Reasonable Expectations of Privacy in the Computer Age: A Brief Review of Regina v. Ward 2012 ONCA 660 and Regina v. Cole 2012 S.C.C. 53
The decision of the Supreme Court of Canada in Regina v. Cole 2012 S.C.C. 53 issued October 19, 2012, and the decision of the Court of Appeal for Ontario in Regina v. Ward dated October 2, 2012 confirmed the expansive approach to the delineation of an individual’s right to be secure against unreasonable search or seizure guaranteed by s. 8 of the Canadian Charter of Rights and Freedoms ("the Charter"). In each instance, the court held that a reasonable expectation of privacy may exist in personal electronic data, even when that data has been shared, or is accessible to, other individuals, such as the employer as was the case in Regina v. Cole. In each instance the court engaged in a comprehensive analysis to determine whether, in the totality of the circumstances, the individual enjoyed a reasonable expectation of privacy in relation to the electronic data at issue. In Regina v. Cole, the Supreme Court of Canada held that a teacher had a reasonable expectation of privacy in relation to personal information stored on his work computer, but in Regina v. Ward, the Ontario Court of Appeal held that the individual did not have a reasonable expectation of privacy in his name and address which was provided to his Internet Service Provider.
R. v. Cole 2012 S.C.C. 53
In Regina v. Cole,1 the Supreme Court of Canada considered a charge of possession of child pornography laid against a teacher. The alleged child pornography was found on the teacher’s work computer by a school board technician performing maintenance on the computer. The computer technician discovered a hidden folder containing nude and partially nude photographs of an underage female student. The technician notified the school principal, who instructed him to copy the photographs, which were provided to the principal, and ultimately provided without a search warrant by the principal to the police.
School board policy provided that all data and messages generated or handled by board equipment were considered to be the property of the school board, but stipulated that teachers’ email correspondence remained private, but subject to access by school administrators if specified conditions were met.2 The school board’s policy manual allowed for incidental personal use of the board’s information technology, but warned that "users should not assume that files stored on network servers or hard-drives of individual computers will be private".3
While noting the fact that the analysis of the totality of the circumstances consisted of many strands which "pull in competing directions in this case"4 the majority of the Supreme Court concluded that Mr. Cole’s subjective expectation of privacy in the photographs stored in his work computer was objectively reasonable.5 The court noted that the nature of the information at issue was extremely private and "heavily favours recognition of a constitutionally protected privacy interest".6 Pulling in the other direction was the ownership of the laptop by the school board, the workplace policies and practices and the technology in place at the school. The court held that while these considerations diminished Mr. Cole’s privacy interest in his laptop (in comparison to his expectation of privacy in his personal computer) it did not eliminate it entirely.7
The court held that a third party (in this case the school board) could not waive Mr. Cole’s expectation of privacy in his computer, and that while the school officials undoubtedly had the right to seize the computer,8 for administrative purposes, once the principal had reasonable grounds to believe the computer contained a nude photograph of a student,9 this did not provide a lawful basis for the police to seize the computer from the school officials without a search warrant.10
The Supreme Court of Canada concluded that, what the school board should have done, was to have seized the computer, and inform the police of the discovery of illegal material on the laptop, which would have provided a basis for the police to have obtained a search warrant. As the court noted:
"… receipt of the computer from the school board did not afford the police warrantless access to the personal information contained within it. This information remained subject, at all relevant times, to Mr. Cole’s reasonable and subsisting expectation of privacy."11
And further, the court noted:
"The fact that the school board had acquired lawful possession of the laptop for its own administrative purposes did not vest in the police a delegated or derivative power to appropriate and search the computer for the purposes of a criminal investigation".12
In the end, the court allowed the illegally obtained evidence to be admitted in Mr. Cole’s trial on the basis that Mr. Cole had a diminished reasonable expectation of privacy in his workplace computer,13 and the police did not engage in egregious conduct in accepting the computer from the school board.14 The police had an honest, but mistaken, belief they were lawfully entitled to obtain it from the principal without a warrant, and, in any event, the police had reasonable and probable grounds to obtain a warrant in this case.15
The court concluded that the exclusion of the evidence would have a substantial negative impact on the truth-seeking function of the criminal trial process, and accordingly ruled that the evidence should not be excluded from Mr. Cole’s trial.16
What is significant in the decision for employers is the fact that it was the reality of permitted personal use of workplace computers which, fundamentally, resulted in Mr. Cole having a reasonable expectation of privacy in the personal material on his workplace computer.
The court was clear that while the permitted practice and written policies of the employer were important, neither was determinative in deciding whether a person had a reasonable expectation of privacy in the information placed on a workplace computer. As the court stated:
"Even as modified by practice, however, written policies are not determinative of a person’s reasonable expectation of privacy. Whatever the policy states, one must consider the totality of the circumstances in order to determine whether privacy is a reasonable expectation in the particular situation".17
R. v. Ward 2012 ONCA 660
In Regina v. Ward, the Court of Appeal considered an appeal from convictions for possession of, and accessing, child pornography. During the investigation, the police had obtained, without a search warrant, information from Bell Canada that identified the appellant as the person who had viewed a particular pornographic website at a particular point in time. As characterized by the Court of Appeal, the police sought from Bell Canada "information capable of putting the appellant at a specific place, at a specific time, in the course of his travels on the internet".18
The appellant challenged his conviction on the grounds that he had a reasonable expectation of privacy in the information provided by Bell Canada, that it was unlawfully obtained by the police in breach of s. 8 of the Charter, and that the evidence subsequently obtained based on that information should have been excluded at trial.
