Law Times

Law Times • January 23, 2012 FOCUS ON Privacy Law What are employers' privacy duties? Commissioner releases guidelines as questions arise after decision BY MICHAEL McKIERNAN Law Times privacy in material on his work computer. In R. v. Cole, the appeal court excluded evidence E obtained in a warrantless police search of a work- issued laptop after finding the employee had a reasonable expectation of privacy over its contents. In October, the Supreme Court agreed to hear a Crown appeal in the case, which involves a high school teacher facing child pornography charges. "I think the Cole case created a lot of confu- mployment lawyers are looking to the Supreme Court of Canada for guidance after the Ontario Court of Appeal rec- ognized an employee's limited right to for employers to recognize some sort of privacy expectation. Unless we see clear legal direction that preserves a full right of access for employers, we could see them going back to policies that we saw 15 years ago where they were really saying if you want to do personal stuff, use your own device. Employers' systems are designed for doing business, and they can't be getting into fights with employees every time they need to take a look at what is happening in the business." Still, Anne Muter, an employment lawyer sion," says Stuart Rudner, an employment lawyer with Miller Thomson LLP in Markham, Ont. "It raised a concern that there was a shift in the law, but I think it has to be read in context, which was a criminal prosecution with potential imprisonment, which is quite different than the question of whether an employer can monitor the employee's use of their own equipment within the context of the employment relationship. It would be nice if the Supreme Court would take a paragraph and comment how this all impacts on the employee and employer relationship." Richard Cole ran into trouble when a school computer 'I think the Cole case created a lot of confusion,' says Stuart Rudner. browsing history and the entire contents of its hard drive, to be intrusive. "The contents of the hard drive of a laptop may contain extremely personal information such as medical and finan- cial reports, personal journals, e-mails, and appointments," she wrote. Dan Michaluk, a privacy lawyer at Hicks Morley technician found naked pictures of a Grade 10 student on his laptop during a virus scan. The matter reached the school board, which conducted its own search before handing over the laptop to police. Writing on behalf of the unanimous three-judge panel, then-appeal court justice Andromache Karakatsanis found that there was no clear policy on monitoring of school lap- tops but that teachers had explicit permission to use them for personal reasons. As well, she found that many teachers stored personal information on them. "I conclude, therefore, that the appellant had a reasonable expectation of privacy in the information stored in the hard drive of his laptop, which was subject to the limited right of access by his employer's technicians performing work- related functions," she wrote. While Karakatsanis found the school board's search was reasonable in the circumstances, she deemed the actions by police, which included copying the computer's Internet Hamilton Stewart Storie LLP in Toronto, worries that the decision defines the school board's right of access to its own equipment too narrowly. "I think most employers would hope when the Supreme Court of Canada deals with it that if they recognize any expectation of privacy at all, they frame the employer's right of access as fairly broad and certainly much broader than framed by the Court of Appeal," he says. Rudner says the peculiar fact situation and the added complication of the criminal charges in the Cole case may limit its application in employment matters. "Realistically, I don't think it has changed an employer's right to monitor employee usage of company equipment and the Internet and I don't think it has changed their right to search their own property." But Michaluk says employers may feel compelled to resort to more restrictive policies unless the courts bring cer- tainty to the issue. "We're all using our work systems now for personal use, and there seems to be so much pressure now at Vancouver firm Boughton Law Corp., says employers can bring some measure of certainty themselves by instituting clear policies on the use of their equipment. "If employers want access, they have to make sure the employees know there isn't an expectation of privacy and manage that expectation. Make it clear and express it on a regular basis so that the expectation doesn't arise. That's a particular chal- lenge for employers that haven't been thinking about it. If they've let people use the Internet and laptops for personal use for the last 10 years or it's generally understood that it's acceptable, then I think those employees can make a case that they're operating with a reasonable expectation of privacy." Muter highlights a recent B.C. case involving the Fraser Health Authority in which a 10-year employee was termi- nated for excessive use of the Internet at work. The employee grieved the firing and the union attempted to exclude an Internet log report, produced from data pulled from the company server, on the basis that it violated the provincial Freedom of Information and Protection of Privacy Act. But the arbitrator found no violation and admitted the report, noting that the employer had a clear policy that emphasized its ownership of the company computers and any data on them. Another Internet-related privacy risk to employers comes before they even start an employment relationship with some people. Late last year, the B.C. Office of the Information and Privacy Commissioner released guide- lines on social media background checks for prospective employees. The guidelines recognize that social media searches are enticing "because they are faster and simpler than other See Employers, page 13 PAGE 9 BY MICHAEL McKIERNAN Law Times control of a university under the province's Freedom of Information and Protection of Privacy Act, according to a recent decision issued by her office. Universities have been subject to the leg- T islation since 2006 and in a Nov. 7, 2011, decision, adjudicator Diane Smith found an arbitrator had strayed into her territory during a labour dispute over a freedom-of- information request. "Applying the two-part test in Weber, it is clear that the legislature intended that issues arising from requests and appeals under the act be determined by the head, he information and privacy com- missioner for Ontario has exclu- sive jurisdiction to decide wheth- er records are in the custody or and on appeal, by the commissioner, and not by a labour arbitrator," wrote Smith, who added that "bearing in mind that the arbitrator's authority only arises under the collective agreement, an instrument that is not determinative of the issue of custody or control, I find that, in the con- text of an access to information request made under the act, the commissioner has the exclusive jurisdiction to deter- mine this issue." The requester had demanded all records, written or electronic, that men- tioned him, including communications written or received by professors at the University of Ottawa. But when the university asked its pro- fessors to turn over potentially responsive records, the faculty union, the Association of Professors of the University of Ottawa, filed a grievance claiming its members' materials weren't in the control or under the custody of the university and that the request may impinge on academic free- dom, a unique factor that distinguishes the employer-employee relationship in such cases. Arbitrator Philip Chodos sided with the association in finding the university's request had violated the collective agree- ment. In a later award, he accepted a union suggestion on which records held by pro- fessors were in the university's control. The university then refused the freedom-of- information request, citing Chodos' award and the fact that it had received no respon- sive records. That prompted the requester to appeal to the privacy commissioner's office, where Smith heard the case. She found Chodos had "taken an overly restrictive approach to custody and control." In any case, she wrote, "in the circumstances www.lawtimesnews.com of this appeal, it is this office, rather than the arbitrator, that has the exclusive jurisdiction to make this determination." Smith went on to lay out the criteria as to which records held by professors should be considered to be in the custody or control of the university: 1. Records or portions of them in the possession of an association member that deal with personal matters or activities that are wholly unrelated to the university's mandate aren't in its custody or control. 2. Records relating to teaching or research are likely to be impacted by academic freedom and would only be in the uni- versity's custody or control if they'd be accessible to it by custom or practice. 3. Administrative records are prima facie in the university's custody and control See Ruling, page 13 Cole Case pits disclosure against academic freedom

• Cover