The Supreme Court of Canada has recently released its decision in R. v. Cole which deals with work computers and an employee’s reasonable expectation to privacy.
While this was a criminal case, the issues addressed are relevant to employers as it deals with an employee’s right to privacy when using a work computer.
The case involves a high-school teacher who was charged with possessing child pornography. Pictures of underage female students were discovered on his work-issued laptop by a technician who was performing regular maintenance activities. It was known and permitted by the employer that the laptop would be used for personal purposes.
The Supreme Court ruled that computers used for personal purposes, regardless if they are found in one’s home or in the workplace, generate information that is “meaningful, intimate, and touching on the user’s biographical core”. Therefore, the Supreme Court ruled that Canadians may reasonably expect privacy in the information contained on their work computers where such privacy would be permitted or reasonably expected. Policies and practices implemented in the workplace may diminish an individual’s expectation of privacy in a work computer but they do not remove the expectations entirely.
IMPLICATIONS FOR EMPLOYERS
While the Supreme Court decision deals with police actions, it still contains implications for employees’ use of work property.
There now exists an expectation of an employee’s privacy even when using an employer’s property. While the case centred on a laptop it is likely that the decision may be extended to other electronic devices such as smart phones, iPads, tablets, etc.
In order to determine the amount of privacy to which an employee is entitled, the case further emphasizes looking at all surrounding circumstances of the situation such as ownership of the device, its use, and the employment policies in place.
Employers should draft clear, reasonable policies that address the type of information that can be accessed, what is permitted use of the work-issued devices, how the devices will be monitored, and the consequences of contravening the policy. Employers may also want to limit who has access to which devices and clearly state the permitted uses of the devices. It is also very important to enforce these policies as to not set a contrary precedent.
While these policies will not completely remove an employee’s expectation of privacy, they will reasonably diminish that expectation.
Prepared with the assistance of Mariana Fonar, student at law.