A recent Ontario Superior Court ruling may impact how employees use computers at work. In R. v. Cole, 2009 CanLII 20699 (ON S.C.) Justice Paul Kane overturned a trial level decision and found that Cole did not have a reasonable expectation of privacy when using a computer provided by his employer.
Mr. Cole was a teacher and network administrator at a Sudbury high school. In the course of his regular admin duties he came across nude photographs of a 16 year-old student which had been sent over the school’s network. Cole saved the photos to his laptop which had been provided by the school board. Later, a board computer technician found the files and reported him to the school, who in turn reported him to the police. The Greater Sudbury Police Service seized the computer (without a warrant) and bypassed his password security system before charging him with possession of child pornography.
The issue raised at appeal was whether Cole’s s. 8 Charter right against unreasonable search and seizure was violated. Justice Kane adapted the test from R. v. Edwards, [1996] 1 S.C.R. 128 to the context of a computer network. The test has two main branches which must be satisfied before a violation is found: Firstly, that there was an objectively reasonable expectation of privacy in the circumstances; and secondly, that the search and/or seizure was conducted in an unreasonable manner. Justice Kane failed Cole on the first branch of the test, finding that he had no reasonable expectation of privacy.
Justice Kane looked at contextual factors including Cole’s acceptance of a User Agreement that expressly indicated that computer files were not private and his knowledge that board technicians could easily access his computer. His exclusive possession of the laptop and the password protection were not sufficient to override other indicators of a lack of privacy. Justice Kane also held that by focussing unduly on the police’s involvement, the trial level decision erroneously ignored other contextual factors relevant under the Edwards test.
This case comes in the wake of other recent decisions which have grappled with the reasonable expectation of privacy, particularly with respect to computers. In another recent unreported (but widely covered) decision R. v. Wilson (10 February 2009), St. Thomas 4191/08 (O.S.C.J.) the Court found that there was no expectation of privacy for internet service provider subscriber information. Similarly, in R. v. Kwok, [2008] O.J. No. 2414 the Court found that there was no expectation of privacy for IP addresses, nor are service providers prohibited from sharing subscriber information with police.
The impact of Cole may be that users of company computers (and possibly other devices like mobile phones) have less of a reasonable expectation of privacy than private computer users. As a result, users on company networks with company property may find themselves exposed to search and seizure without warrant.