While the Court of Appeal ultimately held that the accused did not have a reasonable expectation of privacy in relation to this information, it engaged in an extremely thoughtful analysis of the extent, and limits on, the reasonable expectation of privacy of an individual in his or her ISP address, and in particular analyzed whether the fact that information was "public" necessarily eliminated any expectation of privacy a person may have in that information.
The court held that an individual may have a reasonable expectation of privacy, even when engaging in activities which are conducted in public. As Justice Doherty stated:
"Personal privacy is about more than secrecy and confidentiality. Privacy is about being left alone by the state and not being liable to be called to account for anything and everything one does, says, or thinks. Personal privacy protects an individual’s ability to function on a day to day basis within society while enjoying a degree of anonymity that is essential to the individual’s personal growth and the flourishing of an open and democratic society".19
The court noted that:
"While the public nature of the forum in which an activity occurs will affect the degree of privacy reasonably expected, the public nature of the forum does not eliminate all privacy claims."20
In its analysis, the Court of Appeal emphasized that simply sharing otherwise private information with other individuals does not necessarily mean that a person has forfeited a claim "that the state is excluded from the same zone of privacy".21 Similarly, as the court continued:
"Nor does allowing a state actor within a zone of personal privacy for a specified purpose, automatically foreclose a claim of privacy as against the state should it enter that same zone of privacy for another purpose. … [references omitted] On the purposive interpretation of s. 8, it is no answer to the appellant’s s. 8 claim to assert that because the appellant willingly surrendered the relevant information to Bell Sympatico, he assumed the risk that Bell Sympatico would share the information with the police."22
While noting the relevance of an agreement between the appellant and Bell Sympatico, which spoke both of "Bell Sympatico’s duty to protect the privacy of clients’ information, and its willingness to disclose to police information related to the alleged criminal misuse of its services"23 the court noted that "willing disclosure to third parties is not determinative of the existence of a legitimate privacy claim under s. 8".24
In the ultimate analysis, however, the court held that, while the appellant had a subjective expectation that his ISP address would remain private, Bell Sympatico had a legitimate interest in preventing its services from being utilized for the purpose of accessing child pornography,25 and applicable privacy legislation (PIPEDA) contemplated reasonable disclosure of a customer’s personal information. PIPEDA also gave Bell the discretion to disclose personal information to the police in the course of an investigation if the prerequisites of the disclosure provision were met.26
In this case, the requested information was specific and narrow, seeking only the name and address of the person who had accessed the pornographic website on a particular occasion.27
The contractual terms between the appellant and Bell Sympatico confirmed that Bell Sympatico had a duty to protect the confidentiality of a client’s information, but that it was permitted to disclose information in relation to investigations involving the alleged criminal misuse of its services.28 Furthermore, Bell Sympatico had an accepted use policy that made it clear that uploading or downloading child pornography was a breach of the accepted use policy and that Bell Sympatico would "offer full co-operation with law enforcement agencies in connection with any investigation arising from a breach of this accepted use policy".29
Ultimately, the detailed contextual analysis engaged in by the court concluded that:
"A reasonable and informed person would not expect that society should recognize that the appellant had a reasonable expectation of privacy in his subscriber information provided to Bell Sympatico".30
In Regina v. Cole, the Supreme Court of Canada has upheld a reasonable expectation by an employee in the privacy of personal information stored on his work computer. In the circumstances of that case, however, the evidence obtained from the workplace computer by the police without warrant was admitted in the employee’s trial, having regard to the diminished expectation of privacy held by the employee in the information, the good faith of the police, and the strong societal interest in the trial of the allegation of possession of child pornography on its merits.
In Regina v. Ward, the Ontario Court of Appeal has engaged in a scholarly analysis of the nature of the reasonable expectation of privacy guaranteed by s. 8 of the Charter, and held that it did not extend to the customer name and address provided to an Internet Service Provided in the particular circumstances of that case.
Nevertheless, the case is interesting in confirming that, depending upon the particular circumstances, a reasonable expectation of privacy may extend to personal information voluntarily disclosed to third parties, or to the conduct of an individual which, while engaged in publicly, is reasonably expected to remain anonymous in the particular circumstances of the case.
These cases confirm the broad and purposive interpretation of s. 8 of the Charter right to be secure against unreasonable search and seizure found in the jurisprudence of appellate courts in Canada.
1 2012 SCC 53
2 Ibid, at para. 16
3 Ibid, at para. 55
4 Ibid, at para. 57
5 Ibid, at para. 57
6 Ibid, at para. 58
7 Ibid, at para. 58
8 Ibid, at paras. 78-79
9 Ibid, at para. 62
10 Ibid, at para. 67
11 Ibid, at para. 73
12 Ibid, at para. 67
13 Ibid, at para. 92
14 Ibid, at para. 90
15 Ibid, at para. 93
16 Ibid, at para. 98
17 Ibid, at para. 53
18 R. v. Ward, 2012 ONCA 660, per Doherty, J.A. at para. 69
19 Ibid, at para. 71
20 Ibid, at para. 72
21 Ibid, at para. 77
22 Ibid, at para. 77
23 Ibid, at para. 107
24 Ibid, at para. 78
25 Ibid, at para. 97
26 Ibid, at para. 99
27 Ibid, at para. 101
28 Ibid, at para. 107
29 Ibid, at para. 107
30 Ibid, at para. 108