Column

Privacy of Employee Information in Employer’s IT Tools: BC Appeals Court Applies Cole

The issue of the degree of protection for the privacy for personal information of an employee stored on devices (usually information technology tools such as laptops, smart phones, etc.) of the employer has been considered by the Courts. The Supreme Court in R. v. Cole[i] addressed such a case. In R. v. McNeice[ii], the British Columbia Court of Appeals had the occasion to add their own thoughts in a similar case in which they applied the Cole principles. McNeice further illuminates the considerations in such cases.

It is noteworthy that the examination of the protection for the privacy for personal information of an employee in these cases occurs in the context of the expectation of privacy required under Section 8 of the Charter of Rights and Freedom. In other words these are cases where criminal charges are brought against the employee and the evidence on the employer’s devices used by the employees is a relevant factor. These cases allow us to examine how the Court addresses searches by the police of such devices.

Where a search is carried out by the police without a warrant, it is presumptively unreasonable.[iii] To establish reasonableness, the Crown must prove on the balance of probabilities (1) that the search was authorized by law, (2) that the authorizing law was itself reasonable, and (3) that the authority to conduct the search was exercised in a reasonable manner.[iv]

In Cole[v] the Supreme Court considered a case where an employee (teacher) was permitted to use the employer’s computer for incidental personal purposes. Access to the laptop was protected by a password but nonetheless in doing routine maintenance work on the laptop the employer’s technician found a hidden folder with nude pictures of a student. The technician notified the principal, and, copied the photographs to a CD. The principal[vi] seized the laptop, and school board technicians copied the temporary Internet files onto a second CD. The laptop and both CDs were handed over to the police. The police, without a warrant, reviewed their contents and then created a mirror image of the hard drive for forensic purposes. Mr. Cole was charged with possession of child pornography.

The issue that the Court dealt with was whether or not the evidence should be excluded pursuant to ss. 8 and 24(2) of the Canadian Charter of Rights and Freedoms.

The Court noted that in Cole, the operational realities of the workplace weigh both for and against the existence of a reasonable expectation of privacy. “For, because written policy and actual practice permitted Mr. Cole to use his work-issued laptop for personal purposes. Against, because both policy and technological reality deprived him of exclusive control over — and access to — the personal information he chose to record on it”. The Supreme Court found a continuing reasonable expectation of privacy and that a Charter breach was established as the police had no other lawful authority for their search. The Court found that Mr. Cole had a reasonable expectation of privacy in his Internet browsing history and the informational content of his work-issued laptop, any non-consensual examination by the state was a “search”; and any taking, a “seizure”.[vii]

Unconstitutionally obtained evidence can be excluded under s. 24(2) if, considering all of the circumstances, its admission would bring the administration of justice into disrepute. In Cole the Supreme Court advised this requires a balancing assessment involving three inquiries: (1) the seriousness of the Charter-infringing state conduct; (2) the impact of the breach on the Charter-protected interests of the accused; and (3) society’s interest in the adjudication of the case on its merits.[viii]

In Cole, applying these principles, the Supreme Court found that lower courts had erroneously excluded the unconstitutionally obtained evidence pursuant to s. 24(2) of the Charter. Of importance to the Supreme Court was the diminished nature of Mr. Cole’s reasonable expectation of privacy and that the operational realities of the workplace attenuated the effect of the breach on the Charter-protected interests.[ix] The Court noted that the exclusion of the material would have a marked negative impact on the truth-seeking function of the criminal trial process and so refused to exclude the evidence unlawfully obtained by the police.

Similarly the Court noted that balancing the rights of citizens to have their reasonable expectations of privacy respected against the interest of the state in law enforcement requires consideration of a number of factors. These factors would include the nature of the information, the relationship between the disclosing party and the person asserting the confidentiality claim, the location of the information and the manner in which it was obtained, and the application of such a contextual approach to the facts of any specific case.[x]

In McNeice the appellant, a principal in a school, appealed a conviction of accessing child pornography based on evidence on a laptop assigned by the employer to the defendant. Similar to Cole, in McNeice, the police took the computer, with the consent of the school district’s superintendent, and without obtaining a search warrant.

