Work computer may be "private" for purposes of search and seizure

R. v. Cole, 2012 SCC 53 was released this morning. In summary, a person may well have a reasonable expectation of privacy protected by the Charter on a work computer. It all depends on the circumstances.

Computers that are reasonably used for personal purposes - whether found in the workplace or the home - contain information that is meaningful, intimate, and touching on the user's biographical core. Canadians may therefore reasonably expect privacy in the information contained on these computers, at least where personal use is permitted or reasonably expected. The accused's personal use of his work-issued laptop generated information that is meaningful, intimate, and organically connected to his biographical core. Ownership of property is a relevant consideration, but is not determinative. Workplace policies are also not determinative of a person's reasonable expectation of privacy. Whatever the policies state, one must consider the totality of the circumstances in order to determine whether privacy is a reasonable expectation in the particular situation. While workplace policies and practices may diminish an individual's expectation of privacy in a work computer, these sorts of operational realities do not in themselves remove the expectation entirely. A reasonable though diminished expectation of privacy is nonetheless a reasonable expectation of privacy, protected by s. 8 of the Charter. Accordingly, it is subject to state intrusion only under the authority of a reasonable law.

The Court holds:



[34] Section 8 of the Charter guarantees the right of everyone in Canada to be secure against unreasonable search or seizure. An inspection is a search, and a taking is a seizure, where a person has a reasonable privacy interest in the object or subject matter of the state action and the information to which it gives access (R. v. Tessling, 2004 SCC 67, [2004] 3 S.C.R. 432, at para. 18; R. v. Evans, [1996] 1 S.C.R. 8, at para. 11; R. v. Borden, [1994] 3 S.C.R. 145, at p. 160).



[35] Privacy is a matter of reasonable expectations. An expectation of privacy will attract Charter protection if reasonable and informed people in the position of the accused would expect privacy (R. v. Patrick, 2009 SCC 17, [2009] 1 S.C.R. 579, at paras. 14-15).



[36] If the claimant has a reasonable expectation of privacy, s. 8 is engaged, and the court must then determine whether the search or seizure was reasonable.



[37] Where, as here, a search is carried out without a warrant, it is presumptively unreasonable (R. v. Nolet, 2010 SCC 24, [2010] 1 S.C.R. 851, at para. 21; Hunter v. Southam Inc., [1984] 2 S.C.R. 145, at p. 161). To establish reasonableness, the Crown must prove on the balance of probabilities (1) that the search was authorized by law, (2) that the authorizing law was itself reasonable, and (3) that the authority to conduct the search was exercised in a reasonable manner (Nolet, at para. 21; R. v. Collins, [1987] 1 S.C.R. 265, at p. 278).



[38] Before applying this analytical framework here, I pause to explain why it is unnecessary on this appeal to decide whether the Charter applies to school officials. The Crown conceded in the courts below that it does. Like the Court of Appeal, I shall proceed on that assumption, as did Cory J. in R. v. M. (M.R.), [1998] 3 S.C.R. 393, at paras. 24-25.



V



[39] Whether Mr. Cole had a reasonable expectation of privacy depends on the "totality of the circumstances" (R. v. Edwards, [1996] 1 S.C.R. 128, at para. 45).



[40] The "totality of the circumstances" test is one of substance, not of form. Four lines of inquiry guide the application of the test: (1) an examination of the subject matter of the alleged search; (2) a determination as to whether the claimant had a direct interest in the subject matter; (3) an inquiry into whether the claimant had a subjective expectation of privacy in the subject matter; and (4) an assessment as to whether this subjective expectation of privacy was objectively reasonable, having regard to the totality of the circumstances (Tessling, at para. 32; Patrick, at para. 27). I will discuss each in turn.



[41] In this case, the subject matter of the alleged search is the data, or informational content of the laptop's hard drive, its mirror image, and the Internet files disc - not the devices themselves.



[42] Our concern is thus with informational privacy: "[T]he claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others" (Tessling, at para. 23, quoting A. F. Westin, Privacy and Freedom (1970), at p. 7).



[43] Mr. Cole's direct interest and subjective expectation of privacy in the informational content of his computer can readily be inferred from his use of the laptop to browse the Internet and to store personal information on the hard drive.



[44] The remaining question is whether Mr. Cole's subjective expectation of privacy was objectively reasonable.



[45] There is no definitive list of factors that must be considered in answering this question, though some guidance may be derived from the relevant case law. As Sopinka J. explained in R. v. Plant, [1993] 3 S.C.R. 281, at p. 293:



In fostering the underlying values of dignity, integrity and autonomy, it is fitting that s. 8 of the Charter should seek to protect a biographical core of personal information which individuals in a free and democratic society would wish to maintain and control from dissemination to the state. This would include information which tends to reveal intimate details of the lifestyle and personal choices of the individual.



