Expectations of privacy must be considered when reading e-mails
Question: To what extent can an employer with no e-mail policy read an employee’s e-mails that are not addressed to it but contain content regarding the employee’s poor opinion on practices within the company? Can the e-mails be used as evidence of insubordination justifying discipline?
Answer: Perhaps the key legal response in the Canadian privacy law landscape is “balance.” The federal Privacy Commissioner said “an employer’s need for information should be balanced with an employee’s right to privacy.”
This direction has clearly been reflected in the federal Personal Information Protection and Electronic Documents Act (PIPEDA), which came into effect in May 2000, and relevant case law from before and after it came into force. The key question is whether, in all of the circumstances, the employee’s e-mail communication should be subject to a reasonable expectation of privacy on the part of the employee.
PIPEDA
For employers who are federally regulated, PIPEDA functions to place limitations on the employer’s right to simply intercept and review employees’ e-mail communications. The act stipulates an employer may collect, use or disclose personal information only for purposes a reasonable person would consider appropriate under the circumstances. Thus, if an employer were to be challenged on the issue of surveillance it would have to provide clear evidence of a situation that reasonably required use of it. Likewise, if an employer were to find itself in a situation where it wanted to use an employee’s e-mail as evidence against the employee for insubordination, the employer would have to demonstrate use of the information from the e-mail was reasonably justified.
PIPEDA reflects the balancing of competing interests that is evident from the case law. In R v. Weir, an Alberta case involving child pornography and privacy issues, the court concluded electronic mail ought to carry with it a reasonable expectation of privacy under the Canadian Charter of Rights and Freedoms. In 1999, the British Columbia Supreme Court built on Weir with its decision in Pacific Northwest Herb Corp. v. Thompson, where the court looked at whether an employee has a reasonable expectation of privacy with regards to his workplace computer use. The employee used a company computer at home for work and personal use and after being dismissed he continued to use the computer in preparing materials for a wrongful dismissal action against his employer. Despite the employee’s attempts to erase the files, the employer was able to retrieve them. Ultimately, however, the employee was successful in convincing the court a reasonable expectation of privacy existed over those files which he had attempted to erase, as they were “personal.”
Reasonable expectation of privacy
While Pacific Northwest helps secure some ground for the protection of an employee’s reasonable expectation of privacy, other cases have defined “reasonable” such that employers have been afforded the right to monitor e-mail and Internet activity. In International Association of Bridge and Structural and Ornamental Ironworkers, Local Union No. 97 and Office and Technical Employee’s Union, Local 15, the arbitrator concluded an employer had not violated an employee’s privacy when it salvaged personal files from her computer. Despite the fact many of the documents were password-protected, the employer was found to be justified in retrieving them when it was revealed most of the documents were saved during working hours.
In cases like International, adjudicators have been willing to hold that employees should not expect privacy in relation to their workplace e-mail communications which are delivered and received using the employer’s equipment and Internet connection. The balance has tilted in favour of the employer’s right to monitor and control the inappropriate use of its computer system.
Workplace policies
It should be noted in circumstances involving workplace policies the concept of reasonable expectation of privacy is viewed very differently. In Milsom v. Corporate Computers Inc., the Alberta Court of Queen’s Bench determined an employee has no reasonable expectation of privacy with respect to e-mails sent and received on an employer’s computer, even in the absence of a corporate policy to the contrary.
Four-step approach
Ultimately, it appears employers have the right to monitor e-mail and Internet use but only where the circumstances call for such measures. In a recent case from the Federal Court, Eastmond v. Canadian Pacific Railway, a four-step approach was formulated to assess whether monitoring of workplace e-mail communications is reasonable. The court found, at minimum, an employer should be able to demonstrate reasonableness if:
•the e-mail monitoring is necessary to meet a specific need;
•the monitoring is likely to be effective in meeting that need;
•the loss of privacy is proportional to the benefit gained; and
•there is no alternate and less invasive way of achieving the same end.
The best circumstance for the employer is to have a policy that explicitly communicates to employees that workplace e-mail communications are not subject to any reasonable expectation of privacy. Having such a policy essentially removes any doubt from that question. In the absence of a policy, there is the possibility an adjudicator would consider the employee’s expectation of private communications in relation to her e-mails could be reasonable. There is, therefore, a risk that an employer who intercepts such communications could be seen to have violated an employee’s privacy.
It is also worth noting the Criminal Code makes it an offence to “willfully intercept a private communication” by means of any electromagnetic, acoustic, mechanical or other device. In at least one case from Alberta, a court has held e-mail messages are potentially included within the scope of this section of the Criminal Code. In the Alberta case, the court concluded although workplace e-mail should be accorded some privacy protection, it is not the same as other means of private communications such as a traditional first-class letter.
