Charter protects employees’ privacy in data stored on employer computers rules Supreme court in R v Cole

The Supreme Court released its reasons in R. v. Cole, 2012 SCC 53 on Friday. It confirmed that a person has a reasonable expectation of privacy in his personal computer, even if it is owned by his or her employer. A police search of the computer without a warrant violated the accused’s rights under the Canadian Charter of Rights and Freedoms. However, the evidence could nevertheless be admitted into evidence on the facts of the case.

The facts in R v Cole were summed up in the headnote of the case as follows:

The accused, a high-school teacher, was charged with possession of child pornography and unauthorized use of a computer.  He was permitted to use his work-issued laptop computer for incidental personal purposes which he did.  While performing maintenance activities, a technician found on the accused’s laptop a hidden folder containing nude and partially nude photographs of an underage female student.  

The technician notified the principal, and copied the photographs to a compact disc.  The principal seized the laptop, and school board technicians copied the temporary Internet files onto a second disc.  The laptop and both discs were handed over to the police, who without a warrant reviewed their contents and then created a mirror image of the hard drive for forensic purposes.  The trial judge excluded all of the computer material pursuant to ss. 8 and 24(2) of the Canadian Charter of Rights and Freedoms.  The summary conviction appeal court reversed the decision, finding that there was no s. 8 breach.  The Court of Appeal for Ontario set aside that decision and excluded the disc containing the temporary Internet files, the laptop and the mirror image of its hard drive.  The disc containing the photographs of the student was found to be legally obtained and therefore admissible.  As the trial judge had wrongly excluded this evidence, the Court of Appeal ordered a new trial.

The key portions of the Court’s ruling dealing with a person’s reasonable expectation of privacy in his/her employer owned laptop are set out below:

Section 8 of the Charter guarantees the right of everyone in Canada to be secure against unreasonable search or seizure. An inspection is a search, and a taking is a seizure, where a person has a reasonable privacy interest in the object or subject matter of the state action and the information to which it gives access (R. v. Tessling, 2004 SCC 67 (CanLII), 2004 SCC 67, [2004] 3 S.C.R. 432, at para. 18; R. v. Evans, 1996 CanLII 248 (SCC), [1996] 1 S.C.R. 8, at para. 11; R. v. Borden, 1994 CanLII 63 (SCC), [1994] 3 S.C.R. 145, at p. 160).

Privacy is a matter of reasonable expectations. An expectation of privacy will attract Charterprotection if reasonable and informed people in the position of the accused would expect privacy (R. v. Patrick, 2009 SCC 17 (CanLII), 2009 SCC 17, [2009] 1 S.C.R. 579, at paras. 14-15)…

Whether Mr. Cole had a reasonable expectation of privacy depends on the “totality of the circumstances” (R. v. Edwards, 1996 CanLII 255 (SCC), [1996] 1 S.C.R. 128, at para. 45).

The “totality of the circumstances” test is one of substance, not of form. Four lines of inquiry guide the application of the test: (1) an examination of the subject matter of the alleged search; (2) a determination as to whether the claimant had a direct interest in the subject matter; (3) an inquiry into whether the claimant had a subjective expectation of privacy in the subject matter; and (4) an assessment as to whether this subjective expectation of privacy was objectively reasonable, having regard to the totality of the circumstances (Tessling, at para. 32; Patrick, at para. 27).  I will discuss each in turn.

In this case, the subject matter of the alleged search is the data, or informational content of the laptop’s hard drive, its mirror image, and the Internet files disc — not the devices themselves.

Our concern is thus with informational privacy: “[T]he claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others” (Tessling, at para. 23, quoting A. F. Westin, Privacy and Freedom(1970), at p. 7).

Mr. Cole’s direct interest and subjective expectation of privacy in the informational content of his computer can readily be inferred from his use of the laptop to browse the Internet and to store personal information on the hard drive.

The remaining question is whether Mr. Cole’s subjective expectation of privacy was objectively reasonable.

There is no definitive list of factors that must be considered in answering this question, though some guidance may be derived from the relevant case law.  As Sopinka J. explained in R. v. Plant, 1993 CanLII 70 (SCC), [1993] 3 S.C.R. 281, at p. 293:

In fostering the underlying values of dignity, integrity and autonomy, it is fitting that s. 8 of theCharter should seek to protect a biographical core of personal information which individuals in a free and democratic society would wish to maintain and control from dissemination to the state.  This would include information which tends to reveal intimate details of the lifestyle and personal choices of the individual.

