How much right to privacy do employees have for their personal activities on work computers?
When the case of a teacher who was found with inappropriate photos (including those of a student) and a history of pornographic web searches on his school-issued laptop made it to the Supreme Court, the judges weighed in on what rights employees have on their work tools.
At first glance it may seem odd to find a criminal law case touching on Charter of Rights and Freedoms issues in a column dedicated to employment law issues. However, it is clear that the Supreme Court of Canada’s decision in R. v. Cole transcends criminal and constitutional law and has important and timely implications for employment jurisprudence in relation to an employee’s privacy expectations with regards to information stored on their work laptop.
Worker privacy rights while using their employer-owned devices has become the new battleground in the power struggle between employers and employees.
Here’s what happened.
Cole was a high school teacher who taught computer science. He also supervised the laptop program in place at his school. It was up to Cole to supervise and monitor the students’ lap top use (including emails sent by the students), and it was during his own surveillance efforts that he discovered nude and pornographic images of an underage female student. Cole kept copies of these images in a secret file stored on his school board issued and owned laptop.
While hunting remotely for a virus on the Board’s system, one of the school board’s IT professionals inadvertently discovered Cole’s secret file and the illicit photos. The IT employee suspected the images were of a minor student, so he documented his discovery and immediately reported what he had found to the school principal. The principal requested a copy of the file and soon thereafter demanded that Cole return his laptop and supply his password.
Cole returned the laptop but refused to hand over his password. In addition, Cole specifically asked that the secret file not be accessed by anyone because it contained photographs of his wife. The IT employee made a copy of the laptop’s hard drive and Cole’s internet browsing history (which turned out to contain further pornographic images). The principal and Board officials then delivered copies of the disc and the lap top to the police.
As a result of the police investigation, Cole was charged with possession of child pornography and unauthorized use of a computer in violation of the Criminal Code. However, the police did not obtain a search warrant to access the information on Cole’s computer. And although the laptop belonged to the school board who consented to the search, the investigating officer was aware that Cole and other teachers used their Board-owned laptops for both business and personal use. And that’s what makes this a Charter case on the expectation of privacy on work tools.
The Supreme Court of Canada ultimately heard the case and by a 6-1 majority determined that where an individual reasonably uses a computer for personal purposes, whether at work or at home, and irrespective of who actually owns the computer, personal information that is “meaningful, intimate, and touching on the user’s biographical core” will be contained on the computer. A reasonable expectation of privacy over that personal information arises in this context that is not overridden by an employer policy or by the employer’s ownership of the computer or other technological device.
While the expectation of privacy may be diminished given that the computer is owned by the employer or due to the employer’s policy against misuse of the computer, ownership and policies cannot eradicate an individual’s expectation of privacy.
From an employment law standpoint this case is informative. The employee’s expectation of privacy and the extent of that expectation is, at least in part, determined based on the existence of employer policies governing the use of computer technology. Employers have a clear right to set and enforce policies related to workplace technology. In this way, employers can reserve broad and expansive powers to conduct regular surveillance and monitoring of employer owned technology and to conduct investigations (including surreptitious investigations) in the face of employee privacy interests. Cole‘s legacy ought not to serve to significantly limit an employer’s ability to govern employee technology use.
However, employers without clear and definitive policies regarding technology use and monitoring rights, or employers who allow such policies to be ignored, may run the risk that the Courts may use Cole to carve out a wider zone of employee privacy and freedom as against their employers.
Employers ought to recognize that especially where portable technology is provided to employees, there is invariably an inherent personal use component and employee privacy should be protected within reasonable limits. Moreover, it is also important for employers to tolerate some degree of lawful personal use and to set some reasonable parameters around what constitutes reasonable personal use so that employees have employer established guidelines to follow.
Category: Employment Law, Management,