Do employees have a reasonable expectation of privacy in employer-provided technology?
Although it was a criminal case, the case of R. v. Cole, 2011 ONCA 218, presented an interesting question: Whether a high-school teacher had a reasonable expectation of privacy in the contents of a work computer on which he was entitled to store personal information.
The decision is even more interesting because it was authored by Justice Karakatsanis, now of the Supreme Court of Canada.
Facts
The teacher, one Mr. Cole, had been provided with a laptop by the school for use with respect to school-related business. Mr. Cole was also permitted to use the computer for personal use, including taking it home on weekends and over summer vacation.
The school had no policy on the use of laptops, as was noted by another teacher who was concerned about banking information that he stored on his laptop. Mr. Cole used his laptop for grossly inappropriate purposes: downloading child pornography.
A school technician loading new software onto Mr. Cole’s computer found the images, reported them to the principal and thus the criminal case. Further specifics as to the facts, more interesting to criminal lawyers, are fully set out in the decision. This post in no way intends to speak to the nuances of the criminal law.
Decision of the Court of Appeal for Ontario
In her reasons for decision the Honourable Justice Karakatsanis held that:
[The teacher] had a reasonable expectation of privacy from state intrusion in the personal use of his work computer and in the contents of his personal files on its hard drive. However, his expectation of privacy was modified. He had no expectation of privacy with respect to access to his hard drive by his employer’s technician for the limited purpose of maintaining the technical integrity of the school’s information network and the laptop.
In the result, the court found that data found and seized by the school’s technician could properly be considered at trial, but the data found by the police pursuant to a warrantless search violated Mr. Cole’s section 8 Charter rights and therefore ought to be excluded.
[Note: the Supreme Court of Canada has now provided its decision in this case. For that analysis, see Supreme Court of Canada: Employees’ Rights to Privacy with Work Equipment.]
Do Employees Have a Reasonable Expectation of Privacy in Employer-Provided Technology?
In answering whether Mr. Cole’s privacy rights had been violated, Justice Karakatsanis had to first resolve whether Mr. Cole even had a reasonable expectation of privacy. In her reasons, Justice Karakatsanis wrote:
[31] The reasonable expectation of privacy must be determined based on a totality of the circumstances, including the factors identified in Edwards, [1996] 1 S.C.R. 128 at para. 45:
- whether the accused was present at the time of the search;
- whether the accused had possession or control of the property or place searched;
- whether the accused owned the property or place searched;
- the historical use of the property or item;
- the ability to regulate access, including the right to admit or exclude others from the place;
- the existence of a subjective expectation of privacy; and
- the objective reasonableness of the expectation.
[32] More recently, in R. v. Tessling, [2004] 3 S.C.R. 432, at para. 32, and R. v. Patrick, [2009] 1 S.C.R. 579, at para. 27, the Supreme Court of Canada set out an analytical framework for assessing the totality of the circumstances, which involves consideration of the nature or subject matter of the evidence gathered, whether the applicant had a direct interest in that subject matter, whether the applicant had a subjective expectation of privacy in the subject matter, and whether that expectation of privacy was objectively reasonable.
[33] In Tessling at paras. 20-24, the court noted that in determining the reasonableness of the privacy expectation, it is a useful analytical tool to determine the nature of the privacy interest. In this case, the search involved both a territorial privacy interest in the hard drive of a computer used in part for personal use, and an informational privacy interest, including potentially intimate details of the lifestyle and personal choices of the appellant that can have a bearing on his “dignity, integrity and autonomy” (R. v. Plant, [1993] 3 S.C.R. 281, at p. 293).
[34] In Patrick, Binnie J. observed at para. 17 that an asserted expectation of privacy in things located on someone else’s property must be one that an independent and informed observer is prepared to recognize as reasonable. Whether an expectation is objectively reasonable includes: the nature of the place where the search occurred; whether the informational content of the subject matter was in public view, had been abandoned, or was already in the hands of third parties; whether the police technique was intrusive in relation to the privacy interest; whether the evidence gathering technique was objectively unreasonable; and whether the informational content exposed intimate details of the appellant’s lifestyle or information of a biographic nature (see Patrick, at para. 27).
Considering all the factors, Justice Karakatsanis resolved that:
[45] I agree with the trial judge that, based upon the totality of the circumstances in this case, including the factors set out in Edwards, the appellant had a reasonable expectation of privacy in the personal use of his work laptop. Although this was a work computer owned by the school board and issued for employment purposes with access to the school network, the school board gave the teachers possession of the laptops, explicit permission to use the laptops for personal use and permission to take the computers home on evenings, weekends and summer vacation. The teachers used their computers for personal use, they employed passwords to exclude others from their laptops, and they stored personal information on their hard drives. There was no clear and unambiguous policy to monitor, search or police the teachers’ use of their laptops.
…
[47] On the other hand, the appellant knew that a school technician had a limited right of access to the hard drive as part of his duties to maintain the stability and security of the network system. Business and other institutions commonly engage technicians to service and maintain their networks. Users understand that a technician can access computers connected to the network to ensure the integrity of the system. The appellant’s reasonable expectation of privacy was modified to the extent that the appellant knew that his employer’s technician could and would access the laptop as part of his role in maintaining the technical integrity of the school’s information network. However, this was not sufficient to displace a reasonable expectation that otherwise would exist in the personal electronic information maintained on his hard drive, except to that extent and for that limited purpose.
[48] I conclude, therefore, that the appellant had a reasonable expectation of privacy in the information stored in the hard drive of his laptop, which was subject to the limited right of access by his employer’s technicians performing work-related functions. In other words, the appellant had no expectation of privacy with respect to this limited type of access.
Analysis and Takeaways
The case highlights the need for employers to have strict and explicit policies with respect to the personal use of work equipment.
Employers should be clear with respect to the extent to which an employee may use work-supplied equipment for personal reasons and what the consequences will be if the equipment is not used appropriately.
The failure to provide such policies clearly results in ambiguity and challenges for the employer and may vest employees with certain rights quite apart from those in the criminal context.
--As always, everyone’s situation is different. The above is not intended to be legal advice for any particular situation. It is always prudent to seek professional legal advice before making any decisions with respect to your own case.
No comments:
Post a Comment