Millions of Canadians go to work each day, turn on their workplace computers, and wonder whether they have also shut off their privacy. Many employers seek to remove any reasonable expectation of privacy by telling employees that they should not expect any privacy when using workplace computers during company time.
Earlier this month, the Supreme Court of Canada grappled with the question of workplace privacy and arrived a somewhat different conclusion. It ruled that the workplace environment may diminish an employee’s reasonable expectation of privacy, but it does not remove the expectation altogether.
The case involved a criminal action against a high school teacher, who was provided with school-issued laptop computer that could be used for incidental personal purposes. A computer technician at the school discovered nude photographs of a female student while performing routine maintenance on the machine. The school copied the images and turned over the computer and the images to police, who later charged the man with possession of child pornography and unauthorized use of a computer.
The legal issue in the case turned on whether the police conducted a warrantless search of the computer in violation of the Canadian Charter of Rights and Freedoms, which guards against unreasonable search and seizure. To answer that question, the Court assessed whether the employee had a reasonable expectation of privacy.
The Court’s analysis started by reaffirming that Canadians reasonably expect privacy in the information found on their personal computers. Provided the use is permitted or reasonably expected, the same is true for workplace computers since both personal and workplace computers frequently “contain information that is meaningful, intimate, and touching on the user’s biographical core.”
But what if the employer has a workplace policy or established practice that warns against personal use? The Court acknowledged that such policies create a “diminished” expectation of privacy, but argued that they do not completely remove the expectation as the “nature of the information at stake exposes the likes, interests, thoughts, activities, ideas, and searches for information of the individual user.” In fact, the court noted “whatever the policies state, one must consider thetotalityof the circumstances in order to determine whether privacy is a reasonable expectation in the particular situation.”
The court also considered the fact that the laptop belonged to the school (a 2010 Supreme Court computer privacy case involved a personal computer owned by the individual). The Court found that the ownership of the computer is a relevant consideration, but it too is not determinative.
Reasonable expectation of privacy therefore depends upon the “totality of the circumstances”, which presented a difficult balance in this case since there was a clear privacy interest in the information on the laptop set against school policies and ownership of the computer. Given these competing interests, the Court ruled that the reduced privacy interest was not eliminated in its entirety. It therefore ordered that the teacher face a new trial.
While this case involves criminal issues and the Charter analysis will not apply to every workplace (the court even states that it will “leave for another day the finer points of an employer’s right to monitor computers issued to employees”), the decision sends a strong signal that Canadians do not forfeit all their privacy rights simply by logging onto their workplace computers. The reasonable expectation of privacy for Canadian workers may be diminished on the job, but it is not extinguished.
Michael Geist holds the Canada Research Chair in Internet and E-commerce Law at the University of Ottawa, Faculty of Law. He can reached at firstname.lastname@example.org or online at www.michaelgeist.ca.