In the absence of a workplace policy that clearly stipulates employee e-mails should not be subject to a reasonable expectation of privacy, there is some risk an employer will be violating privacy rights if it intercepts such communications. Even so, adjudicators have been willing to view workplace communications as having less of a basis for a reasonable expectation of privacy. This is particularly so where the employer provides the equipment and Internet hookup, the communications take place in the workplace and the employee is aware the employer regularly accesses workplace computer systems for maintenance, repairs and upgrades.
Finally, it should be borne in mind not every critical communication by an employee concerning the employer will be considered to be insubordinate.
The term “insubordination” has been defined in Black’s Law Dictionary as “a willful disregard of an employer’s instructions, an act of disobedience to proper authority, a refusal to obey an order that a superior officer is authorized to give.” There must be some element of flouting or challenge to the employer’s legitimate authority. Simply complaining to a co-worker, for example, about the employer’s policies may not amount to insubordination.
Employers should be cautious about intercepting an employee’s e-mail communications, particularly in the absence of an e-mail policy that clearly states there is no reasonable expectation of privacy in relation to workplace e-mails. In the absence of a policy, it is necessary to examine all of the circumstances of the communication to assess whether or not there would be a reasonable expectation of privacy in relation to the communication that has been intercepted. Finally, such e-mails may not amount to insubordination if they don’t present a real challenge to the employer’s legitimate authority.
For more information see:
•R v. Weir, 1998 CarswellAlta 151 (Alta.Q.B.).
•Pacific Northwest Herb Corp. v. Thompson, 1999 CarswellBC 2738 (B.C. S.C.).
•International Association of Bridge and Structural and Ornamental Ironworkers, Local Union No. 97, and Office and Technical Employee’s Union, Local 15, [1997] B.C.C.A.A.A. No. 630.
•Milsom v. Corporate Computers Inc., 2003 CarswellAlta 599 (Alta. Q.B.).
•Eastmond v. Canadian Pacific Railway, 2004 CarswellNat 1842 (F.C.).
Brian Kenny is a partner with MacPherson Leslie and Tyerman LLP in Regina. He can be reached at (306) 347-8421 or [email protected].
From the archives
Brian Kenny looked at the topic of monitoring employee computer use and the need to formally notify employees of this practice in his Ask and Expert column in the March 28, 2007, issue of Canadian Employment Law Today.
In the June 20, 2007, issue of Canadian Employment Law Today, employment lawyer Helen Gray discussed guidelines for employers when dealing with employee personal information and privacy, including the monitoring of e-mail and Internet usage in the workplace.
Answer: Perhaps the key legal response in the Canadian privacy law landscape is “balance.” The federal Privacy Commissioner said “an employer’s need for information should be balanced with an employee’s right to privacy.”
This direction has clearly been reflected in the federal Personal Information Protection and Electronic Documents Act (PIPEDA), which came into effect in May 2000, and relevant case law from before and after it came into force. The key question is whether, in all of the circumstances, the employee’s e-mail communication should be subject to a reasonable expectation of privacy on the part of the employee.
PIPEDA
For employers who are federally regulated, PIPEDA functions to place limitations on the employer’s right to simply intercept and review employees’ e-mail communications. The act stipulates an employer may collect, use or disclose personal information only for purposes a reasonable person would consider appropriate under the circumstances. Thus, if an employer were to be challenged on the issue of surveillance it would have to provide clear evidence of a situation that reasonably required use of it. Likewise, if an employer were to find itself in a situation where it wanted to use an employee’s e-mail as evidence against the employee for insubordination, the employer would have to demonstrate use of the information from the e-mail was reasonably justified.
PIPEDA reflects the balancing of competing interests that is evident from the case law. In R v. Weir, an Alberta case involving child pornography and privacy issues, the court concluded electronic mail ought to carry with it a reasonable expectation of privacy under the Canadian Charter of Rights and Freedoms. In 1999, the British Columbia Supreme Court built on Weir with its decision in Pacific Northwest Herb Corp. v. Thompson, where the court looked at whether an employee has a reasonable expectation of privacy with regards to his workplace computer use. The employee used a company computer at home for work and personal use and after being dismissed he continued to use the computer in preparing materials for a wrongful dismissal action against his employer. Despite the employee’s attempts to erase the files, the employer was able to retrieve them. Ultimately, however, the employee was successful in convincing the court a reasonable expectation of privacy existed over those files which he had attempted to erase, as they were “personal.”
Reasonable expectation of privacy
While Pacific Northwest helps secure some ground for the protection of an employee’s reasonable expectation of privacy, other cases have defined “reasonable” such that employers have been afforded the right to monitor e-mail and Internet activity. In International Association of Bridge and Structural and Ornamental Ironworkers, Local Union No. 97 and Office and Technical Employee’s Union, Local 15, the arbitrator concluded an employer had not violated an employee’s privacy when it salvaged personal files from her computer. Despite the fact many of the documents were password-protected, the employer was found to be justified in retrieving them when it was revealed most of the documents were saved during working hours.
