George Orwell famously quipped, "Big Brother is watching you." In our technological age, "Big Brother" is not just the state but also our employer. Consider this, from the moment you enter your login credentials on your workplace computer, there is a chance that your keystrokes are being analyzed and screenshots of your computer activities are being taken by monitoring software. And that's not all, monitoring software will typically allow an employer to review your emails, instant messages, online searches and websites visits.

 

The rationale goes that employers have an interest in ensuring their computer systems are used for proper means and not for unlawful or improper conduct such as information theft, harassment, hate crime, or activities that may expose employers to potential cyber-attacks.  To that end, many employers have established written policies for workplace computer use while advising employees that their computer systems are subject to employer monitoring.  In theory, this would be the end of the matter. However, it is common knowledge that workplace computers are subject to frequent personal use by employees. So, can an employee expect any privacy in materials stored, accessed, or transmitted using workplace computers?

 

Despite the prevalence of workplace computer use, it was not until October 19, 2012, when the Supreme Court of Canada handed down its decision in R.v. Cole, that employee privacy rights on workplace computers were addressed in a substantive manner.  

 

Cole concerned a high school teacher charged with possession of child pornography after sexually explicit photographs of an underage student were discovered on the hard drive of his school-owned laptop. The photos were uncovered by a computer technician who accessed the contents on Cole's laptop via the school's server. After consultation with the principal and school board officials, the laptop, a copy of the hard drive, and browser history of temporary Internet files were provided to the police. The police went on to examine the materials without a warrant and Cole was subsequently charged with possession of child pornography. At trial, Cole successfully challenged the search carried out by police by invoking Section 8 of the Canadian Charter of Rights and Freedoms, which protects citizens from unreasonable search and seizure. The Crown appealed the decision, and the Ontario Court of Appeal rescinded the trial judge’s decision.  Cole then went on to appeal to the Supreme Court.

 

Although the Supreme Court’s analysis in Cole concerned a public sector employee in a criminal context, it nonetheless provides valuable guidance as to what employees (both in the public and private sector) can expect in terms of their workplace privacy rights. Referring to the Court's decision in R.v. Morelli, 2010 SCC 8, Fish J. writing for the majority noted at the outset that:

 

 "...Canadians may reasonably expect privacy in the information contained on their own personal computers. In my view, the same applies to information on work computers, at least where personal use is permitted or reasonably expected. Computers that are reasonably used for personal purposes -- whether found in the workplace or the home -- contain information that is meaningful, intimate, and touching on the user's biographical core." [...] (paragraphs 1 and 2).

 

The Supreme Court went on to note that while workplace policies and practices may diminish an employee's expectation of privacy, the "operational realities," including ownership of property, i.e., the employer's computer, was not determinative in removing the expectation entirely.

 

In determining the existence and extent of an employee's expectation of privacy according to the Supreme Court, one must look at the "totality of the circumstances". In Cole's case, there were a number of factors that supported and diminished his expectation of privacy. In support, the Court noted the following factors:

 

• The school board's Policy and Procedures Manual allowed for the incidental personal use of the board's information technology;

 

• The policy stipulated that teacher's email correspondence remained private, subject to access if specified conditions were met; and

 

• Users were permitted to password-protect their board issued laptops.  

 

On the other hand, the Court found that a number of factors weighted against Cole's expectation of privacy, including:

 

• The board's Policy and Procedure Manual stipulated that all data and messages generated on or handled by board equipment are to be considered property of the school board;

 

• The school's Acceptable Use Policy, although written for students, applied to teachers restricting the use as to which their laptops could be put while warning users not to expect privacy; and

 

• On an annual basis, the board's Acceptable Use Policy was brought to the teachers’ attention.

 

Looking at the totality of the circumstances that weighted in favour and against Cole, the Supreme Court found that a reasonable and informed person in the position of Cole would have an expectation of privacy.  Consequently, the actions of the police were found to have violated Cole’s Section 8 Charter rights.  However, the Court found that the admission of the evidence obtained from the warrantless search would not bring the administration of justice into disrepute. The breach was not high on the scale of seriousness, and its impact was decreased by the diminished privacy interest Cole had in the laptop and the discoverability of the evidence.    

 

Since Cole, there have been a number of cases that have engaged employee privacy interests and their right to unreasonable search and seizure. The majority of these cases are distinctive given the set of facts and circumstances in which they arose. Nonetheless, they are illustrative.

 

In R. v. Baribeau, 2012 SKQB 542, Baribeau, a retiree, was allowed to keep a company-owned laptop. A few years later he reached out to his former company to help repair his computer. The employee in charge of the repair suspected that the computer contained child pornography, therefore he copied the hard drive without telling Baribeau and gave it to police. The Saskatchewan Court of Queen’s Bench found Baribeau’s Section 8 Charter rights were breached after police decided that a warrant was not necessary to examine data turned over to them.

 

In R. v. Jarvis, 2014 ONSC 1801, a high school teacher was caught using a pen camera to surreptitiously record young female students. The pen camera was turned over to the school’s principal and given to police who viewed its contents without a warrant. Jarvis was charged with voyeurism, and sought to challenge the evidence on the grounds that his Section 8 Charter rights were breached. The Ontario Superior Court of Justice found that Jarvis’s Section 8 rights were breached, however, he had a reduced or nominal expectation of privacy in the pen camera given that it was a prohibited device while on school property. 

 

As with the case of Cole, the courts held that the Charter breaches in Baribeau and Jarvis were on the low end of the spectrum of seriousness and allowed the evidence uncovered to stand against the accused in both cases.

 

Given the prevalence of personal use on workplace computers, Cole was and remains a precedent-setting case for employee privacy rights. However, there is an important caveat, and a very important one: while an employer’s policies and practices might not extinguish an employee’s expectation of privacy it does diminish it. Therefore, even though employees have a reasonable expectation of privacy in the workplace, this privacy is not absolute.

 

So next time before you click, surf, or save on a work computer, remember that your employer may still be monitoring you.