Do You Know What Your Employees Are Doing With Their Work-Issued Laptops?

This post was written prior to our January 2017 merger, under our previous firm name, Aikins, MacAulay & Thorvaldson LLP.

It’s midnight on Saturday. Do you know what your employees are doing with their work-issued laptops?

Many municipalities provide employees laptop computers to facilitate their work. They allow employees to take their laptops home, to the cottage or wherever. CAOs and other managers are also aware that whether it is in the office, at home or on the road, employees will connect to the internet and use their work-issued devices for personal reasons – everything from checking the latest sports news to booking a winter vacation.

You may not care, or even want to know, what your employees are doing with your computers; as long as there is a little work completed along the way. However, employers have legitimate business reasons for monitoring the use of work-issued devices, such as monitoring for evidence of a breach of workplace standards like bullying or harassment and maintaining the integrity of your computer network. The question is does an employee have the right to privacy for information stored on a work-issued device? The short answer is maybe, it depends. But you can take steps to improve the odds.

The Supreme Court of Canada (“SCC”) recently decided a case that had to address the issue of an employee’s expectation of privacy for personal matters on a work-issued laptop. That case was R. v. Cole.

Cole was a high school teacher in northern Ontario. He was permitted to use his work-issued laptop computer for incidental personal purposes. Cole did browse the internet and stored personal information on the computer’s hard drive.

While performing maintenance on Cole’s laptop, the school’s technician found a folder containing nude and partially nude photographs of a female grade 10 student. This is troubling in any circumstances, but particularly in a school. The principal seized the laptop and the school board’s technicians copied Cole’s internet files and created a mirror image of the computer’s hard drive. The laptop and the copied data were then provided to the police by the school board. Cole was charged with possession of child pornography and unauthorized use of a computer contrary to the Criminal Code of Canada.

At Cole’s trial the issue became the admissibility into evidence of the data which contained the offending photographs.

The SCC concluded that the more personal and confidential to the individual the subject matter at issue is, the more likely it is that a court will recognize the employee has a privacy interest. However that privacy interest can be diminished by the “operational realities” of the workplace. The lower the expectation of privacy, the better chance an employer will have a right to access the information and use it as evidence in an arbitration, court case, workplace health and safety or human rights complaint.

Path Forward for Municipalities

So, how can you as a municipal employer make sure that the totality of circumstances favour a lower expectation of privacy on employer-issued devices?

Policies are still important, even though R. v. Cole made it clear that they are not determinative. Policies must be clear, consistently applied and should state: that the computer and data is the employer’s property; that there is no expectation of privacy if there is reason to suspect an employee is acting contrary to law (bullying, harassment, taking confidential information) or threatening the integrity of the network.

Employees should be periodically reminded that if they require private internet access, the employer’s device and network are not it. They should use a personal device, not connected to the employer’s network. These reminders can be by email or a pop up message when an employee logs onto the device. This concept should also be in the policy.

Allowing some personal use on employer equipment does increase the expectation of employee privacy. Some commentators are recommending that employers ban personal use, but frankly such a rule is not realistic and it would diminish the overall enforceability of your policy.

R. v. Cole did not establish that employees always have a right to privacy of personal information on employer-owned devices, but the case will be read as providing employees greater privacy rights. This will impact CAOs and others responsible for managing in the workplace. Accessing personal information on an employer computer for the purpose of establishing discipline will require probable cause or a reasonable basis for suspicion. There will be no automatic employer right to just go and get the information.

The bottom line is employees will have a greater right to privacy when using an employer-owned device, but municipalities as employers can and need to set the tone, context and culture through proper policy and reinforcement in the workplace. This will allow CAOs and other managers the tools they need to address issues as they arise.

Now for the legal caveats. The SCC expressly stated it was not ruling on finer points of an employer’s right to monitor computers issued to employees. R. v. Cole was decided in an unusual situation. The privacy issue arose in the context for a criminal case and the Charter of Rights and Freedoms applied. The issue became whether the police, in accepting the CD and computer information from the school board without a warrant, violated Cole’s Charter right to be secure against unreasonable search and seizure.

For municipalities the Charter issue is important because, unlike private sector employers you are a level of government and the Charter will apply.

Coincidentally, a school board like Mr. Cole’s employer is also bound by the Charter. The SCC did not deal with the issue of whether the employer’s search of Cole’s laptop, without a warrant, was a Charter violation (it was not a point argued in the case).

However, the SCC did refer to previous case law that involved school boards (and therefore presumably could be applied to municipalities) that schools can conduct searches, if there are reasonable grounds to believe a rule has been violated and there is statutory authority to act on reasonable grounds. The court referenced maintaining a safe school environment.  Municipalities have a duty under The Workplace Safety and Health Act to maintain a safe workplace and protect employees from harassment and bullying and, therefore, at least in those contexts, provided there are reasonable grounds to seek the information on a work-issued device, a municipality will have a defence for its actions.

So how did it end up for Cole? The SCC concluded that the lack of search warrant, in the circumstances, was not such an egregious breach of Cole’s Charter rights and that admitting the computer data into evidence would not bring the administration of justice into disrepute. Cole would get new trial and the evidence from the computer would be judge and/or jury.

This article was originally published in Municipal Leader, Spring 2013 issue.

Note: This article is of a general nature only and is not exhaustive of all possible legal rights or remedies. In addition, laws may change over time and should be interpreted only in the context of particular circumstances such that these materials are not intended to be relied upon or taken as legal advice or opinion. Readers should consult a legal professional for specific advice in any particular situation.

David Negus is a partner in the labour and employment department at Aikins Law.