It is a question that employment lawyers are asked all the time: can an organization monitor or search the personal emails sent by its employees? The answer, as is often the case, is that it depends. In this context, the issue is the expectation of privacy that the employee reasonably has. In a recent case (Saskatchewan Government and General Employees Union v Unifor Local 481, 2015 CanLII 28482 (SK LA)), a labour arbitrator in Saskatchewan refused to allow an employer to rely upon email correspondence between an employee and his wife which clearly demonstrated that the employee had lied about being a member of a biker gang. The arbitrator found that the employee had a reasonable expectation of privacy in relation to those email messages.
Notably, the employee in question was employed as a Labour Relations Officer and assigned to represent employees in correctional services. In order to carry out is duties, he was required to attend various prisons throughout the province.
The Employer had an Information Technology and Acceptable Use Policy which stated that employees…
Interestingly, the Policy also states that “Personal incidental use of the network office is not explicitly denied nor explicitly approved.”
Personal emails revealed bike gang activities
In January 2015, the employer was notified that the Grievor had been involved in a bar fight while apparently wearing clothing indicating he was a member of a biker gang. When confronted, the grievor admitted that he had been affiliated with the Saints and Sinners motorcycle gang in the past but had not been involved with them, or any other gang, for at least two years.
The employer, not entirely satisfied with the explanation, went on to review the grievor’s work email account and found thousands of deleted emails between the grievor and his wife. The employer determined that the content of these emails, which included photos, contradicted the grievor’s statements that he was not part of a motorcycle gang. As a result, he was dismissed.
Was the employer’s email search warranted?
The Union took the position that the email search was an unwarranted breach of the grievor’s privacy since they were personal emails between him and his wife. In support of its position, the Union relied upon the Supreme Court of Canada’s decision in R. v. Cole.
In Cole, the employer school had provided the employee with a laptop to use in teaching communication technology and in supervising a laptop program for students. He was responsible for “policing” student use of laptops, but during routine maintenance, one of the school’s computer technicians found nude images of a grade 10 student on the hard drive. The principal directed the technician to copy the images and the Internet files from Cole’s web surfing history. The copies and the laptop were turned over to the police, who searched them without a warrant. Mr. Cole was charged criminally, and the primary issue became whether there had been an unlawful search which would render the images inadmissible as evidence.
Ultimately, the Supreme Court of Canada found Mr. Cole had some limited expectation of privacy and that section 8 had been breached by the warrantless search (although the Court allowed the images to be admitted into evidence nonetheless).
Some of the more relevant portions of the Supreme Court’s decision included:
- The Court left no doubt in R. v. Morelli… that Canadians may reasonably expect privacy in the information contained on their own personal computers. In my view, the same applies to information on work computers, at least where personal use is permitted or reasonably expected.
- While workplace policies and practices may diminish an individual’s expectation of privacy in a work computer, these sorts of operational realities do not in themselves remove the expectation entirely…
- [Cole] expected a measure of privacy in his personal information on the laptop. Even taking into account the relevant workplace policies, this expectation of privacy was reasonable in the circumstances. It was, however, a diminished expectation of privacy in comparison with the privacy interest considered in Morelli ― which, unlike this case, involved a personal computer that belonged to Mr. Morelli and was searched and seized in his home.
- The lawful authority of his employer — a school board — to seize and search the laptop did not furnish the police with the same power.
- Whether Mr. Cole had a reasonable expectation of privacy depends on the “totality of the circumstances”. The “totality of the circumstances” test is one of substance, not of form. Four lines of inquiry guide the application of the test: (1) an examination of the subject matter of the alleged search; (2) a determination as to whether the claimant had a direct interest in the subject matter; (3) an inquiry into whether the claimant had a subjective expectation of privacy in the subject matter; and (4) an assessment as to whether this subjective expectation of privacy was objectively reasonable, having regard to the totality of the circumstances.
- Computers that are used for personal purposes, regardless of where they are found or to whom they belong, “contain the details of our financial, medical, and personal situations”.
- While the ownership of property is a relevant consideration, it is not determinative.
- Even as modified by practice, however, written policies are not determinative of a person’s reasonable expectation of privacy.
Employees’ expectation of privacy
While the decision in Cole confirms the employee’s expectation of privacy, albeit a diminished one, the entire decision must be read in context: a criminal proceeding considering the protections afforded against the unlawful intrusion of the state. Specifically, the analysis was not whether the employer had the right to review the contents of the laptop, but whether the police had such a right and, ultimately, whether their findings could be as evidence in the criminal prosecution. The analysis was based upon the impact of section 8 of Charter of Rights and Freedoms.
As a result, the opinion I have consistently expressed is that Cole did not change the rights of employers, but had the potential to. And the court’s conclusions do suggest that an employee may have an expectation of privacy with respect to personal information even if:
- It is stored on company-owned equipment;
- There are policies in place confirming that the employer owns the equipment and all information stored on it; and
- There are policies in place warning that employees should have no expectation of privacy.
Given that the issue to be decided by the Court was whether Cole’s section 8 rights had been breached, my view remains that this decision was not intended to impact employment law principles directly. As Mr. Justice Fish wrote for the Court: “I leave for another day the finer points of an employer’s right to monitor computers issued to employees.”
That said, the Cole decision has been considered in some recent employment law cases and it seems that an employer’s right to search its own equipment may not be as strong as many of us have previously thought.
Like the Supreme Court in Cole, the arbitrator in the case described above found that the IT policy did not entirely remove the grievor’s privacy rights. The policy did not preclude personal use, and the arbitrator acknowledged the societal reality that there isn’t always a clear distinction between working time and personal time, recognizing that employees will sometimes use employer-provided equipment for personal purposes.
As a result of this and, in all likelihood, the fact that the communications in question were between spouses, the arbitrator found that the grievor had a reasonable expectation of privacy in the personal emails sent through his work computer.
Search of employee’s email unreasonable, despite clear policy
The next step in the analysis was for the arbitrator to determine whether the Employer’s search was reasonable. While he recognized that there was a genuine and legitimate concern on the part of the Employer regarding the allegations that the grievor was a member of a biker gang, the arbitrator held that “the search of emails to and from his spouse was not reasonable at the time it was carried out.” The arbitrator concluded that the Employer should have relied upon less invasive means of investigation first and that reviewing emails between the grievor and his spouse should have been a last resort.
This decision is troubling in some ways, as it suggests that employers do not have unlimited rights to search their own equipment, even when they have clear policies, communicated to their employees, establishing that they should not have any expectation of privacy. Despite that, the arbitrator found there was some degree of an expectation of privacy.
Conclusion
I continue to recommend that employers implement and enforce clearly worded policies that warn employees not to expect that any information stored on corporate equipment is private. They should consider whether to authorize personal use at all, and they should monitor usage. As someone once said recently, employers should make it clear to employees that “if you don’t want us to see it, don’t put it on our equipment”. I often put wording that simple and clear in policies I draft.
I also recommend that employers be cautious about searching employee’s personal email and make sure that they can justify doing so, to avoid a result such as this one.
At the same time, I always encourage employees to refrain from sending or receiving any communications using their employer’s technology if they would not want their employer to see it. Those who insist on using corporate email accounts, or employer-owned computers or devices, to send personal information do so at their own peril.
- When is failure to attend work job abandonment? - September 6, 2024
- $10,000 in punitive damages awarded for breach of ESA and employer’s reprehensible conduct - August 2, 2024
- Court decision on termination clause and punitive damages award - July 5, 2024
