The Supreme Court of Canada ruled that an employee may have a reasonable expectation of privacy in the contents of his workplace computer, even though the employer’s policies disavow any privacy interest. R. v. Cole, 2012 SCC 53 (Canada Oct. 19, 2012). Whether an expectation of privacy is reasonable in the face of such a policy must be judged in light of the totality of the circumstances. In this case, the court found that the employer’s permission for workers to use computers for some personal purposes weighed against a complete disclaimer of an expectation of privacy.
The court’s ruling came in an appeal by a high school teacher who was prosecuted for possession of child pornography. While performing systems maintenance, school technicians discovered illicit images of an underage female student on the teacher’s school-issued laptop computer. The school turned the photos over to police, who then searched the teacher’s computer without a warrant.
A trial court ruled that the police had obtained the images from the laptop in violation of Section 8 of the Canadian Charter of Rights and Freedoms, which guarantees the right of everyone in Canada to be secure against unreasonable search or seizure. For this reason, the trial court held that none of the evidence obtained from the warrantless search could be used at trial. A summary conviction appeal court found that the authorities had not violated the defendant’s privacy rights. The Court of Appeal for Ontario set aside that decision, holding that some of the evidence obtained from the defendant’s workplace computer should have been excluded and some admitted.
Computers that are reasonably used for personal purposes — whether found in the workplace or the home — contain information that is meaningful, intimate, and touching on the user’s biographical core. Canadians may therefore reasonably expect privacy in the information contained on these computers, at least where personal use is permitted or reasonably expected. Ownership of property is a relevant consideration, but is not determinative. Workplace policies are also not determinative of a person’s reasonable expectation of privacy. Whatever the policies state, one must consider the totality of the circumstances in order to determine whether privacy is a reasonable expectation in the particular situation. While workplace policies and practices may diminish an individual’s expectation of privacy in a work computer, these sorts of operational realities do not in themselves remove the expectation entirely. A reasonable though diminished expectation of privacy is nonetheless a reasonable expectation of privacy, protected by s. 8 of the Charter. Accordingly, it is subject to state intrusion only under the authority of a reasonable law.
by Shawn N. Sullivan, Oct. 28, 2012.