Workplace Computers And Electronic Devices: Protecting Confidential Information And Preserving Evidence - Part Two

Part Two: We've secured the evidence but can we look at it? If you have not read part one of this four part series, see the June issue of BLG's L&E News.

Having taken appropriate measures to protect your confidential information and secure the evidence showing that an employee may have unlawfully copied, transferred or destroyed your company information and now that you have this evidence in hand (in the form of a laptop, a hard drive, a smartphone, a USB key or any other type of storage device), you ask yourself a very important question: am I allowed to look at and use whatever information or data I have found on my employee's workplace device?

You might be tempted to answer "yes, it's the company's device, we can do what we want with it!" After all, the company paid for the device, it paid for the internet connection data service, it paid the employee while he or she was using the device, so why can't the company look at and use any information it finds on an employee's workplace device?

The answer is not so simple because employees have a "reasonable expectation of privacy" in the workplace.

In its October 2012 decision in R. v. Cole,1 the Supreme Court of Canada clearly stated that "Canadians may reasonably expect privacy in the information contained on [...] work computers, at least where personal use is permitted or reasonably expected". Given that "computers that are reasonably used for personal purposes — whether found in the workplace or the home — contain information that is meaningful, intimate, and touching on the user' s biographical core", the SCC took the position that everyone can expect privacy in personal information of this kind. That being said, with respect to a workplace computer, there will be a "diminished expectation of privacy" when compared to a personal computer used at home.

It is important to note that the decision in R. v. Cole concerns a criminal matter which brought into play the Charter of Rights and Freedoms, which does not apply to private sector employers. However, the principles articulated in this decision have been imported into the labour and employment law context, both before civil courts and in grievance arbitrations, in many provinces across the country.

What does this mean from a practical perspective? First, before engaging in a process of searching for or analyzing information on an employee's workplace device (computer, smartphone, etc.), the employer should have reasonable grounds to do so...