Columns

Supreme Court Confirms Privacy Survives in the Workplace

Millions of Canadians go to work each day, turn on their workplace computers, and wonder whether they have also shut off their privacy. Many employers seek to remove any reasonable expectation of privacy by telling employees that they should not expect any privacy when using workplace computers during company time.

Earlier this month, the Supreme Court of Canada grappled with the question of workplace privacy and arrived a somewhat different conclusion. My weekly technology law column (Toronto Star version, homepage version) notes it ruled that the workplace environment may diminish an employee’s reasonable expectation of privacy, but it does not remove the expectation altogether.

The case involved a criminal action against a high school teacher, who was provided with school-issued laptop computer that could be used for incidental personal purposes. A computer technician at the school discovered nude photographs of a female student while performing routine maintenance on the machine. The school copied the images and turned over the computer and the images to police, who later charged the man with possession of child pornography and unauthorized use of a computer.

The legal issue in the case turned on whether the police conducted a warrantless search of the computer in violation of the Canadian Charter of Rights and Freedoms, which guards against unreasonable search and seizure. To answer that question, the Court assessed whether the employee had a reasonable expectation of privacy.

The Court’s analysis started by reaffirming that Canadians reasonably expect privacy in the information found on their personal computers. Provided the use is permitted or reasonably expected, the same is true for workplace computers since both personal and workplace computers frequently “contain information that is meaningful, intimate, and touching on the user’s biographical core.”

But what if the employer has a workplace policy or established practice that warns against personal use? The Court acknowledged that such policies create a “diminished” expectation of privacy, but argued that they do not completely remove the expectation as the “nature of the information at stake exposes the likes, interests, thoughts, activities, ideas, and searches for information of the individual user.” In fact, the court noted “whatever the policies state, one must consider thetotalityof the circumstances in order to determine whether privacy is a reasonable expectation in the particular situation.”

The court also considered the fact that the laptop belonged to the school (a 2010 Supreme Court computer privacy case involved a personal computer owned by the individual). The Court found that the ownership of the computer is a relevant consideration, but it too is not determinative.

Reasonable expectation of privacy therefore depends upon the “totality of the circumstances”, which presented a difficult balance in this case since there was a clear privacy interest in the information on the laptop set against school policies and ownership of the computer. Given these competing interests, the Court ruled that the reduced privacy interest was not eliminated in its entirety. It therefore ordered that the teacher face a new trial.

While this case involves criminal issues and the Charter analysis will not apply to every workplace (the court even states that it will “leave for another day the finer points of an employer’s right to monitor computers issued to employees”), the decision sends a strong signal that Canadians do not forfeit all their privacy rights simply by logging onto their workplace computers. The reasonable expectation of privacy for Canadian workers may be diminished on the job, but it is not extinguished.

3 Comments

  1. How should have this went down
    Mr Geist, while I applaud the decision that as an employee my privacy rights are not extinguished, I am curious as to how the technician in this case, should have responded, legally, to finding child pornography while doing a routine maintenance check on someone’s computer. ie, is there a lesson here for how a technician should handle this type of case? Would this case be any different, if the person had brought the computer to Best Buy for a “tune up” and the technician there found child pornography while doing a routine check? Does the point revolve around “why” a technician doing a routine check would be looking at the pictures?

  2. Shawn H Corey says:

    When Free Porn is Not Enough
    “The school copied the images and turned over the computer and the images to police,…”

    Really. Couldn’t the school administrators find enough free pron? There is absolutely no need for the school to keep such pictures after the police have them. Why isn’t the school also charged with possession of child porn?

  3. Criminal evidence standard is higher
    As it should be, given the stakes are physical incarceration by the state. I’d be surprised on the same facts, if the teacher’s termination and delicensing would not stand up as matters of employment law.