On October 19, 2012, the Supreme Court of Canada (SCC) issued its ruling in R. v. Cole. The court held that a person’s right to be protected against unreasonable searches was breached when the police looked at computer files the employer had given them without first obtaining a search warrant.
Facts
A Sudbury high school provided one of its teachers, Richard Cole, with a laptop to be used for the purpose of teaching. While reviewing students’ computer files, Cole discovered nude photos of an under-age student and copied them onto the hard drive of his work laptop.
The school’s technician discovered the nude photos on Cole’s laptop during a routine data scan. He reported it to the principal. Further investigation revealed that Cole’s computer browser history included a large number of pornographic sites. A disk containing the browser history and the nude photos was provided to the police by the principal. The police viewed the material without a search warrant.
The teacher was charged with criminal offenses. Defense counsel argued that Cole’s constitutional rights had been breached.
Reasonable expectation of privacy
The SCC held that Cole had a reasonable expectation of privacy in the personal information stored on his work-issued laptop. This expectation was violated when that information was examined by the police. As such, his constitutional rights protecting against unreasonable search and seizure had been breached.
Whether a reasonable expectation of privacy exists will depend on the “totality of the circumstances,” the court said. This involves an assessment as to whether Cole’s subjective expectation of privacy was objectively reasonable.
The court emphasized that computers and other Internet-connected devices often contain the sort of personal information in the browsing history that reveals our specific interests, likes, and propensities. This sort of information attracts constitutional protection because it’s reasonable for people to expect that information that goes to their “biographical core” will be kept private. This is so even when the device is owned and monitored by an employer.
Policies not determinative
Cole’s subjective expectation was balanced against other factors, including the language contained in the school’s technology use policies. One policy expressly stated that use of school-issued laptops as well as all data and messages generated and handled via those laptops was the property of the school board. It also set out that users of such technology were subject to access by school administrators. Another policy provided that all material saved on the hard drives or servers may be monitored and that users should not assume that such data will be kept private.
Notwithstanding the strength of the policy language and the school’s ownership over its technology, the court determined that the personal nature of the information outweighed the language contained in the policies.
Cole’s reasonable expectation of privacy was, however, a diminished one in these circumstances.
The principal and other school board officials had the power to seize and search the laptop, particularly based on their statutory duty to maintain a safe school environment. The school board was also legally entitled to inform the police of its discovery.
However, the police didn’t have the same power. The school board couldn’t consent to a search or waive Cole’s Canadian Charter of Rights and Freedoms protection on his behalf.
So the warrantless search of the computer files amounted to an “unreasonable search and seizure.” But, because the court was satisfied that admitting the evidence wouldn’t bring the administration of justice into disrepute, it shouldn’t have been excluded from the trial.
A new trial was ordered.
Takeaway for employers
R v. Cole arose in the context of a claim that an individual’s Charter rights had been breached when the police reviewed and made copies of the contents of that individual’s work-issued laptop.
While Cole didn’t argue that the initial inspection by the school technician as part of the routine maintenance was a breach of his Charter rights, the SCC declined to make a determination as to whether and when an employer can monitor computers that are issued to employees. In fact, the SCC expressly opted to “leave for another day the finer points” of this issue. As such, this area of the law as it applies to employers remains unsettled.
How this decision will inform and be applied to future cases involving reasonable expectations of privacy in the workplace remains to be seen. But this case emphasizes the importance of maintaining clear policies in relation to the acceptable use of technology.
Employers are encouraged to:
- Ensure your policies clearly state that the technology (and data stored) remains the property of the employer.
- Ensure your policies clearly state the acceptable parameters for use of that technology.
- Provide notice that employees’ activities may be monitored and they shouldn’t expect them to be private.
Such policies may not be determinative regarding police powers but may diminish an otherwise reasonable expectation of privacy. This will enhance the employer’s ability to enforce its standards of acceptable computer use.
