In R. v. Richard Cole, 2012 SCC 53, the Supreme Court of Canada reviewed the Court of Appeal’s decision that an employee’s rights were infringed under s. 8 of the Canadian Charter of Human Rights and Freedoms (the “Charter”) by the police searching his work laptop computer and the exclusion of the disc containing the temporary Internet files, the laptop, and the mirror image of its hard drive containing child pornography.
The employee, a high-school teacher, was charged with possession of child pornography and unauthorized use of a computer. The employee was permitted to use the work-issued laptop computer for incidental personal purposes. A technician, while performing maintenance activities, found a hidden folder containing nude and partially nude photographs of an underage female student. The technician notified the principal and made a copy of the photographs to a compact disc. The principal seized the laptop and the temporary Internet files were copied on a second disc. Without a warrant the police reviewed the contents of the laptop and both discs and created a mirror image of the hard drive for forensic purposes. The Trial Judge excluded all of the computer materials pursuant to ss. 8 and 24(2) of the Charter.
The Appeal Court concluded that the employee had a reasonable expectation of privacy in the informational content of the laptop, but that this expectation was modified to the extent that the employee knew that the employer’s technician could and would access the laptop as part of his role in maintaining the technical integrity of the school’s information network; therefore the search and seizure of the laptop by the principal and the school board was technically not a “search” under s. 8 of the Charter, was authorized by law and reasonable, and the disc containing the photographs was thus created without breaching s. 8. The Court of Appeal excluded the laptop and the mirror image of its hard drive pursuant to s. 24(2) of the Charter, as well as the disc containing the Internet files, but only provisionally, leaving it up to the Trial Judge to re-assess the admissibility of this evidence if the evidence becomes important to the truth-seeking function as the Trial unfolds.
The Supreme Court of Canada examined whether the employee had a reasonable expectation of privacy in his employee-issued work computer, whether the search and seizure by the police of the laptop and the disc containing the Internet files was unreasonable under s. 8 of the Charter and whether the evidence should be excluded under s. 24(2) of the Charter. The Court said yes to only the first two questions.
The Court cited R. v. Morelli, [2010] 1 S.C.R. 253, which holds that employees are entitled to a reasonable expectation of privacy in the information contained on their own personal computers, and extended this to apply to information on work computers, at least where personal use is permitted or reasonably expected.
Justice Fish, writing for the majority, said,
“Computers that are reasonably used for personal purposes – whether found in the workplace or the home – contain information that is meaningful, intimate, and touching on the user’s biographical core. Vis-à-vis the state, everyone in Canada is constitutionally entitled to expect privacy in personal information of this kind. While workplace policies and practices may diminish an individual’s expectation of privacy in a work computer, these sorts of operational realities do not in themselves remove the expectation entirely: The nature of the information at stake exposes the likes, interests, thoughts, activities ideas, and searches for information of the individual user. Such was the case here.”
The Court concluded that privacy is a matter of “reasonable expectation” and depends on the “totality of the circumstances” being a test of substance and not form. The test consists of four lines of inquiry – 1) subject matter, 2) whether the claimant had a direct interest in the subject matter, 3) whether the claimant had a subjective expectation of privacy in the subject matter, and 4) whether the subjective expectation of privacy was objectively reasonable, having regard to the totality of the circumstances.
The subject matter is the data, or “informational content of the laptop’s hard drive, it’s mirror image, and the Internet files disc”. The employee’s “direct interest and subjective expectation of privacy in the informational context of his computer can readily be inferred from his use of the laptop to browse the Internet and to store personal information on the hard drive.”
With respect to whether the subjective expectation of privacy was objectively reasonable, the Court concluded that, “The more personal and confidential the information, the more willing reasonable informed Canadians will be to recognize the existence of a constitutionally protected privacy interest.” Computers that are used for personal purposes, regardless of where they are found or to whom they belong, contain the details of our financial, medical, and personal situations, particularly where the computer is used to browse the Web. Our “biographical core” – specific interests, likes, and propensities, is revealed through Internet-connected devices.
The Court likened this case to Morelli as it is with respect to “highly revealing and meaningful information about an individual’s life”, however in this case the information was on a work-issued laptop and not a personal computer in a private residence.
Even though the Policy and Procedures Manual of the employer asserted ownership over the hardware and data stored on it, the ownership “is not determinative”…”nor should it carry undue weight within the contextual analysis”.
Rather, the “context in which personal information is placed on an employer-owned computer is significant.” “The policies, practices, and customs of the workplace are relevant to the extent that they concern the use of computers by employees. These operational realities may diminish the expectation of privacy that reasonable employees might otherwise have in their personal information.”
For example, the actual practice of permitting personal use of the work issued laptop, and the employee having a password, weighed for a reasonable expectation of privacy. But because policy and technological reality deprive exclusive control and access to personal information, i.e., the contents of the hard drive was available to all other users and technicians with domain administration rights, a reasonable expectation of privacy is diminished. One must consider the “totality of the circumstances” in order to determine whether privacy is a reasonable expectation in the particular situation.
The Court considered the nature of the employee’s information on the laptop – meaningful, intimate, and organically connected to his biographical core, and the ownership of the laptop by the employer, the workplace policies and practices, and the technology in place at the school, and concluded that the employee’s privacy interest in his laptop was diminished but not eliminated entirely, favouring a constitutionally protected privacy interest.
Impact of Decision on Employers
Employers should ensure that Hiring Letters and Employment Agreements are carefully drafted with respect to whether an employee should expect privacy on computers supplied by employers, and if so, in what circumstances. Even when carefully drafted, employers should exercise caution with respect to accessing the information, and providing computers or data storage devices over to the police absent a search warrant. When employers’ are confronted with issues of whether or not to access an employee’s personal information on a company computer or whether to hand an employee’s personal information to the police, they should first consult with experienced Employment Law counsel.
Impact of Decision on Employees
Employees should be aware that they may have an expectation of privacy to personal information on a company owned computer and that any access by an employer, or dissemination of this information to the police without a warrant could be in violation of the law and entitle the employee to an award of damages. If an employee learns that their personal information on a company owned computer system had been accessed by the employer or the police to that employee’s detriment, experienced Employment Law counsel should be consulted. The full impact of this decision on employees’ right to privacy in the workplace will become clearer as this decision is applied to new cases across the country.
Minken Employment Lawyers is your source for expert advice and advocacy on today’s employment law issues. Whether you are an employer or employee, we can help. Contact us to see how.