Employee privacy rights may now include personal files on employer-provided devices
Employees may now enjoy a “limited” reasonable expectation of privacy regarding electronic devices provided by their employer. In the recent judgment of R v. Cole, which arose in relation to a criminal proceeding, the Ontario Court of Appeal held that a teacher had a reasonable expectation of privacy with respect to personal files stored on a work laptop.
The appellant, a teacher, was provided with a laptop by his school for use in teaching communication technology and supervising a laptop program for students. As a supervisor of the school’s network, he had authority to remotely access the data stored on student computers connected to the school network. The appellant accessed a student’s email account, found nude photographs of another student and copied them onto the hard drive of his laptop. Some time later, a computer technician employed by the school observed a large amount of activity between the appellant’s laptop and the school’s server, so he remotely accessed the appellant’s hard drive to perform a virus scan and ensure the system’s integrity. In doing so, he accessed a hidden folder on the appellant’s hard drive and found the sexually explicit images.
The technician informed the school of the images, and the laptop was seized by the school board. The school board informed the police and provided them with the teacher’s laptop and information regarding his browsing history. However, the police failed to obtain a warrant before searching the laptop and browsing history. During the criminal trial, the judge excluded all of the evidence from the laptop and browsing history, and held that the teacher had a reasonable expectation of privacy, and the police required a warrant prior to the search. This decision was overturned by the Superior Court of Justice, which held that the teacher had no reasonable expectation of privacy regarding the contents of the laptop. The case was then heard by the Ontario Court of Appeal.
The main issues on appeal was whether the appellant had a reasonable expectation of privacy in the contents of a work computer on which he was entitled to store personal information, and if so, whether the searches by the school breached section 8 of the Charter and whether the failure of the police to obtain a warrant should lead to the exclusion of the evidence.
The Court held that although the computer in question was a work computer owned by the school board and issued for employment purposes, the following factors created a situation whereby the appellant possessed a reasonable expectation of privacy regarding the contents of the computer:
- teachers were given personal possession of the laptops and explicit permission to utilize the laptops for personal use;
- teachers were permitted to take the laptops home on evenings, weekends and summer vacations;
- passwords were employed by teachers to exclude others from their laptops;
- personal information was routinely stored on the laptops hard drives; and
- there was no clear and unambiguous policy to monitor, search or supervise the teachers’ use of their laptops.
However, the appellant's reasonable expectation of privacy was limited to the extent that the school's computer technician could access the laptop to perform work-related functions. Accordingly, as the appellant had no expectation of privacy with respect to this limited type of access, and the images were obtained as a result of this search, the images were admissible. However, as the evidence obtained by police was retrieved without first obtaining a proper warrant, all of the evidence arising from the police’s search of the appellant’s hard drive was ultimately excluded as it violated the appellant’s Charter rights.
As mentioned above, this decision arose out of a criminal proceeding, and as such the Court was tasked with determining whether the school board and/or police violated the appellant’s Charter rights. In making its determination, the Court found that the school board was in fact subject to the Charter, and as such the analysis may not be directly applicable to private sector employers.
However, it is our opinion that this decision does send a clear message to employers regarding developing and implementing properly drafted internet and electronic use policies, particularly regarding electronic devices which employees utilize outside of the workplace. Such policies should contain clear language stating that an employee has no expectation of privacy regarding such devices, that the employer has a right to monitor email and internet use, and the ramifications for improper usage.