In the recent decision of R. v. Cole, released on October 19, 2012, the Supreme Court of Canada (SCC) indicated that employees may reasonably expect privacy in the information contained on their work computers, at least where personal use is permitted or reasonably expected.

“While workplace policies and practices may diminish an individual’s expectation of privacy in a work computer, these sort of operational realities do not in themselves remove the expectation entirely: The nature of the information at stake exposes the likes, interests, thoughts, activities and searches for information of the individual user,” wrote Justice Morris Fish for the 6-1 majority.

The case centred on the privacy interests of Richard Cole, who was charged after a computer technician found a hidden folder containing nude and partially nude photographs of an underage female student on his laptop during maintenance activities. The technician notified the principal, who ordered the photographs be copied to a CD. The principal then seized the laptop and technicians copied temporary Internet files onto a second disc. The laptop and both discs were handed over to the police, who reviewed their contents and created a mirror image of the laptop’s hard drive for forensic examination, all without a warrant.

The Supreme Court decision notes that the trial judge excluded all of the computer material, finding that it breached the right to be secure from unreasonable search or seizure pursuant to Section 8 of the Canadian Charter of Rights and Freedoms. On appeal, the Court of Appeal for Ontario set aside that decision and excluded all material except for the disc containing the photographs, which it found to be legally obtained and admissible.

In ordering a new trial, the Supreme Court ruled that the police infringed on Cole’s rights under Section 8 of the Charter, as receipt of the computer did not afford the police warrantless access to the personal information contained within. However, the conduct of the police officer in this case was not an egregious breach of the Charter, the Supreme Court ruled.

Although the high school teacher’s privacy interests were diminished due to the school board ownership of the laptop and workplace policies regarding computer use, the expectation of privacy was found to be  warranted where the computers are allowed for personal use.

Clearly, employees might surf the Internet on their break, make a few personal calls or send personal emails. While the employer shouldn’t be too interested in the content of this personal use for the most part, it naturally would want to know if the employee was doing something that could be harmful to the business or even be illegal. But if the employer wants to check on what the employee’s been doing, it has to tread carefully so the employee’s privacy rights aren’t violated.

While this is primarily a criminal case, there has been much discussion about what the various court decisions have meant when it comes to employee privacy rights on work computers, particularly since employees having laptops and smartphones that they use outside of work is common. Based on this case, even if the equipment is still owned by the employer and is meant for work purposes, the employer doesn’t necessarily own all the data on it.

The Cole case suggests employers should do the following:

• Review their policies and practices regarding personal use of computer resources. A blanket prohibition of personal use is probably not practical or enforceable, so it is better to carefully and consistently manage personal use.
• Review and communicate to employees the employer’s interest in the proper use,  and the concerns about improper use, of computer resources.
• Purge policies of all ambiguity and ensure limits on expectation of privacy are emphatically stated.
• Review methods of communicating and remind employees of the policies. Ensure there is regular reinforcement of the message.
• Monitor computer use to the extent required to ensure policies are adhered to. Promptly and consistently deal with any breaches.
• In the event of a breach, consider all the circumstances, including the employer’s legitimate concerns about its legal obligations, operations and reputation.