[46] The closer the subject matter of the alleged search lies to the biographical core of personal information, the more this factor will favour a reasonable expectation of privacy. Put another way, the more personal and confidential the information, the more willing reasonable and informed Canadians will be to recognize the existence of a constitutionally protected privacy interest.



[47] Computers that are used for personal purposes, regardless of where they are found or to whom they belong, "contain the details of our financial, medical, and personal situations" (Morelli, at para. 105). This is particularly the case where, as here, the computer is used to browse the Web. Internet-connected devices "reveal our specific interests, likes, and propensities, recording in the browsing history and cache files the information we seek out and read, watch, or listen to on the Internet" (ibid.).



[48] This sort of private information falls at the very heart of the "biographical core" protected by s. 8 of the Charter.



[49] Like Morelli, this case involves highly revealing and meaningful information about an individual's personal life - a factor strongly indicative of a reasonable expectation of privacy. Unlike in Morelli, however, this case involves a work-issued laptop and not a personal computer found in a private residence.



[50] The Policy and Procedures Manual of the school board asserted ownership over not only the hardware, but also the data stored on it: "Information technology systems and all data and messages generated on or handled by board equipment are considered to be the property of [the board], and are not the property of users of the information technology".



[51] While the ownership of property is a relevant consideration, it is not determinative (R. v. Buhay, 2003 SCC 30, [2003] 1 S.C.R. 631, at para. 22). Nor should it carry undue weight within the contextual analysis. As Dickson J. (later C.J.) noted in Hunter v. Southam, at p. 158, there is "nothing in the language of [s. 8] to restrict it to the protection of property or to associate it with the law of trespass".



[52] The context in which personal information is placed on an employer-owned computer is nonetheless significant. The policies, practices, and customs of the workplace are relevant to the extent that they concern the use of computers by employees. These "operational realities" may diminish the expectation of privacy that reasonable employees might otherwise have in their personal information (O'Connor v. Ortega, 480 U.S. 709 (1987), at p. 717, per O'Connor J.).



[53] Even as modified by practice, however, written policies are not determinative of a person's reasonable expectation of privacy. Whatever the policies state, one must consider the totality of the circumstances in order to determine whether privacy is a reasonable expectation in the particular situation (R. v. Gomboc, 2010 SCC 55, [2010] 3 S.C.R. 211, at para. 34, per Deschamps J.).



[54] In this case, the operational realities of Mr. Cole's workplace weigh both for and against the existence of a reasonable expectation of privacy. For, because written policy and actual practice permitted Mr. Cole to use his work-issued laptop for personal purposes. Against, because both policy and technological reality deprived him of exclusive control over - and access to - the personal information he chose to record on it.



[55] As mentioned earlier, the Policy and Procedures Manual stated that the school board owned "all data and messages generated on or handled by board equipment". Moreover, the principal reminded teachers, annually, that the Acceptable Use Policy applied to them. This policy provided that "[t]eachers and administrators may monitor all student work and e-mail including material saved on laptop hard drives", and warned that "[u]sers should NOT assume that files stored on network servers or hard drives of individual computers will be private".



[56] Though Mr. Cole's laptop was equipped with a password, the contents of his hard drive were thus available to all other users and technicians with domain administration rights - at least when the computer was connected to the network. And even if the Acceptable Use Policy did not directly apply to teachers, as Mr. Cole maintains, he and other teachers were in fact put on notice that the privacy they might otherwise have expected in their files was limited by the operational realities of their workplace.



[57] The "totality of the circumstances" consists of many strands, and they pull in competing directions in this case. On balance, however, they support the objective reasonableness of Mr. Cole's subjective expectation of privacy.



[58] The nature of the information in issue heavily favours recognition of a constitutionally protected privacy interest. Mr. Cole's personal use of his work-issued laptop generated information that is meaningful, intimate, and organically connected to his biographical core. Pulling in the other direction, of course, are the ownership of the laptop by the school board, the workplace policies and practices, and the technology in place at the school. These considerations diminished Mr. Cole's privacy interest in his laptop, at least in comparison to the personal computer at issue in Morelli, but they did not eliminate it entirely.



VI



[59] As Mr. Cole had a reasonable expectation of privacy in his Internet browsing history and the informational content of his work-issued laptop, any non-consensual examination by the state was a "search"; and any taking, a "seizure".