Some interesting arguments related to computer use and the expectation of privacy.
At my most recent workshop, a participant asked a question about property that is given to employees by the employer and the ability to access such assets in an investigation. After some discussion, he guided me to R. v. Cole, which, being from the Supreme Court is of particular interest. In my reading of the case, I am struck by the considerations for every decision in our legal system. In particular, this case, in my opinion is not absolutely instructive of Harassment Investigators as it largely involves a criminal case and considerations involving Police activity. Elements of the decision deal specifically with the concepts of privacy and the Employer’s policy instructions. Most organizations I have dealt with have similar computer use policies.
The accused, a teacher was charged with possession of child pornography and unauthorized use of a computer. He was permitted to use his work-issued laptop computer for incidental purposes which he did. While performing maintenance activities, a technician found on the accused’s laptop a hidden folder containing nude and partially nude photographs of an underage female student. The technician notified the principal, and copied the photographs to a compact disc. The principal seized the laptop, and school board technicians copied the temporary Internet files onto a second disc. The laptop and both discs were handed over to the police, who without a warrant reviewed their contents and then created a mirror image of the hard drive for forensic purposes.
The case diverges from a standard investigation in the workplace such as a Harassment investigation here, as the Police became involved. The teacher’s expectation of privacy was examined in that context. I have offered areas of the decision that are interesting to me.
“Computers that are reasonably used for personal purposes — whether found in the workplace or the home — contain information that is meaningful, intimate, and touching on the user’s biographical core. Canadians may therefore reasonably expect privacy in the information contained on these computers, at least where personal use is permitted or reasonably expected. Ownership of property is a relevant consideration, but is not determinative. Workplace policies are also not determinative of a person’s reasonable expectation of privacy. Whatever the policies state, one must consider the totality of the circumstances in order to determine whether privacy is a reasonable expectation in the particular situation. While workplace policies and practices may diminish an individual’s expectation of privacy in a work computer, these sorts of operational realities do not in themselves remove the expectation entirely. A reasonable though diminished expectation of privacy is nonetheless a reasonable expectation of privacy, protected by s. 8 of the Charter . Accordingly, it is subject to state intrusion only under the authority of a reasonable law.”
“While the principal had a statutory duty to maintain a safe school environment, and, by necessary implication, a reasonable power to seize and search a school-board issued laptop, the lawful authority of the accused’s employer to seize and search the laptop did not furnish the police with the same power.”
The Policy and Procedures Manual of the school board asserted ownership over not only the hardware, but also the data stored on it: “Information technology systems and all data and messages generated on or handled by board equipment are considered to be the property of [the board], and are not the property of users of the information technology”.
Even as modified by practice, however, written policies are not determinative of a person’s reasonable expectation of privacy. Whatever the policies state, one must consider the totality of the circumstances in order to determine whether privacy is a reasonable expectation in the particular situation
I have presented some of the arguments and conclusions of the Supreme Court. If you are interested in the full context, please refer to the source document. Of interest to me, the Court held that a workplace policy that explicitly states the laptop and all information is property of the Employer, however that does not by itself remove the accused’s expectation of privacy. A totality of the circumstances must be examined. Some more elements of the decision:
“Mr. Cole does not challenge the initial inspection of the laptop by the school technician in the context of routine maintenance activities. He concedes, moreover, that the technician did not breach his s. 8 rights. In this light, I leave for another day the finer points of an employer’s right to monitor computers issued to employees.”
“The Court of Appeal concluded that, in the circumstances of this case, the subsequent search and seizure of the laptop by school officials acting under the direction of the principal was not unreasonable within the meaning of s. 8 of the Charter . Mr. Cole does not challenge this conclusion.”
“In any event, I agree with the Court of Appeal. The principal had a statutory duty to maintain a safe school environment (Education Act, R.S.O. 1990, c. E.2, s. 265), and, by necessary implication, a reasonable power to seize and search a school-board-issued laptop if the principal believed on reasonable grounds that the hard drive contained compromising photographs of a student. This implied power is not unlike the one found by the majority of this Court.”
These three parts sum up the applicability of this case to our environment, the internal or external Harassment investigation process. No objection to the Employer searching and seizing the laptop or the data was presented.
What this case does tell me is that Employer’s need to have a look at the applicability of their internal policies, especially in the area of computer usage, and in particular when cases involve actions that may be criminal in nature.
Thank you to the participant who helped me learn a little more in this field, let’s all keep helping each other!