The ubiquity of workplace computing and on-line communications has created key new legal issues for employers and employees.
Employers, concerned about employee productivity, network performance and their own potential liability for misuse of computing equipment, have begun to install computer-surveillance technologies that target employee use of information resources.
With surveillance technologies an inexpensive and relatively easy-to-administer instrument, some studies suggest nearly 80 per cent of large companies now monitor employee e-mail and Internet use.
Many employees, meanwhile, are concerned about the effect of workplace computer surveillance on their personal privacy. While millions of computer-enabled employees are familiar with their word-processing and e-mail applications, many know little about surveillance technologies that quietly monitor their network activity, even their every keystroke.
In sorting through the legality of workplace surveillance, many assume that employers' ownership of the computing equipment and the right to set workplace rules grant them an unfettered right to monitor employees' computer usage provided that they disclose the practice. Typically framed as a matter of reasonable expectation of privacy, the belief is that if employees are told not to expect any privacy in the workplace, they don't have any.
A closer examination of Canadian law suggests the rules for workplace surveillance are gradually shifting, however — moving away from an assessment of the reasonable expectation of privacy toward deciding whether the surveillance itself is reasonable.
There are several reasons for the change. First, Canada's private-sector privacy legislation sets limits on workplace surveillance. The statute features an "appropriate purposes" provision that limits the collection, use, and disclosure of personal information only for purposes that a reasonable person would consider are appropriate under the circumstances.
This reasonableness clause creates a critical limitation on workplace surveillance since mere employee consent to surveillance is no longer sufficient to justify unlimited surveillance activities. Surveillance is limited to that which a reasonable person would consider appropriate. For example, keystroke computer surveillance, conducted under the guise of fostering a harassment-free workplace might be unlawful absent some clear evidence that such surveillance is responding to a known issue.
Second, labour arbitration cases involving video-surveillance practices provide a sense of how arbitrators are balancing the competing interests of employers and employees. In many of those cases, surveillance is permitted, but only where a substantial problem has been identified, surveillance is likely to solve the problem, alternative approaches have been unsuccessfully pursued, and surveillance is implemented in a fair, even-handed manner.
Third, Canada's federal Privacy Commissioner has begun to express his concern with surveillance and privacy in the workplace. In a case last year involving the capture of a Department of Defense official's e-mail, the commissioner lamented a DND policy on the management of e-mail that stated employees should have no expectation of privacy when using the e-mail system, arguing that privacy protections cannot be eradicated just by informing employees they have no privacy.
These developments signal an important shift in analysis that focuses on whether the surveillance itself is reasonable, not if the employee had a reasonable expectation of privacy.
With a collision between computer surveillance and privacy on the horizon, the desirability for clear criteria to judge reasonableness will undoubtedly intensify. Although no court has expressly identified how to determine whether computer surveillance is reasonable, there are at least five factors that should be factored into the analysis.
First, consideration must be given to the target of the surveillance. For example, it is more difficult to justify monitoring members of the judiciary than general office workers, since judicial monitoring might compromise judicial independence.
Second, a well-defined purpose is essential to meet the reasonableness standard. The use of surveillance technologies in the workplace may indeed be legitimate – it falls to the employer to articulate a clear purpose that corresponds to the target of the surveillance and the technology used.
Third, case law and policy makers have often called for the exploration of less invasive approaches before adopting a surveillance solution. For example, the need to pursue privacy-friendly solutions was raised by several judges during the 2001 firestorm over judicial computer surveillance in the United States, with judges noting that a simple memorandum clarifying problematic practices often resulted in altered computer use habits.
Fourth, employees must be provided with adequate, timely notice that includes an accurate description of surveillance practices.
Fifth, consideration must also be given to the processes and security safeguards implemented after the surveillance begins and the data begins to accumulate.
In seeking to develop an appropriate approach to workplace computer surveillance, it is worth remembering that neither the right to privacy nor the right to monitor is absolute. Canadian law seeks to balance these respective interests by assessing the reasonableness of the surveillance. In years past, an employee's reasonable expectation of privacy alone was determinative. No longer. The emergence of national privacy legislation, international privacy norms, and labour case law all point to a shift towards greater privacy protection in the workplace.