The closer the subject matter of the alleged search lies to the biographical core of personal information, the more this factor will favour a reasonable expectation of privacy.  Put another way, the more personal and confidential the information, the more willing reasonable and informed Canadians will be to recognize the existence of a constitutionally protected privacy interest.

Computers that are used for personal purposes, regardless of where they are found or to whom they belong, “contain the details of our financial, medical, and personal situations” (Morelli, at para. 105).  This is particularly the case where, as here, the computer is used to browse the Web.  Internet-connected devices “reveal our specific interests, likes, and propensities, recording in the browsing history and cache files the information we seek out and read, watch, or listen to on the Internet” (ibid.).

This sort of private information falls at the very heart of the “biographical core” protected by s. 8of the Charter.

Like Morelli, this case involves highly revealing and meaningful information about an individual’s personal life — a factor strongly indicative of a reasonable expectation of privacy.  Unlike inMorelli, however, this case involves a work-issued laptop and not a personal computer found in a private residence.

The Policy and Procedures Manual of the school board asserted ownership over not only the hardware, but also the data stored on it: “Information technology systems and all data and messages generated on or handled by board equipment are considered to be the property of [the board], and are not the property of users of the information technology”.

While the ownership of property is a relevant consideration, it is not determinative (R. v. Buhay,2003 SCC 30 (CanLII), 2003 SCC 30, [2003] 1 S.C.R. 631, at para. 22).  Nor should it carry undue weight within the contextual analysis.  As Dickson J. (later C.J.) noted in Hunter v. Southam, at p. 158, there is “nothing in the language of [s. 8] to restrict it to the protection of property or to associate it with the law of trespass”.

The context in which personal information is placed on an employer-owned computer is nonetheless significant.  The policies, practices, and customs of the workplace are relevant to the extent that they concern the use of computers by employees.  These “operational realities” may diminish the expectation of privacy that reasonable employees might otherwise have in their personal information (O’Connor v. Ortega, 480 U.S. 709 (1987), at p. 717, per O’Connor J.).

Even as modified by practice, however, written policies are not determinative of a person’s reasonable expectation of privacy.  Whatever the policies state, one must consider the totality of the circumstances in order to determine whether privacy is a reasonable expectation in the particular situation (R. v. Gomboc, 2010 SCC 55 (CanLII), 2010 SCC 55, [2010] 3 S.C.R. 211, at para. 34, per Deschamps J.).

In this case, the operational realities of Mr. Cole’s workplace weigh both for and against the existence of a reasonable expectation of privacy.  For, because written policy and actual practice permitted Mr. Cole to use his work-issued laptop for personal purposes.  Against, because both policy and technological reality deprived him of exclusive control over — and access to — the personal information he chose to record on it.

As mentioned earlier, the Policy and Procedures Manual stated that the school board owned “all data and messages generated on or handled by board equipment”.  Moreover, the principal reminded teachers, annually, that the Acceptable Use Policy applied to them.  This policy provided that “[t]eachers and administrators may monitor all student work and e-mail including material saved on laptop hard drives”, and warned that “[u]sers should NOT assume that files stored on network servers or hard drives of individual computers will be private”.

Though Mr. Cole’s laptop was equipped with a password, the contents of his hard drive were thus available to all other users and technicians with domain administration rights — at least when the computer was connected to the network. And even if the Acceptable Use Policy did not directly apply to teachers, as Mr. Cole maintains, he and other teachers were in fact put on notice that the privacy they might otherwise have expected in their files was limited by the operational realities of their workplace.

The “totality of the circumstances” consists of many strands, and they pull in competing directions in this case.  On balance, however, they support the objective reasonableness of Mr. Cole’s subjective expectation of privacy.

The nature of the information in issue heavily favours recognition of a constitutionally protected privacy interest.  Mr. Cole’s personal use of his work-issued laptop generated information that is meaningful, intimate, and organically connected to his biographical core.  Pulling in the other direction, of course, are the ownership of the laptop by the school board, the workplace policies and practices, and the technology in place at the school.  These considerations diminished Mr. Cole’s privacy interest in his laptop, at least in comparison to the personal computer at issue inMorelli, but they did not eliminate it entirely.

credits;http://www.barrysookman.com/2012/10/21/charter-protects-employees-privacy-in-data-stored-on-employer-computers-rules-supreme-court-in-r-v-cole/

Print Page