by Shaya Silber
We all expect that information on our computers to be kept private. This is certainly obvious for personal computers. However, can we expect the same level of privacy when computers (or other devices) are provided by our employers, and are occasionally accessed for personal use?
In R. v. Cole the Supreme Court of Canada was asked whether an individual has a reasonable expectation of privacy for information stored on a computer provided by an employer.
In that case, a high school teacher was charged with possession of child pornography. The content was found on his work-issued computer. The defendant was issued a computer for work purposes, and was permitted to use the computer for incidental personal use too. The defendant handed in his computer to the school’s IT department for maintenance. While undergoing maintenance, the IT department discovered illegal images on the computer and notified the school, who in turn notified the police. The police searched the computer without a warrant, and charged Cole with possession of child pornography.
While the Supreme Court found Cole to be guilty, they did find that his Charterrights (that protect from unreasonable search and seizure), had been violated when the police searched the computer without a warrant. The Supreme Court declined to specifically address the “finer points of an employer’s right to monitor computers issued to employees”. However, this case is interesting since it opens the door to further discussion on the issue of whether employees can expect a degree of privacy on work-issued computers.
It should be noted that in the Cole case, the employer had an explicit policy with respect to computer usage. The policy did allow for incidental personal use. It stated that personal emails remained private and that the contents of the computer was “subject to access by school administrators”. The policy further stated that “all data and messages generated on or handled by board equipment are considered to be the property of [the school board]”.
The existence of a policy to search, access, or own content on a work-issued computer may diminish an employee’s reasonable expectation of privacy. However, it does not completely remove the expectation of privacy. It will be interesting to see how future cases examine this question.