Pornography in the workplace: employers can monitor, but police must obtain a warrant

On October 19, 2012, the Supreme Court of Canada confirmed in R. v. Cole¹ that while employees do have a reasonable expectation of privacy when it comes to the contents of computers provided for work purposes, employers have a legitimate right to supervise the use made of computer equipment supplied to their employees.

Summary of the facts

Mr. Cole taught information technology in a Sudbury high school. The school board issued a laptop to Mr. Cole for work.

While performing maintenance work on the computer system, a technician detected abnormal activity on Mr. Cole’s laptop. Accessing the laptop remotely, the technician discovered a hidden file that had the potential to destabilize the school network. On examining the file, he found that it contained pictures of a young student posing nude. What is more, an examination of the history of Internet searches revealed files containing pornographic material.

The computer technician informed the school principal. The photographs, Internet files and laptop were handed over to the police, who never obtained a search warrant. Mr. Cole was charged with possession of child pornography.

Ruling

The debate deals mainly with the breach of Mr. Cole’s privacy under the Canadian Charter of Rights and Freedoms (the “Charter”) and the decision to exclude from evidence any computer material that had been seized by the police.

The Supreme Court began by confirming that employees do have a reasonable expectation of privacy in the personal information stored on their work computer, at least when employers authorize or reasonably expect personal use to be made of such equipment. The reasoning behind this is that computers contain information deemed to be “meaningful” and “intimate” regarding their “likes, interests, thoughts, activities, ideas, and searches for information”.

Reasonable, though diminished, expectation of privacy in the workplace

The reasonable expectation of privacy is not extinguished, but it is diminished, when employees use a work-issued computer. The Supreme Court emphasizes that while policies and practices in the workplace considerably limit an individual’s expectation of privacy, determining whether or not such “reasonable expectation” exists will nonetheless depend on the “totality of the circumstances”.

In this case, the Supreme Court ruled that the operational realities of Mr. Cole’s workplace weigh both for and against the existence of a reasonable expectation of privacy. Mr. Cole had exclusive use of the computer. According to practices and written policies, he was explicitly permitted to occasionally use the work-issued laptop for personal purposes. Besides, he was allowed to bring it home nights and weekends, even during vacations. The Court concluded that ownership of the computer is relevant, but not determinative, in this case. What is more, the school board’s policy does not provide for computer monitoring and, barring some exceptions, the emails of teachers are private.

Moreover, Mr. Cole did not have exclusive control over the personal information he recorded on the computer or over who accessed to that information, which remained the property of the school board. And while Mr. Cole did password-protect the computer, its contents remained accessible to all technicians who had domain administrative rights on the school’s network.

From these various elements, the Court concluded that Mr. Cole did have a reasonable, though diminished, expectation of privacy in his browsing history and in the informational content of the work-issued laptop.

Police should have obtained a search warrant

The Court concluded that the police was under the obligation to obtain a search warrant before accessing personal information recorded on the computer. In that respect, it is clear that the school principal’s permission or consent is not enough.

Generally, violation of a constitutional right under the Charter will result in illegally seized evidence being excluded. In this case, the Supreme Court made an exception and decided not to set aside these elements of proof, deeming that the violation was minor, that the police had acted in good faith and that admitting the evidence would not bring the administration of justice into disrepute.

Employer justified in seizing computer equipment

The Supreme Court ruled that, unlike the police, the employer, in this case the high school principal, had a statutory duty under the Education Act to maintain a safe school environment and, by necessary implication, had the power to ensure that computers issued by the school board did not contain compromising photographs of a student. Under the circumstances, the principal was justified in seizing and searching the laptop. It is important to point out that Mr. Cole did not contest the computer’s inspection carried out under the principal’s supervision.

The Supreme Court therefore confirmed that an employer that has legitimate reasons can reserve itself the right to monitor the use made of computers loaned to employees and the data stored thereon; in some cases, the employer can take possession thereof either for the purposes of an internal investigation or in the context of disciplinary proceedings.

Consequences

True, the Supreme Court analysis deals specifically with the application of the Charter, since the public ministry admitted that school authorities are subject to the statute. That said, the judgment is not designed to target private sector employers. The overall message is positive, because the ruling recognizes the employer’s surveillance right.

Cole may very well have yet another impact on labour relations. By ruling that computers, “whether found in the workplace or the home”, contain sensitive private information, the Court is stressing that the boundary between an employee’s professional and personal lives is permeable. It is now clear that employees have a limited and diminished expectation of privacy, even when they use a computer that is supplied by their employer.

This case is a perfect example of why it is important for employers to draft clear policies on the personal use of electronic devices made available to employees. Regularly reminding them of the existence of these policies and applying them consistently will also reduce employees’ expectation of privacy with regards to using such material in the context of their duties, since in the end, as the Supreme Court teaches, it is totality of the circumstances specific to each case that will be analyzed.

¹ [2012] SCC 53.