Reasonable expectation of privacy in work computer? Yes

R. v. Cole, 2011 ONCA 218, released today online, is fact based but does go so far as to find a reasonable expectation of privacy in a work computer. The expectation was limited in that the Court recognised technicians would have access to the computer's hard drive for maintenance purposes. As a result the expectation of privacy was less than might be for, say, a home computer.

Although arising in the criminal law context (a teacher with nude pictures of a Grade 10 student) the decision has ramifications for employment law.

The Court writes:

[44]         There is little authority in Canada on the issue of whether an individual has a reasonable expectation of privacy in work computer. In R. v. Little, 2009 CanLII 41212 (ON S.C.), the application judge held that the accused had a reasonable expectation of privacy in the information on his work hard drive, but it was a diminished expectation compared to that in a home computer or a computer owned and used exclusively by an individual running his or her own business. In France (Republic) v. Tfaily (2009), 98 O.R. (3d) 161 (C.A.) [In Chambers], an application for leave to appeal, the question raised on appeal was whether there were sufficient grounds to issue warrants to search for the applicant's work computers. The applicant was a professor at Carleton University. Simmons J.A. noted that university professors are entitled to use their work computers for personal communications and research and that therefore they have an objectively reasonable expectation of privacy in relation to personal electronic data.

[45]         I agree with the trial judge that, based upon the totality of the circumstances in this case, including the factors set out in Edwards, the appellant had a reasonable expectation of privacy in the personal use of his work laptop. Although this was a work computer owned by the school board and issued for employment purposes with access to the school network, the school board gave the teachers possession of the laptops, explicit permission to use the laptops for personal use and permission to take the computers home on evenings, weekends and summer vacation. The teachers used their computers for personal use, they employed passwords to exclude others from their laptops, and they stored personal information on their hard drives. There was no clear and unambiguous policy to monitor, search or police the teachers' use of their laptops.

[46]         Furthermore, applying the factors in Patrick at para. 27, the information in the folder stored on the hard drive was not in public view, was not abandoned and was not in the hands of third parties. While the access by the technician for the purpose of maintaining the integrity of the system was not intrusive or objectively unreasonable, access by a state actor for the purpose of determining the nature of the information stored by the appellant would be intrusive. Access to that information on the hard drive potentially exposed intimate details of the appellant's personal choices and could have exposed intimate details of a personal nature. The appellant had a reasonable expectation of privacy in both the hard drive of the laptop and the personal information it contained.

[47]         On the other hand, the appellant knew that a school technician had a limited right of access to the hard drive as part of his duties to maintain the stability and security of the network system. Business and other institutions commonly engage technicians to service and maintain their networks. Users understand that a technician can access computers connected to the network to ensure the integrity of the system. The appellant's reasonable expectation of privacy was modified to the extent that the appellant knew that his employer's technician could and would access the laptop as part of his role in maintaining the technical integrity of the school's information network. However, this was not sufficient to displace a reasonable expectation that otherwise would exist in the personal electronic information maintained on his hard drive, except to that extent and for that limited purpose.

[48]         I conclude, therefore, that the appellant had a reasonable expectation of privacy in the information stored in the hard drive of his laptop, which was subject to the limited right of access by his employer's technicians performing work-related functions. In other words, the appellant had no expectation of privacy with respect to this limited type of access.