Supreme Court of Canada rules employees have reasonable expectation of privacy in workplace computers

On October 19, 2012, the Supreme Court of Canada released the highly-anticipated decision in R. v. Cole, on appeal from the Ontario Court of Appeal (see “Ontario’s top court rules employees have privacy interests in content on work computers”). In a 6-1 majority decision, the Supreme Court held that employees have a reasonable expectation of privacy in the information contained on a work-issued computer where personal use of the computer is permitted or reasonably expected. Canada’s top court stated that workplace policies and practices may diminish that expectation of privacy, but they do not operate to nullify it.

Richard Cole was employed as a high-school teacher when he was charged with possession of child pornography, and unauthorized use of a computer, under the Criminal Code. The charges arose after a school computer technician remotely accessed the hard drive of Cole’s school-issued laptop and found sexually explicit images of an underage student. The Crown later alleged that while monitoring students’ e-mail in the course of his duties, Cole found the images and copied them to his laptop.

When the technician discovered the images on Cole’s hard drive, the school’s principal directed the technician to copy the images onto a disc for use as evidence. The principal then required Cole to turn over the laptop. School board officials searched its contents and copied the temporary internet files onto another disc. The laptop and the two discs were then turned over to police, who reviewed them without obtaining a warrant.

On a pre-trial application, the trial judge excluded the evidence on the basis that the warrantless police search of the computer was an infringement of Cole’s Charter right to be secure against unreasonable search and seizure. On appeal, the trial judge’s decision was overturned. The Court ruled that the accused had no reasonable expectation of privacy in the school-issued laptop. Cole appealed this decision to the Ontario Court of Appeal.

The Court of Appeal held that there was a limited modification to Mr. Cole’s expectation of privacy in the contents of the computer due to the school technician’s access to the laptop. Nevertheless, this diminished expectation of privacy did not justify the warrantless police search. Although the laptop and its contents were in the hands of third parties, the accused did not abandon his privacy interest in the personal information stored on the computer. The Court of Appeal allowed the appeal and sent the matter back to trial, with the laptop and temporary internet files excluded as evidence. The Crown appealed the decision to the Supreme Court of Canada.

BEFORE THE SUPREME COURT OF CANADA

Justice Fish, for the majority, cited the 2010 decision in R. v. Morelli in which it was definitively held that there is a reasonable expectation of privacy in information contained on a personal computer. Fish J. stated that the same principle should apply in the context of a work computer, at least where personal use of the computer is permitted or reasonably expected. In the majority’s view, computers that are used for personal purposes, whether at home or in the workplace, “contain information that is meaningful, intimate, and touching on the user’s biographical core.” There is a constitutionally-protected expectation of privacy in information of this kind. The Court did note, however, that the expectation of privacy is somewhat diminished in the case of a work computer.

THE TOTALITY OF THE CIRCUMSTANCES TEST

The Supreme Court stated that the determination of whether there is a reasonable expectation of privacy involves the application of the “totality of the circumstances” test from the Supreme Court decision in R. v. Edwards (1996). The totality of the circumstances test involves four lines of inquiry:

an examination of the subject matter of the alleged search;
a determination as to whether the claimant had a direct interest in the subject matter;
an inquiry into whether the claimant had a subjective expectation of privacy in the subject matter; and
an assessment as to whether this subjective expectation of privacy was objectively reasonable, having regard to the totality of the circumstances.

In applying the above test, the Supreme Court identified the subject matter of the alleged search to be the data, or informational content of the laptop’s hard drive, its mirror image, and the disc with the internet files. The Supreme Court stated that Mr. Cole’s direct interest and subjective expectation of privacy could “readily be inferred from his use of the laptop to browse the Internet and to store personal information on the hard drive.”

The Court went on to consider the fourth component of the test – whether Mr. Cole’s subjective expectation of privacy was objectively reasonable. It cited the decision in R. v. Plant (1993) in which Sopinka J. stated:

In fostering the underlying values of dignity, integrity and autonomy, it is fitting that s. 8 of the Charter should seek to protect a biographical core of personal information which individuals in a free and democratic society would wish to maintain and control from dissemination to the state. This would include personal information which tends to reveal intimate details of the lifestyle and personal choices of the individual.