In cases like International, adjudicators have been willing to hold that employees should not expect privacy in relation to their workplace e-mail communications which are delivered and received using the employer’s equipment and Internet connection. The balance has tilted in favour of the employer’s right to monitor and control the inappropriate use of its computer system.
Workplace policies
It should be noted in circumstances involving workplace policies the concept of reasonable expectation of privacy is viewed very differently. In Milsom v. Corporate Computers Inc., the Alberta Court of Queen’s Bench determined an employee has no reasonable expectation of privacy with respect to e-mails sent and received on an employer’s computer, even in the absence of a corporate policy to the contrary.
Four-step approach
Ultimately, it appears employers have the right to monitor e-mail and Internet use but only where the circumstances call for such measures. In a recent case from the Federal Court, Eastmond v. Canadian Pacific Railway, a four-step approach was formulated to assess whether monitoring of workplace e-mail communications is reasonable. The court found, at minimum, an employer should be able to demonstrate reasonableness if:
•the e-mail monitoring is necessary to meet a specific need;
•the monitoring is likely to be effective in meeting that need;
•the loss of privacy is proportional to the benefit gained; and
•there is no alternate and less invasive way of achieving the same end.
The best circumstance for the employer is to have a policy that explicitly communicates to employees that workplace e-mail communications are not subject to any reasonable expectation of privacy. Having such a policy essentially removes any doubt from that question. In the absence of a policy, there is the possibility an adjudicator would consider the employee’s expectation of private communications in relation to her e-mails could be reasonable. There is, therefore, a risk that an employer who intercepts such communications could be seen to have violated an employee’s privacy.
It is also worth noting the Criminal Code makes it an offence to “willfully intercept a private communication” by means of any electromagnetic, acoustic, mechanical or other device. In at least one case from Alberta, a court has held e-mail messages are potentially included within the scope of this section of the Criminal Code. In the Alberta case, the court concluded although workplace e-mail should be accorded some privacy protection, it is not the same as other means of private communications such as a traditional first-class letter.
In the absence of a workplace policy that clearly stipulates employee e-mails should not be subject to a reasonable expectation of privacy, there is some risk an employer will be violating privacy rights if it intercepts such communications. Even so, adjudicators have been willing to view workplace communications as having less of a basis for a reasonable expectation of privacy. This is particularly so where the employer provides the equipment and Internet hookup, the communications take place in the workplace and the employee is aware the employer regularly accesses workplace computer systems for maintenance, repairs and upgrades.
Finally, it should be borne in mind not every critical communication by an employee concerning the employer will be considered to be insubordinate.
The term “insubordination” has been defined in Black’s Law Dictionary as “a willful disregard of an employer’s instructions, an act of disobedience to proper authority, a refusal to obey an order that a superior officer is authorized to give.” There must be some element of flouting or challenge to the employer’s legitimate authority. Simply complaining to a co-worker, for example, about the employer’s policies may not amount to insubordination.
Employers should be cautious about intercepting an employee’s e-mail communications, particularly in the absence of an e-mail policy that clearly states there is no reasonable expectation of privacy in relation to workplace e-mails. In the absence of a policy, it is necessary to examine all of the circumstances of the communication to assess whether or not there would be a reasonable expectation of privacy in relation to the communication that has been intercepted. Finally, such e-mails may not amount to insubordination if they don’t present a real challenge to the employer’s legitimate authority.
For more information see:
•R v. Weir, 1998 CarswellAlta 151 (Alta.Q.B.).
•Pacific Northwest Herb Corp. v. Thompson, 1999 CarswellBC 2738 (B.C. S.C.).
•International Association of Bridge and Structural and Ornamental Ironworkers, Local Union No. 97, and Office and Technical Employee’s Union, Local 15, [1997] B.C.C.A.A.A. No. 630.
•Milsom v. Corporate Computers Inc., 2003 CarswellAlta 599 (Alta. Q.B.).
•Eastmond v. Canadian Pacific Railway, 2004 CarswellNat 1842 (F.C.).
Brian Kenny is a partner with MacPherson Leslie and Tyerman LLP in Regina. He can be reached at (306) 347-8421 or [email protected].
From the archives
Brian Kenny looked at the topic of monitoring employee computer use and the need to formally notify employees of this practice in his Ask and Expert column in the March 28, 2007, issue of Canadian Employment Law Today.
In the June 20, 2007, issue of Canadian Employment Law Today, employment lawyer Helen Gray discussed guidelines for employers when dealing with employee personal information and privacy, including the monitoring of e-mail and Internet usage in the workplace.
