Do employees have a reasonable expectation of privacy with
respect to their personal information stored on workplace computers? This is a
complex legal question, affecting the rights of charities and not-for-profits
in their capacities as employers. In the recently released Supreme Court of
Canada decision R. v. Cole, Canada’s highest court affirmed that employees can reasonably expect at least
some privacy in the personal information they may generate on their workplace
As explained below, the Cole decision arose in relation to a criminal
proceeding. As such, the decision does not have direct application to private
sector employees, including those of charities and not-for-profits. However,
the decision does provide useful insight regarding how courts in Canada may
approach the issues of workplace computer privacy. This Charity Law Bulletin will review the Cole decision, and provide guidance on how employees may
address the issues of workplace computers and employee privacy concerns.
B. THE FACTS
R. v. Cole is a criminal case, but with important
implications for the workplace. Richard Cole was a high school computer
teacher who was charged with possession of child pornography and unauthorized
use of a computer pursuant to ss.163.1(4) and 342.1(1) of the Criminal Code.
During regular maintenance activities by a school board computer technician,
hidden files containing nude and partially nude pictures of an underage female
student were discovered on Mr. Cole’s computer. The laptop computer supplied
to Mr. Cole by the school, and its use, was governed by the school board’s
Policy and Procedures Manual, which allowed for “incidental personal use of the
board’s information technology.” The policy stated that all teachers’ email correspondence would remain private,
but school administrators could access it if specified conditions were met.
The school’s Acceptable Use Policy, a student use policy which restricted
laptop use and warned users to not expect privacy in their files, was also
applicable to the teachers.
Following the search of the computer by the technician and
school administrators, the police then performed a warrantless search. The warrantless
search by police of the laptop and photographs copied onto compact discs by the
technician was found by the trial judge to be in violation of ss.8 and 24(2) of the Canadian Charter of Rights and Freedoms.
The summary conviction appeal court overturned the trial judge’s decision and
found that Mr. Cole’s section 8 rights were not violated.
The Court of Appeal for Ontario however, held that the police did infringe his
section 8 rights and the Supreme Court of Canada upheld this finding, stating that Mr. Cole
“expected a measure of privacy in his personal information on the laptop.”
However, the Supreme Court also held that the evidence which the police
obtained as a result of the search should not be excluded from the
trial, as its admission “would not bring the administration of justice into
C. RIGHT TO PRIVACY: WORKPLACE COMPUTERS
As noted by the Supreme Court of Canada, personal
information stored on computers can be “meaningful, intimate, and touch(es) on
the user’s biographical core”.
Where a workplace permits personal use of computers, stored information
“exposes the likes, interests, thoughts, activities, ideas and searches for
information” of an individual employee.
Accordingly, the Supreme Court held that employees would have a reasonable
expectation of privacy concerning the personal information, where personal use
is either expressly permitted or reasonably expected. This finding has
important implications for employers, in terms of managing employee
expectations of privacy, and protecting the employer from the abuse of
D. WORKPLACE COMPUTER POLICIES
The Supreme Court of Canada noted that
“workplace policies and practices may diminish an employee’s expectations of
privacy in a work computer.”
Therefore, practices and policies of the workplace will be relevant, and the “operational
realities” of the office may decrease the reasonable expectation of privacy an
employee might otherwise have.
Employers though, cannot rely on written policies alone in the determination of
their employee’s expectation of privacy – in the end it will be the “totality
of the circumstances” that will determine whether privacy is to be expected.
In the Cole case, the school board stated in their
policy that they owned “all data and messages generated on or handled by board
equipment” and the Student Acceptable Use Policy (also applicable to teachers) stated
that email and work saved on hard drives would be monitored and users were
warned that they “should NOT assume that files stored on network servers or
hard drives of individual computers will be private.”
The operational realities of the workplace in this situation therefore limited
the privacy that Mr. Cole and other teachers should have expected in their
computer files. Even so, the Supreme Court of Canada, looking at the “totality
of the circumstances” still recognized a constitutionally protected privacy
interest, as the information that was generated on the work computer from Mr.
Cole’s personal use was “meaningful, intimate, and organically connected to his
Although workplace policies and procedures were in place, and the computer was
owned by the school board, it still did not completely eliminate his privacy rights.
The Cole decision highlights the importance of
employers, including charities and not-for-profits, developing workplace
computer policies governing employee use of work computers, Smartphones and
other mobile communication devices. Although the Supreme Court of Canada has
not commented on the right of an employer to monitor an employee’s computer use,
employers should be aware that some employees may still attempt to rely on Cole to limit their employer’s monitoring rights, claiming an invasion of privacy.
Employers obviously have a legitimate interest in how
their computers are used by employees. Employers need to protect confidential
information and the integrity of their equipment and software. They also may
require monitoring of computer use in order to assess employee performance
issues, or to investigate harassment, workplace violence or human rights
complaints. In light of the Cole decision, employers will need to take
proactive steps to manage their employees’ expectations for the privacy of any
work related computer use. Employers should be clear that work computers are
for work only, and that any personal communications must be limited, and/or
transactions should be done on their own computers or devices. By implementing
and adhering to these policies, employers can limit an employee’s privacy
expectations, by making it clear that the employee’s work computer use is not private and may be monitored.