A recent Supreme Court of Canada judgment underscores the importance of putting in place policies governing the use of workplace computers.
Christine A. Carron of Norton Rose writes that the decision in R. v Cole will diminish – although not entirely eliminate – an employee’s reasonable expectation of privacy where the information concerns the most intimate details of an individual’s “biographical core.”
The case concerned a school board’s right to monitor materials on a teacher’s school-issued laptop and the further right to hand over to police certain materials discovered on it, in the absence of a warrant. The court clearly distinguished between the two issues.
It cautioned that privacy policies and the ownership of computer equipment are not necessarily determinative of privacy rights; even where the employer owns the network or hardware, employees have a reasonable, but diminished, expectation of privacy in their personal information residing on workplace computers.
Those expectations increase with the intimacy or closeness of the information to the ‘biographical core’ of the employee and the employee’s direct personal (as opposed to business) interest in that information. On the other hand, expectations of privacy to intimate personal information can be diminished by other circumstances prevailing in the workplace, such as the disclosure of privacy policies providing for monitoring employee communications where monitoring is reasonable for protecting legitimate business interests.
The court took care to emphasize that expectations of privacy will depend on all the circumstances. It refrained, however, from opining on whether those expectations increase where the employee uses his or her own device (BYODs) for work purposes.
Under all the circumstances of the Cole case, the school had the right to monitor and seize the material. These circumstances included the policies and practices in place as well as regular reminders of them to the staff.
However, an employer’s ability to hand over highly personal (as opposed to business) information to law enforcement authorities must be done pursuant to lawful authority, such as a search warrant.
