Legal Commentary

Don’t expect privacy on work computers

By David Canton

For the London Free Press - June 8, 2009

Read this on Canoe

Do you have a reasonable expectation of privacy when using an employer-owned computer?

That was the issue before the Superior Court of Justice on March 12 in Regina vs. Cole.

According to the facts of the case, a school information technologist found nude photos of a 16-year-old Grade 10 student on the defendant’s computer.

The defendant, a teacher at the school, had put the photos on a school-owned laptop computer he used. He apparently obtained the photos by getting access to a student’s e-mail account. The student had sent the photos of herself to a friend.

The teacher was charged with possession of child pornography and with fraudulently obtaining data from the student’s hard drive.

The school board’s “acceptable use” policy stated, in part:

“Information technology systems and all data and messages generated on or handled by board equipment are considered to be the property of (the) school board, . . . not the property of users of the information technology . . .

“School board information technology generally must be used only for business activities. Incidental personal use is permissible so long as (i) it does not consume more than a trivial amount of resources, (ii) it does not interfere with staff productivity, (iii) it does not pre-empt any business activity.

“Inappropriate content — Users may not post, access or attempt to access material that is inappropriate for a school or administrative office environment, such as (but not limited to) offensive, sexually explicit, obscene, profane, inflammatory, or degrading materials.”

The defendant argued his right to be protected from unreasonable search or seizure was breached when the information was retrieved from the computer.

The court held that once the defendant accepted the use policy, he had no privacy interest in the school-owned computers.

The court stressed four points:

- By accepting the Acceptable Use Agreement, the defendant knew data on the computer was not private.

- As a supervisor of the school’s computer system, the defendant knew the data were accessible by the school.

- Because of those points, the defendant’s computer password was not an indicator of privacy.

- The defendant knew the computer and its software were owned by the school.

This is not a surprising result and follows conventional wisdom. While this was a criminal case, similar reasoning would probably apply to civil matters.

The case points out that from an employer perspective, it is very useful to have proper policies in place for employee use of equipment. The best approach is a policy that covers acceptable use of work-related technology.

From an employee perspective, one should keep in mind that employer-provided computers are work tools. It’s not a good idea to use them for anything that the employer or the law might take issue with, or anything you don’t want others at work to see.

Full post as published by eLegal Canton on June 08, 2009 (boomark / email).