Case Report – Ont. SCJ says no expectation of privacy in data stored on work computer

13 May

On April 28th, the Ontario Superior Court of Justice held that a teacher had no expectation of privacy in information stored on his work laptop.

A school board investigated the teacher after noticing he had an abnormal pattern of network use. A member of the board’s IT staff accessed his laptop remotely and found nude photographs of a 16-year-old Grade 10 student. Soon after, the board obtained the laptop from the teacher (who refused to provide his password) and reported him to the police. The police charged him with possession of child pornography. Given the teacher allegedly obtained the photos by accessing a student’s e-mail account, the police also charged him with unauthorized use of a computer pursuant to section 342.1 of the Criminal Code.

The Ontario Superior Court of Justice allowed an appeal of the trial judge’s decision to exclude evidence based on a finding the board had breached the teacher’s Charter right to be free from unreasonable search and seizure. It held that the trial judge had erred in concluding that the teacher had an objectively reasonable expectation of privacy, stating:

The laptop on which the impugned evidence was found was issued to Mr. Cole as an instrument of his employment with the school board by his employer. The evidence is that the laptop was the property of the school. Mr. Cole, in his teaching role, taught students in the classroom using this employer-issued computer while his students used their own laptops. Both the respondent and his students used school board software, server, and the school’s computer network. I take judicial notice of the fact that employers, in their use of computers to carry on their business, invest tremendous amounts of money and time creating, inputting, analyzing, managing and protecting the data coming into, going out of, and stored on their computer systems.

While the judgement contains numerous statements as broad as this, the Court did state that its judgement turned on a number of specific facts. It stressed that  the teacher was bound by his employment contract to an acceptable use policy that limited his interest in information stored on the laptop and that the teacher (quite remarkably) had a special role in supervising computer use at the board that ought to have reinforced this point.

This appeal judgement reflects an approach that has been traditionally adopted by Canadian labour arbitrators and, to the extent they have addressed the question, Canadian courts. It is not surprising in itself, but the sharp difference in view held by the trial judge nicely illustrates the current tension on this issue. The trial judge had said:

In the present case, the accused had not rented the computer but was given the exclusive use of it, such exclusive use being secured by a password. Its contents could not be accessed, except when in actually in use or when one was in possession of the password. We also know that there existed some protocol at least to advise staff of any imminent intention to recover actual possession of their computers. Barring this, staff were allowed to use their computer for limited personal purposes and, indeed, to take them home during the summer recess, whether for personal use or for the purpose of preparing their fall courses. Whatever the official policy might have been (this would likely avoid any later argument) the actual policy seems to have been to accept that staff would load private material onto their computers.

This might reveal a judge who was struggling with the idea that the black letter of policy can nullify the expectations that otherwise might be engendered by personal use. For now, this view remains the minority view (if that) and is reinforced by the recent “lawful access” decisions reported on this blog as typified by R. v. Wilson.

I’ll be speaking on this topic at the upcoming OBA “Hot Topics in Privacy Law” seminar. Details are linked here.

R. v. Cole, 2009 CanLII 20699 (ON S.C.).

Advertisements

8 Responses to “Case Report – Ont. SCJ says no expectation of privacy in data stored on work computer”

  1. Kevin May 13, 2009 at 1:53 pm #

    The results seems right, but something seems off in the analysis. Probably because the employer was itself a government body … that seems to have led to an odd concession as to the applicability of s.8.

    I think a better analysis would be this: s.8 doesn’t apply because all the relevant information was voluntarily, proactively made available to the police by someone with access and control. Therefore, no search occurred. Whether or not it was the employer, a laptop repair shop, or even a thief–the state shouldn’t be bound by s.8 concerns when a good citizen voluntarily provides evidence that the police didn’t come looking for. I think of R. v. Weir from Alberta, but I’m sure there are other cases on point. I’d distinguish Wilson, and any other case where the police actually come looking for the info.

    The “privacy” issue should be a private issue between the employee and the employer, not a s.8 issue.

    On that private issue, I think the result is correct–the employee should have no reasonable expectation that the employer will not access or disclose information stored on the employer’s asset. Employers have reasonably relied on that principle for some time.

    Even then, though, this case actually illustrates the potential weaknesses in that principle. It does seem like a case where the employee was given a great deal of leeway to use the asset for personal use. The efforts taken to communicate the AUP in this case seem a lot more substantial than most employers undertake. I wonder if we’ll soon find a case where an arbitrator or court find a reasonable expecation of privacy vis-a-vis the employer when it comes to information on employer computers.

    But again, I just don’t see that as a s.8 issue at all.

  2. Dan Michaluk May 13, 2009 at 4:10 pm #

    Thanks so much Kevin.

    I agree that the court looks very hard at the facts to get to its end point! As for the Charter issue, I’ve had cause to research on whether school boards are bound by the Charter as “government.” Its not a question that has been clearly answered, though there’s some obiter at the SCC in a decision called “Chamberlain” that says yes. I’m not surprised it was conceded here, as it often is. Dan.

  3. Kevin May 13, 2009 at 4:48 pm #

    There have been some pretty good freedom of expression cases in BC and PEI establishing the same point. But does being bound by the Charter mean that a school board’s actions amount to “searches” within the meaning of s.8? I’m not sure of the answer, but if it does, then it must dramatically impact employee relations in the public sector …

  4. Dan Michaluk May 14, 2009 at 10:10 am #

    I’m not sure about the two hats argument, but I did see it argued in an arbitration case recently. I’ll find it and flip it to you by e-mail Kevin. Thanks again. Dan.

  5. Dan Michaluk May 14, 2009 at 10:18 am #

    Here’s a link to a summary of the case: http://bit.ly/NSVIU

Trackbacks/Pingbacks

  1. Don't expect your work computer to be private | NJN Network - May 13, 2009

    […] Stephen Pate, NJN Network, Charlottetown, Prince Edward Island, Canada, May 13 2009 with story from All About Information […]

  2. Case Report – Ontario IPC says personal e-mails in control of City « All About Information - May 30, 2009

    […] on corporate computer systems. For a recent case that also demonstrates the traditional view see R. v. Cole. The good question is whether the traditional view is waning, as might be indicated by Johnson v. […]

  3. Information Roundup – 2 August 2009 « All About Information - August 2, 2009

    […] day was 283 unique visitors on May 13th of this year, where a link from Michael Geist on the Cole case gave me a good […]

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: