The Supreme Court has ruled on a case that began with nude student photos on a teacher’s work computer, but opened the larger question of an employee’s reasonable expectation of privacy when using office technology.
In R v Cole (2012) the school’s computer technician found the photos and alerted the principal, who called the police. The police downloaded and stored the material as well as the browser history without a warrant. The defendant, the teacher Mr. Cole, argued a Charter of Rights violation under section 8, which protects Canadians against unreasonable search and seizure.
The outcome at the Ontario Court of Appeal – here validated by the Supreme Court – is a boon to employee rights and a warning to workplace HR departments. Moreover, the ruling is a strong step toward affirming the new reality that technology is not neutral in legal battles, it impacts the rights relationships we have with others and the way that individuals orient themselves in the world. The holding, written by Justice Fish, described the relationship between computer data and its user with the phrase “connected to his biographical core.”
Workplace policies are also not determinative of a person’s reasonable expectation of privacy… The police in this case infringed the accused’s rights under s. 8 of the Charter. The accused’s personal use of his work-issued laptop generated information that is meaningful, intimate, and organically connected to his biographical core. Pulling in the other direction are the ownership of the laptop by the school board, the workplace policies and practices, and the technology in place at the school. These considerations diminished the accused’s privacy interest in his laptop, at least in comparison to a personal computer, but they did not eliminate it entirely.
The Ontario Court of Appeal (OCA) decision clarified that s.8 did not apply to the school technician performing inspections within the scope of their duties, but rather to state intrusion by police.
The Supreme Court outlined the concept that privacy can be reasonably expected on a workplace computer where personal use is reasonably expected.
In Cole’s case the determinant factors are mixed. The school board granted employees permission to use their laptops for “incidental” personal use. His expectation of privacy, though, should have been limited because the school’s policy was clear that data and messages “generated on or handled by” board devices would be considered school board property.
There are some HR and technology policy-type actions that employers can take to better protect the company’s interest, as outlined here, here, and here.
But there is only so much that employers can do to safeguard. If personal use is allowed or can be reasonably expected on company devices, employees can expect a degree of privacy. However, the situation is not always clear as there are nuances and complexities that can diminish an employee’s expectation of privacy.
One large area not yet explored by pundits is the growing prevalence of sanctioned social media use by companies for external communications and recruitment. The more companies require employees to be on quasi-professional and quasi-personal networks like LinkedIn, Twitter and even in some industries, Facebook, the more the line blurs between professional and personal use on company devices.
Ultimately in R v Cole, the majority felt that the evidence gathered from the laptop could be used when the case was retried. “The admission of the evidence would not bring the administration of justice into disrepute,” wrote Fish.
Justice Abella dissented, arguing that it should be excluded.
There are two related lower court decisions. France (Republic) v Tfaily (2009) is an OCA decision confirming that a university professor must provide personal electronic data to a French government’s terrorism investigation. Poliquin v Devon Canada Corp (2009) is an Alberta Court of Appeal decision that allowed an employer’s application to dismiss a wrongful termination suit following the distribution of inappropriate material using a work computer.
There are multiple privacy statutes federally and provincially, but little recognition of a tort of invasion of privacy. The recent Jones v Tsige (2012) decision introduced a new privacy tort in Ontario, but this case was not appealed to the Supreme Court.
Denise Brunsdon is a JD/MBA candidate at Western University.