In the Court’s view, the more personal and confidential the information in question, the more likely there is a constitutionally protected privacy interest.

Computers that are used for personal purposes, regardless of where they are found or to whom they belong, “contain the details of our financial, medical, and personal situations” (Morelli, at para. 105). This is particularly the case where, as here, the computer is used to browse the Web. Internet-connected devices “reveal our specific interests, likes, and propensities, recording in the browsing history and cache files the information we seek out and read, watch, or listen to on the Internet”

This sort of private information falls at the very heart of the “biographical core” protected by s. 8 of the Charter.

The Court noted that although ownership of the property is a relevant consideration, it is not determinative. Similarly the policies, practices and customs of the workplace, although relevant in the analysis, are not determinative of a person’s reasonable expectation of privacy. In the Court’s view, the workplace policies of the school operated both for and against the existence of the reasonable expectation of privacy. The policies permitted Mr. Cole to use the work computer for personal purposes, thus favouring the reasonable expectation of privacy. On the other hand, the fact that Cole did not have exclusive control over the computer diminished that expectation. Nevertheless, in considering the totality of the circumstances, the Supreme Court held that Cole did in fact have a reasonable expectation of privacy in his internet browsing history and the informational content of the work-issued computer.

WARRANTLESS POLICE SEARCH A BREACH OF THE CHARTER BUT EVIDENCE STILL ADMISSABLE

Having found that Mr. Cole had a reasonable expectation of privacy in the information stored on the work computer, the Supreme Court held that the warrantless access by the police to the information was a breach of s. 8 of the Charter. In the Supreme Court’s view, the receipt of the computer from the school did not afford the police warrantless access to the information on it. Similarly, the Court held that the employer could not validly consent to the search, or waive the constitutional protection afforded to Mr. Cole on his behalf.

Despite these findings however, the Supreme Court ruled that the admission of the unlawfully obtained evidence would not bring the administration of justice into disrepute. This decision was based on the diminished reasonable expectation of privacy of Mr. Cole and on the fact that the evidence in issue would have ultimately have been discoverable due to the existence of reasonable and probable grounds to conduct a search of the computer. The Supreme Court also noted that excluding the evidence would have a “marked negative impact on the truth-seeking function of the criminal trial process.”

The Supreme Court allowed the appeal and set aside the exclusionary order of the Court of Appeal. A new trial was ordered.

In Our View

The Supreme Court’s decision in Cole makes it clear that where an employer permits personal use of a work computer, or, where personal use of the work computer can be reasonably expected, employees will have a reasonable expectation of privacy in the personal information stored on the computer. This expectation may be diminished, but is nevertheless sufficient to be afforded Charter protection. The employer cannot waive this protection on behalf of the employee. It is interesting to note that the employer’s access to the information stored on Mr. Cole’s work computer was not a violation of his privacy interest. The school board’s access to the contents of the computer was seen to be acceptable based on the workplace policies and the provisions of the Education Act which require school boards to ensure a safe environment for students. The lesson for employers is that they should implement clear and unambiguous written policies which address both permitted employee usage of computers, as well as access and monitoring of the computer by the employer. The policies should clearly put employees on notice as to the circumstances in which the employer will access information on its computers or its network more broadly. The policies should confirm that data sent over the network remains the property of the employer, and that employees who wish to maintain privacy in personal communications or other information should not send them over the employer’s network.

Although such policies will not guarantee that monitoring or review of employee personal information will be upheld as reasonable and not privacy-invasive, they are an important step in reaching that objective.

Please do not hesitate to contact us for assistance in drafting or reviewing your privacy and IT policies for compliance with recent decisions, including R. v. Cole.

For further information, please contact Steven Williams at (613) 940-2737 or Porter Heffernan at (613) 940-2764.