At trial the BC trial court had distinguished the trial level decision in Cole which concluded that Mr. Cole had a reasonable expectation of privacy in the contents of a school laptop’s hard drive. Rather the trial Court in McNeice found that both by deleting the data and not using a password were indicators that the appellant had abandoned any expectation of privacy.

Factual differences between Cole and McNeice were that in Cole the employer’s policy permitted personal use of the laptop and the laptop was password protected while in McNeice the employer’s policy was silent on the use of the laptop for personal purposes and the laptop was not password protected.

On appeal in McNeice the BC Court of Appeal found, that the deletion of the files was more consistent with an intention to conceal, and thus to maintain a privacy interest, than it is with the idea of “abandonment”, and an intention to give up a privacy interest.

As a result, in McNeice, as in Cole, that although the appellant’s s. 8 right was breached, the evidence was properly to be admitted on the proper application of s. 24(2) as the admission of the unlawfully seized evidence would not bring the administration of justice into disrepute.

What McNeice teaches us is that the Courts will not lightly discard an employee’s expectation of privacy even where files were not password protected. Similarly we also see in both Cole and McNeice that where the defendant is in a trusted position in a school environment and the personal information sought to be protected is child pornography then it may be that society’s interest weighs in favour of admission of the evidence for a proper adjudication of the issues.

Both Courts however did not address the question of the degree to which, in a civil context, an employer can monitor the computers of its employees.[xi]

The lessons of Cole suggest that a properly crafted policy addressing the employer’s rights to data on the employer’s devices will be a factor in determination of an expectation of privacy in the criminal context. Further both cases confirm the importance that employers have clear policies addressing the degree of privacy that an employee should expect to have in their employer’s IT devices and that in a criminal context it is likely that a Court will find an expectation of privacy in such employee information.



[i] R. v. Cole, 2012 SCC 53 (CanLII)

[ii] 2013 BCCA 98

[iii] R. v. Nolet, 2010 SCC 24 (CanLII), 2010 SCC 24, [2010] 1 S.C.R. 851, at para. 21; Hunter v. Southam Inc., 1984 CanLII 33 (SCC), [1984] 2 S.C.R. 145, at p. 161

[iv] Nolet, at para. 21; R. v. Collins, 1987 CanLII 84 (SCC), [1987] 1 S.C.R. 265, at p. 278

[v] See R. v. Cole, 2012 SCC 53 (CanLII)

[vi] The Court noted that the principal had a statutory duty to maintain a safe school environment. Education Act, R.S.O. 1990, c. E.2, s. 265

[vii] See R. v. Cole, 2012 SCC 53 (CanLII) at para. 59.

[viii] See R. v. Cole, 2012 SCC 53 (CanLII) at para. 81.

[ix] See R. v. Cole, 2012 SCC 53 (CanLII) at para. 92.

[x] See Hunter v. Southam, [1984] 2 S.C.R. 145 at 159-160.

[xi] The Supreme Court expressly noted that it was not considering the rights of an employer to monitor computers issued to employees. See R. v. Cole, 2012 SCC 53 (CanLII) at para. 60.

Retweet information »

Comments

  1. There is a clear lesson that employers who issue technology to their employees should think about their rights to search the content and to disclose content to law enforcement. There is probably an additional lesson that if the content is child pornography, no right will withstand its disclosure and use. The two cases discussed here were easier, because they related to the conduct of school officials, but people who do not work with children may not be able to rely on privacy rights either if they have child pornography.

    Is that as it should be, given the importance of protecting children? Are there other interests that should outweigh privacy or other civil rights? Or does that involve a Charter section 1 (or section 24) balancing exercise in every case?

Leave a Reply

(Your email address will not be published or distributed)