By Maria Giagilitsis and Brian Smeenk
In a decision released earlier this week, the highest court in Canada’s most populous province, Ontario, issued a surprising ruling on workplace privacy law. The case involved criminal charges against a teacher accused of possession of child pornography.
The court said the employee has a reasonable expectation of privacy on workplace computers, which protected him against computer searches by the police. The employer was given more latitude but not free rein.
Until now, the general rule in Canada was that personal information stored by employees on workplace computers would be treated as the employer’s property. Employers could access any information stored by employees on its equipment. In R. v. Cole however, the Ontario appeal court muddied the waters considerably.
The result was that prosecutors will be unable to use many computer images in the teacher’s criminal trial. But different considerations apply to employers. This raises questions about what employers can do to ensure their equipment is not misused by employees.
Basic facts
A Sudbury high school teacher was provided a laptop by his school. He used the laptop to teach communication technology. He was also responsible for supervising a laptop program for students.
The teacher had the authority to remotely access data stored on the students’ laptops. He did this regularly. While reviewing one student’s computer files, he discovered nude photos of another student. The teacher copied the nude photos onto the hard drive of his school-issued laptop rather than reporting the incident.
The school’s computer technician discovered the nude photos in a hidden folder on the teacher’s computer. He found them while doing a routine data scan. Upon identifying the girl as a student, the technician notified the principal. The principal instructed him to copy the images, along with the teacher’s Internet surfing history, onto a disk. That surfing history included a large number of pornographic sites. The employer gave that, along with the nude photos, to the police. The police viewed both the disk and the laptop without a warrant.
The teacher was charged with possession of child pornography and criminal use of computer systems. In court, the teacher’s lawyer argued that the teacher had a reasonable expectation of privacy in the contents of his laptop. The issue was appealed to Ontario’s highest court.
Interesting twists
The Court of Appeal emphasized that the teacher had exclusive use of the laptop and that the laptop was protected by a personal password. The court also noted that teachers were generally permitted personal use of school computers.
But the evidence also demonstrated that the school’s policy and procedures manual prohibited including sexually explicit content on school computers. The manual also said that all data and messages are considered the property of the school board. The manual further advised teachers that the school would access private e-mails if inappropriate use was suspected.
Court of Appeal decision
The court found that the teacher did have a reasonable expectation of privacy in the contents of his laptop, at least vis a vis the police. The police therefore violated the teacher’s right against unreasonable search and seizure under the Charter of Rights and Freedoms when they seized the laptop and searched it without a warrant.
The court looked beyond the strict wording of the school’s computer-use policies. It focused instead on the actual practice and customs of the workplace. While the policy was that computers were meant to be used for business purposes, staff routinely used computers to store intimately personal information, such as financial and banking data. All the circumstances satisfied the court that the teacher had a reasonable expectation of privacy in the contents of his laptop. This gave him protection against police seizures and searches.
The court, however, gave the employer more leeway than it gave police. Although the court assumed that the Charter could apply to the school board (note that this is contentious — the Charter does not apply to most employers), it found that the employer didn’t violate the teacher’s Charter rights. The employer didn’t act improperly when it accessed the teacher’s laptop and copied the photos to disk. The employer found these photos while performing normal computer maintenance — an activity that the court acknowledged was within the employer’s right to carry out on its own equipment.
Similarly, the teacher’s principal acted properly in viewing some of the images found by the technician, directing him to copy the photographs onto a disk, and requiring the teacher to hand over the laptop. Even though this was a “search and seizure,” it was consistent with the principal’s duty to ensure the health and safety of students. The principal couldn’t be held to the same standard as the police.
As for the employer itself (the school board), it didn’t violate the teacher’s Charter rights either even though it searched the laptop and secured further evidence regarding the teacher’s computer and Internet use before handing it over to the police. The search and the preservation of evidence for internal discipline procedure were in accordance with the employer’s obligation to ensure a safe and secure environment for its students.
Quick assessment
This case will be analyzed and commented upon by many. An early assessment is this. First, it must be emphasized that the expectation of privacy only operated against the police’s search and seizure in this case. Second, it must be emphasized that this decision was based on Charter rights. Those rights don’t apply to most employment relationships, certainly not those in the private sector.
One might argue that the court’s decision places individual privacy rights over other rights. This might be true with respect to police searches and seizures. However, the decision supports employers who maintain well-drafted policies that make it clear the employee has no privacy rights on the employer’s computers. It also favors employers who actively maintain, monitor, and enforce their own computer-use policies.
The decision acknowledges that employers may access data stored by employees on workplace computers in appropriate circumstances. It also acknowledges that such data can be used in internal investigations and later disciplinary proceedings. This is clearly the case with respect to situations that are found as a result of regular monitoring and maintenance.
The decision highlights the importance of well-written computer-use policies. It also highlights the importance of ensuring that workplace practices are consistent with those policies.