The prevalence of computers in the workplace and employees' increased use of them gives rise to questions about the existence of privacy rights in materials stored, accessed or transmitted using employer-owned hardware and network systems. In tension with assertions of privacy, employers claim that the misuse of workplace computers to view or send inappropriate, illegal or even merely distracting material interferes with their duty to provide a safe and productive workplace, and with their right to protect the integrity of their business operations. These concerns have led to the implementation of a range of monitoring measures targeting employee email and Internet activities.
The Supreme Court of Canada (the SCC) addressed these competing interests in the context of workplace computers in its October 19, 2012 decision in R. v. Cole, holding that Canadians may reasonably expect privacy in information contained on workplace computers where personal use is permitted or reasonably expected. The court described such information as "meaningful, intimate and touching on the user's biographical core". While computer and data ownership, workplace policies and practices, and technologies in place for monitoring network activity may diminish an employee's expectation of privacy, such "operational realities" will not extinguish the expectation of privacy in its entirety.
Legal Landscape Prior to Cole
Before Cole, there was limited Canadian jurisprudence on employee privacy rights on workplace computers, particularly at the appellate level. In France (Republic) v. Tfaily (2009), Simmons J.A. recognized a reasonable expectation of privacy in personal electronic data stored by professors on university-owned computers. This aspect of the ruling was based on the terms of the collective agreement governing the employment relationship. In Poliquin v. Devon Canada Corp., the Alberta Court of Appeal allowed an employer's application for summary dismissal of a lawsuit for wrongful termination, in part on the grounds that the employee at issue had no reasonable expectation of privacy in his workplace computer. Emphasizing an employer's right to protect the professional, ethical and operational integrity of its business operations, the court held that "... an employer is entitled not only to prohibit use of its equipment and systems for pornographic or racist purposes but also to monitor an employee's use of the employer's equipment and resources to ensure compliance" (para. 49).
American court decisions and Canadian labour arbitration decisions demonstrate a similar reluctance to recognize employee privacy rights on workplace computers. Recent American cases such as Falmouth Fire Fighters' Union Local 1497 v. Town of Falmouth and People v. Kent suggest that a reasonable expectation of privacy will be found only where an employer has provided positive assurances or recognition of the confidentiality of materials accessed, transmitted or stored using an office computer. In the earlier and oft-cited decision of Smyth v. Pillsbury Co., the court reached a more extreme result in denying privacy protection for employee communications transmitted over workplace networks notwithstanding assurances from the employer that such communications would remain confidential and privileged.
In the labour context, arbitrators have regularly declined to recognize a reasonable expectation of privacy on workplace computers, emphasizing employer ownership of computer hardware and network systems. Employers instituting acceptable use or electronic monitoring policies benefit from the generous criteria for the unilateral adoption of workplace rules set out in KVP Co. v. Lumber & Sawmill Workers' Union, Local 2537 (Veronneau) (1965). Under these criteria, a rule must be clear, reasonable, and not inconsistent with the collective agreement. Further, the employer must notify employees affected by the operation of the rule, and must enforce the rule consistently from the time that it is introduced.
Even where the terms of an employer policy on computer and network use are not made clear to an employee, Briar v. Canada (Treasury Board) (Briar) and Consumers Gas v. C.E.P. suggest that a "common sense" test may be applied in assessing the employee's conduct. The arbitrator in Briar said at para. 74, "... even if it could be said that [the grievors] were unaware of the policies, they distributed material which common sense dictated was inappropriate to distribute at a workplace and, in particular, at a correctional facility where they are supposed to set an example of socially acceptable behaviour."
Supreme Court of Canada's Decision in Cole
Cole concerned a teacher who was criminally charged with possession of child pornography following the discovery of nude, sexually explicit photographs of a female Grade 10 student on the hard drive of his school-owned laptop. The photos were found by a computer technician employed by the school board, who was responsible for ensuring the integrity of the network system. The laptop, as well as compact discs containing the photos, a screenshot of the laptop including the file path and thumbnail pictures, and temporary Internet files pulled from the teacher's browsing history were ultimately provided to the police, who proceeded with a warrantless search. The teacher challenged the search, and sought to exclude the evidence based on an alleged violation of his right to be free from unreasonable search and seizure under s. 8 of the Canadian Charter of Rights and Freedoms.
The SCC's decision, while set in the context of a criminal case, outlines the scope of an employee's reasonable expectation of privacy for personal information on workplace computers. The court confirmed the Ontario Court of Appeal's finding that Canadians do in fact have a reasonable expectation of privacy on workplace computers, at least where personal use is permitted or reasonably expected.
Referring to the 2010 decision in R. v. Morelli, Fish J. for the unanimous court on this issue said that any computer used for personal purposes contains "... information that is meaningful, intimate and touching on the user's biographical core" (paras. 2 and 58), including financial, medical and personal information. The court recognized that, in particular, computers used for Internet browsing reveal specific interests, likes and propensities about the user.
While workplace policies and practices can diminish an employee's reasonable expectation of privacy, the court held that these policies are not sufficient to extinguish the privacy expectation. This "diminished expectation of privacy" is equally protected by s. 8 of the Charter. The same reasoning was applied with respect to school board ownership of the teacher's laptop computer, as well as the technology in place at the school to monitor network activity.
To determine the existence and extent of the expectation of privacy, the court said one must look to the totality of the circumstances. In Cole, the nature of the information at issue and the fact that the accused was permitted to use his computer for personal use, both pursuant to policy and in practice, weighed in favour of a reasonable, although diminished, expectation of privacy.
The court found that the actions of the police in conducting a warrantless search violated the teacher's s. 8 Charter rights. However, Fish J. for the majority concluded that the admission of evidence would not bring the administration of justice into disrepute, in part because the impact of the breach was decreased by the teacher's diminished privacy interest in the laptop materials and because of the ultimate discoverability of the evidence based on the existence of reasonable and probable grounds to search.
The Supreme Court of Canada's decision establishes that, where the employer permits or condones personal use of workplace computers, employees will have a reasonable expectation of informational privacy. That said, it remains to be seen what impact Cole will have on the admissibility of evidence and the employer's ability to prove just cause in civil actions for wrongful dismissal.
Although Cole emphasizes that employer policies and practices will diminish rather than extinguish the expectation of privacy in workplace computers, it remains advisable for employers to implement clear and unambiguous technology and privacy policies and monitoring conventions with respect to the acceptable use of workplace computers. Employers should also ensure that monitoring policies comply with applicable privacy legislation, including employee notification of the purposes of monitoring and collection of information contained on workplace computers, and the use that will be made of information collected.