsing history data and personal documents lie at the very heart of the biographical core protected from unreasonable search and seizure.

What does this decision mean for employers? Although decided in a Charter context, this case likely stands for the proposition that employees have a reasonable expectation of privacy over certain data contained on workplace computers, even in the presence of an acceptable use policy. Where there is no reasonable expectation of privacy with regard to particular information, such as work product, then the employer is free to search those documents, particularly if there is a policy in place allowing such searches. Where there is a reasonable expectation of privacy, however, any search must balance the employee’s right to privacy with the employer’s right to investigate wrongdoing taking into consideration the following questions:

• Was the purpose of the search reasonable in all of the circumstances?
• Was the search conducted in a reasonable manner?
• Were there other alternatives to obtain the evidence being sought?

Employers should accordingly be very cautious in ordering a search of employees’ workplace computers.

 

Footnotes: