Privacy Issues in the Workplace

Most people freely use the employer’s email server to send and receive personal communications, browse the internet and store personal data on the corporate hardware and use the employer’s smart phone to text at will. Scant attention, if any, is paid to the employer’s oversight and indeed, inspection of these activities.

Use of workplace computer equipment

It has now become quite common for employers to require an agreement which limits the ability of employees to use the employer’s information technology. Such agreements also typically ban or restrict the use of such equipment for personal use, and for downloading of documents and programs from external sites. There is good reason for the employer to seek such protection to ensure the security and safety of its technology systems.

Access to Employee’s Documents & Email and Texts

However, often the same agreement will state that the employer may gain access to an employee’s emails and other personal information which may be stored on the employer’s hardware. It is this issue which leads to controversy.

The Leading Authority

The leading case is the Supreme Court of Canada decision in R v Cole, which arose in a criminal context, yet nonetheless offers words of guidance for workplace parties on this subject.

The accused was a high school teacher who had been permitted to use the School Board’s laptop computer for personal purposes. He stored personal information on the computer which included nude and semi-nude photographs of a female student.

Following routine computer maintenance, the IT department of the school discovered the offending images. The computer was subsequently surrendered to the police by the school who accessed the computer without a warrant, thereby raising the issue of a Charter breach.

This, in turn, led to an assessment of the reasonable expectations of privacy of the accused to the contents of the computer. The Charter is intended to protect privacy interests, allowing for state intervention only by legal authority.

Reasonable Expectations of Privacy at Work

This question of “reasonable expectations of privacy” in a workplace context raised by the Cole decision has become significant to employment law.

In Cole, the employer did allow for personal use of the laptop but also maintained a policy which stated personal email remained private, and added that “all data and messages generated on or handled by board equipment are considered to be the property of [the school board]”. Also, the school’s “Acceptable Use Policy”, which applied to both students and teachers, warned users not to expect privacy in their files.

The Supreme Court stated that in circumstances where personal use of workplace computers is permitted or reasonably expected, the individual has a reasonable expectation of privacy in the personal information stored on the machine. Such policies may diminish, but do not eradicate, a user’s expectation of privacy. The Court stated:

Computers that are reasonably used for personal purposes — whether found in the workplace or the home — contain information that is meaningful, intimate, and touching on the user’s biographical core. Vis-à-vis the state, everyone in Canada is constitutionally entitled to expect privacy in personal information of this kind.

While workplace policies and practices may diminish an individual’s expectation of privacy in a work computer, these sorts of operational realities do not in themselves remove the expectation entirely: The nature of the information at stake exposes the likes, interests, thoughts, activities, ideas, and searches for information of the individual user.

The Court continued with the theme that the school board’s policies and practices diminished the expectation of privacy, but did not, however, eliminate it altogether.

Protection of Personal Information of Employees

Notably, the Cole decision did involve the actions of the police, clearly a government actor and subject to Charter protections, unlike a private employer. The Court stated that it would defer the consideration of the rights of the employer to conduct a search of the computer to a future case.

The Court’s direction on offering protection to the personal information of employees is clear:

Computers that are used for personal purposes, regardless of where they are found or to whom they belong, “contain the details of our financial, medical, and personal situations” (Morelli, at para. 105). This is particularly the case where, as here, the computer is used to browse the Web. Internet-connected devices “reveal our specific interests, likes, and propensities, recording in the browsing history and cache files the information we seek out and read, watch, or listen to on the Internet” (ibid.).

This sort of private information falls at the very heart of the “biographical core” protected by s. 8 of the Charter.

Considerations for Employers

 Based on Cole, it is likely that whatever a written agreement or clearly intended policy document may state, such words will not allow for an infringement of personal rights. Equally, ownership is not conclusive of an employee’s right to expected privacy.

A clear and well-defined agreement setting out what personal uses are allowed or not, and that the employer retains the right to examine and access personal data stored on the employer’s computer equipment is nonetheless a first step in defining the respective rights of both parties. It may well not rule the day, but it remains an essential step to define expected positions.

Based on the Ontario Court of Appeal decision in Jones v Tsige, a private employer could be sued for breach of the expected privacy of an employee for reading an employee’s private files and email. This could occur in the absence of a personal use agreement and may also be likely, given the words of the Supreme Court in Cole, even where such an agreement is in place.

There are many practical issues to be discussed should the employer wish to inspect the contents of an employee’s computer. How is to know what is “biographical core” unless it examines it first?

Considerations for Employees

Advice to employees is quite simple:  refrain from using the employer’s email server, browser, and indeed the computer itself for any material of a personal nature. Tell your friends and family to use a third-party email server (i.e. gmail, Hotmail, etc.) for personal communications. Do not access such third-party accounts from your work computer, which will incidentally reveal your user identifiers. Do not use the employer’s phone for personal text communications. Is all this too difficult? Then expect that your private information and communications will be at risk.

Get Advice on Workplace Privacy Issues

This is a relatively new and complicated legal topic. Every employer should have in place a clear and precise agreement setting out its rights on this subject. Every employee should have solid preventive advice on how to avoid such problems and how to deal with them should issues arise.

If you have questions about workplace privacy issues, contact the offices of Toronto employment lawyers Grosman Gale Fletcher Hopkins. We regularly advise employees and employers on issues in the workplace.. Contact us online or by phone at 416 364 9599 to schedule a consultation.