Reporting on Privacy: The Cole Decision

Last week saw a flurry of reports about the case of R. v. Cole. Cole is a decision of the Ontario Court of Appeal involving charges of possession of child pornography. Two reports in the National Post and Globe and Mail suggest this is a groundbreaking decision with significant implications for employers across Canada with respect to reasonable expectations of privacy. It isn’t. And that fact probably says more about the state of the media’s reporting about privacy than anything else.

The essential story is that Mr. Cole was provided with a laptop by his school for use in teaching and in supervising a laptop program for students. He subsequently accessed a student’s email account, found photographs of another, underage student and copied them onto the hard drive of his school-issued laptop. A computer technician then remotely accessed Mr. Cole’s to verify the system’s integrity and, in doing so, he found the nude, sexually explicit images.

The school board did have a Policy and Procedures Manual but it did not provide for the search of computers nor did it address the issue of privacy, except as it related to email. Students were required to sign an Acceptable Use Agreement but not teachers or staff.

The Post and Globe stories suggest that the implications of the decision are much larger. I won’t comment on the quotes beyond saying they represent what the reporter took away from the interview. The Post quotes Mr. Cole’s counsel (Frank Addario):

“The significance of the case is the court recognizes that where an employer provides an electronic device for use by an employee and acquiesces for personal use, there will be an expectation of privacy in that device,” Mr. Addario said.

The Globe quoted another lawyer:

“This case comes down firmly on the side of privacy and holds that employers cannot give police investigators access to a workplace computer,” he said.

However, when you actually read the Cole decision you come away with a completely different impression. The Court did find a “reasonable expectation of privacy” but that was the result of the facts of the case and not the creation of a new, broad statement of principle. The Charter of Rights and Freedoms only applies to the actions of “state agents”. Where things started to go wrong in the Cole case was that the principal and school board officials gave police the laptop and the compact discs. Some weeks later, without obtaining a search warrant, the investigating officer sent the laptop for analysis. Had the police obtained a warrant, the outcome of the Court of Appeal decision would have been different.

Where there is no “state agent” – usually in a non-criminal or non-regulatory context — private sector employees, in the majority of provinces, can only look to the common law or collective bargaining agreements for any privacy “rights”. Private sector employees in “federal works, undertakings or businesses” and those in BC, Alberta and Quebec have the benefit of personal information protection legislation. Where no law applies, expectations of privacy become a matter of corporate policy.

If an employer has a clearly articulated policy (and I emphasize the word clearly here) and an active monitoring program, the odds are that any expectation of privacy on the part of the employee in the private sector will not be recognized.

Any such policy should have a number of key elements: staff should have no expectation of privacy; that the machines are owned by the company; are for business use only, and that the machines may be subject to search for compliance purposes (using the least intrusive means). It would be preferable to have evidence that staff had read and understood the applicable policy (e.g. a signed acknowledgement) but individual corporate circumstances may not make that possible.

Some might quibble with these elements and corporate culture plays a large role in determining whether all the elements can be implemented but such an approach is not uncommon in the private sector. As for employees using equipment for personal use it will happen but it should not be sanctioned or condoned.

If you want to read a more accurate report on the Cole decision, Dan Michaluk has a good blog post on the subject over at Slaw.

Regrettably, I took three things away from the press reports:

• The school board does not have a mature privacy/governance framework.

• It is misleading to suggest, because of the decision in Cole, that employees can expect recognition of an expectation of privacy in their use of corporate computers.

• Media reports about privacy topics should come with a warning label.