The Supreme Court of Canada (SCC) has released its decision in a privacy case that has been winding its way through the courts for more than 4 years. In R. v. Cole, the SCC determined that an employee has a reasonable expectation of privacy in the information contained on their work computers, provided their employer permits some personal use of those devices.
The case is only indirectly applicable to private employers, as it is primarily a criminal case involving a search and seizure by the state (i.e. the police). In brief, the Accused was a high school teacher who had some responsibility for overseeing the School’s computer network. The Principal of the School had reason to believe the Accused was storing pornographic pictures of a student in a folder on the School’s network. As part of the School’s investigation, it made a copy of the files the Accused was storing on the School’s network and seized the School-owned laptop that had been issued to him. It then turned the files and the laptop over to the police. The police reviewed the materials without obtaining a search warrant. The Accused was subsequently charged under the Criminal Code with possession of child pornography.
The issue for the courts was whether the police had breached the Accused’s Charter Rights by conducting a warrantless search, and if so, whether the evidence obtained from the School’s network and laptop should be excluded. The lower courts disagreed on the extent to which the Accused had a reasonable expectation of privacy in the contents of the School’s computer systems and devices. The SCC ultimately sided with the Accused, holding that his privacy interest in his work computer was similar to, although not as strong as, the privacy interest he would have had in his own personal computer. As such, the police had violated the Accused’s Charter rights when they searched the School’s laptop without first obtaining a warrant. However, taking into account a number of other factors relevant to this particular case, the SCC determined that the evidence should not be excluded.
The SCC expressly indicated in its decision that it was not dealing with the issue of an employer’s right to monitor its own networks and/or computers. However, there are a number of points that employers can take away from this decision:
- Employers should develop a clear and comprehensive computer use policy that is consistently enforced.
- Employers should ensure that their computer use policy is realistic and in accordance with what actually takes place in the workplace. A policy that prohibits any personal use may be difficult to enforce unless the employer takes additional steps, such as actively blocking or restricting internet and network access.
- Many employers will permit some personal use of work computers by employees, provided it is limited and does not interfere with work duties. However, a computer use policy can still be used to limit an employee’s expectation of privacy when using their work computer by, for example, advising the employee that the employer reserves the right to monitor any such use as appropriate.