Nelligan O'Brien Payne gratefully acknowledges the contribution of Suzanne Dunn, Student-at-Law in writing this blog post.
In this world of constant online connection, it is typical for employees to communicate with their spouses during work hours, especially on their work email systems. But if the workplace has a clear policy stating that employees have no expectation of privacy when using their employer’s email system, can they still expect their personal emails to be private?
It turns out they can.
In a 2015 decision, Saskatchewan Government and General Employees Union v Unifor Local 481, a Saskatchewan arbitrator held that employees have an expectation of privacy when they are communicating with their spouses, even if that communication is happening through a workplace email system.
This was true despite a workplace policy that stated the following:
Employees of the [workplace] should not expect that their communications or use of the [workplace] office network system is either confidential or private. The employer retains the right to access and review the contents of all files stored, copied or sent through the office network system.
The right to privacy continued to be true even though the employer had a justified reason to investigate the employee’s possible criminal conduct.
In this case, the employer was investigating whether an employee who had access to provincial correctional facilities was affiliated with a criminal biker gang. When the employer was alerted to the concern, it immediately accessed the employee’s emails, including personal emails between him and his spouse, in which it found photographic evidence of the employee’s alleged involvement in the biker gang. The employee was thereafter terminated for his alleged affiliation.
When deciding on the admissibility of the evidence, the arbitrator held that the employee’s expectation of privacy had been violated, and he found the personal emails inadmissible.
The arbitrator relied heavily on the 2012 Supreme Court case of R v Cole in making his decision. In Cole, the Court determined that employees have an expectation of privacy on their employer-owned computers. This is particularly true if the information is meaningful, intimate and organically connected to the biographical core of the user. Cole involved a police search of an employee’s computer, not an employer search, but the principles of Cole were found to apply nonetheless.
As a result of Cole, the arbitrator ruled that the email search for evidence of the employee’s gang affiliation was unreasonable. The employee’s privacy was therefore found to have been violated for the following reasons:
- The workplace did not explicitly forbid personal use of the email system. Personal use was allowed as long as it did not interfere with the employee’s work or contain prohibited material.
- Written policies are not determinative of a person’s reasonable expectation of privacy. The workplace policy diminished the employee’s privacy interest, but it did not extinguish it.
- Communication between spouses is considered highly personal information connected to the employee’s biographical core, and therefore merits a high expectation of privacy, regardless of content.
- The emails had been deleted or moved into the trash, signalling they were not intended to be read by others.
- The investigation was not related to the workplace IT system or Internet abuse.
- The employer did not explore alternatives to acquiring the information; its first and immediate response was to examine the employee’s personal emails. The employer did not have a strong reason or probable cause to justify the search of the employee’s personal emails. The search was highly intrusive and less intrusive alternatives should have been considered.
The arbitrator held that in the modern age, it is inevitable that employees will use their employer-owned electronic devices or IT systems for personal use: “Employees do not automatically lose any right to privacy simply because they happen to send or receive a personal email on the employer’s email system”.
Personal emails can only be examined where the employer is reasonably justified in doing so and where it examines them in a reasonable manner. Email searches should not be used as a first resort in an investigation, particularly if there are alternative options for acquiring the information.
However, the arbitrator did note that if there had been a clear prohibition for even incidental personal use of the workplace email system, or if the investigation was related to Internet abuse, the result may have been different.
Employers should be careful in circumstances where they try and rely solely on an IT policy that states that their employees do not have an expectation of privacy when using workplace emails. An employer who wants to search their employee’s personal emails for evidence to justify a termination must first establish that their search is reasonable. Employers should explore alternative options before searching emails, particularly if the investigation is not IT-related.
