The Supreme Court of Canada recently heard, and has reserved judgment in, Her Majesty the Queen v. Richard Cole.
Cole involved a teacher who had stored photographs of a young nude female on a laptop computer owned by his employer and issued to him. The photographs were discovered by the school's information technologist (during a routine check, the technologist had noticed a potentially dangerous hidden file that he believed might destabilize the school's network and investigated this further). The teacher subsequently surrendered the computer to the school principal upon request. The school then copied the photographs and an internet file onto a disc and provided the disc to the police, along with the laptop. Cole was charged with possession of child pornography. An issue arose as to whether the evidence was admissible in the criminal trial and this turned, in part, on whether Cole had a reasonable expectation of privacy in these records, given that teachers were expressly allowed to use the school's laptops for personal purposes.
The lower court found that Cole could indeed have some expectation of privacy in the circumstances, although the school's examination of his computer files was not itself found to be unreasonable in the circumstances.
While the Cole case is primarily focused on whether the police required a warrant to access and take custody of the records, the Canadian Association of Counsel to Employers intervened in the case, in order to make submissions regarding an employer's rights in relation to the intended function of a work computer and in maintaining and protecting the employer's information system, and an employer's legitimate interest and obligation to oversee its systems.
At the same time that the Cole decision is pending, the Massachusetts Superior Court has issued a decision in Falmouth Firefighters Union v. Town of Falmouth, finding that a Town employee (a firefighter) had no legitimate expectation of privacy in e-mails he sent or received on Google Gmail in circumstances where the Town purchased the domain names used for its employees' e-mail accounts. Although the Town of Falmouth did not save any e-mails on any computer, server, or disc, it was the administrator of the Gmail accounts. The Massachusetts Court accepted that the Gmail accounts were widely used by Town employees for personal communications as well as for work, but noted that the Town's email policy stated that the Town maintained the ability to access any messages on or transmitted over the email system and that "employees should not assume that such messages are confidential or that access by the employer will not occur." Accordingly, the Court found that the firefighter had no basis to sue his employer under the Massachusetts Privacy Act. The Supreme Court of British Columbia has recognized in Pacific Northwest Herb Corp. v. Thompson (1999) that the president of a company may have had a reasonable expectation of privacy in relation to documents he created on a company-owned computer for family or personal reasons, but that he was not entitled to interim injunctive relief restraining his former employer from retrieving or copying such records pending the outcome of his wrongful dismissal suit against the employer. The Court noted in this regard that the president was “the author of his own problems.” The Court took a different view, however, regarding communications between the president and his legal counsel which were stored on the employer's computer. The employer was not entitled to access these and the president had not waived privilege over such records, despite having stored them on his employer's computer.
It will be interesting to see what the Supreme Court of Canada has to say about an employer's rights in Cole.
In the meantime, the best approach for employers is to have a very clear, written technology use policy, to document the distribution of this policy to all employees and to use best efforts to avoid accessing any employee records which appear on their face to be entirely personal and/or covered by lawyer-client privilege, other than records which appear to present a risk to legitimate employer interests (such as the records involved in Cole).
Employers who are dealing with an unusual situation involving retrieval of employee email should seek specific legal counsel.