Are people expecting too much privacy from Cole?

Since the Supreme Court of Canada (SCC) decision in R. v. Cole was issued in October 2012, I’ve seen press reports, blog posts and law firm newsletter articles talk about the existence of computer-related expectations of privacy in an employment context. This is somewhat contrary to the conventional wisdom that employers, with notice and through the use of policy, can eliminate such employee expectations of privacy. Did the Supreme Court of Canada really change the employer-employee dynamic when it comes to expectations of privacy?

I’ve blogged about Cole here when the Court of Appeal decision came out. With the SCC decision, my initial view hasn’t changed but I do think the waters have been muddied to a certain degree.

To recap Cole briefly, a high school teacher was charged with possession of child pornography. The key factual aspects involved the handling of Cole’s employer-issued laptop (who has one of the best remote jobs in his hands). During maintenance activities, a school technician found the offending photographs and copied the laptop’s temporary Internet files onto a disc. The laptop and discs were provided to the police who then forensically created a mirror image of the laptop’s hard drive.

At issue at each level of trial and appeal was police conduct and whether there was a violation of Mr. Cole’s Charter rights under s. 8. At trial, all the computer material were excluded; on appeal, most of the material was excluded; at the SCC, the court found that there was a s. 8 violation but that it was “not high on the scale of seriousness” [para. 97] and ruled that exclusion of the evidence would bring the administration of justice into disrepute.

While the end result is the admissibility of all the evidence, the SCC nonetheless found that Mr. Cole had a real but diminished expectation of privacy. This finding is what has garnered the most attention.  I still think an important consideration is that this was a Charter case about police conduct. Granted the conduct was not considered egregious in this context but it was still a Charter breach. What I did note and what appears to have gotten lost, is the SCC’s comments as to the employer’s conduct and their implications for any expectation of privacy.

Mr. Justice Fish wrote: 

“…The principal had a statutory duty to maintain a safe school environment (Education Act, R.S.O. 1990, c. E.2, s. 265), and, by necessary implication, a reasonable power to seize and search a school-board-issued laptop if the principal believed on reasonable grounds that the hard drive contained compromising photographs of a student…I likewise agree with the Court of Appeal that other school board officials had the same implied powers of search and seizure as the principal (paras. 62-63).”

It was also noted that the Court of Appeal found that the employer’s seizure of the laptop did not violate s. 8 (i.e. any expectation of privacy). Finally, as Mr. Justice Fish succinctly stated:

 “I leave for another day the finer points of an employer’s right to monitor computers issued to employees.” [para. 60]

So as between employers and employees, one should not read expectations of privacy into Cole. Vis-á-vis computers, such expectations may well exist but not from anything said in Cole. For now, when we speak of workplace privacy interests, employers often have a greater degree of control in order to better meet its responsibility to protect other employees. One need only look at Poliquin v. Devon Canada Corporation to see this starkly stated.

Poliquin was an appeal of a dismissed summary judgment application by an employer in a wrongful dismissal case. The Alberta Court of Appeal determined that the case had no merit and stated a rather strong view on the subject of computer-related expectations of privacy in the workplace:

“Employers have the right to set the ethical, professional and operational standards for their workplaces. Doing so not only falls within an employer’s management rights, it also constitutes an integral component of corporate good governance. The workplace is not an employee’s home; and employees have no reasonable expectation of privacy in their workplace computers. It therefore follows that while employers may permit employees limited personal use of workplace computers, the employer is entitled to restrict the terms and conditions on which that use may be permitted.”

Cole did nothing to displace this view.

So why do I think the waters may be muddied? Two reasons. First, this view of Cole may well find its way into arbitral decisions on computer-related expectations of privacy  A lot of the law surrounding employee privacy comes from such sources – especially in a labour context. Second, courts may apply Cole in different contexts that buttress this mistaken conclusion. One need only look at Communications, Energy and Paperworkers Union, Local 707 v. Suncor Energy Inc. where the Alberta Court of Appeal — in the context of drug testing — recently stated:

“…Suncor also argued that the level of intrusion on workers would be minor in light of the nature of the testing process, and that workers already faced other measures and were liable to testing for similar albeit more situation-specific reasons. This argument of Suncor was also related to the concept of the “reasonable expectation” of workers as to privacy on the work site. As of the date these reasons were completed, the Supreme Court affirmed that employees do not completely lose their expectation of privacy at a work place: R v Cole…”

What should employers do on this subject of expectations of privacy in employer-owned computers? Before reading too much into Cole, I suggest waiting for Mr. Justice Fish’s “another day”.