Although a teacher’s expectation of privacy in their work-issued computer was diminished, they nonetheless retained a privacy interest and a warrant was required to search it.

In R. v. Cole, 2012 SCC 53, the accused was a high-school teacher also responsible for policing student use of their networked laptops. He was supplied with a laptop owned by the school board and accorded domain administration rights on the school’s network. This permitted him to access the hard drives of student laptops.

Cole’s use of the work-issued laptop was governed by the school board’s policy and procedures manual, which allowed for incidental personal use. The policy stipulated teachers’ e-mail correspondence remained private, but subject to access by school administrators if specified conditions were met. It did not address privacy in other types of files but stated that “all data and messages generated on or handled by board equipment are considered to be the property of (the school board).”

The school’s acceptable use policy – written for and signed by students – also applied to teachers. It not only restricted laptop uses but also warned users not to expect privacy in their files. While performing maintenance activities on Cole’s laptop, a school board technician found a hidden folder containing nude and partially nude photographs of an underage female student and notified the principal, who directed him to copy the photos to a compact disc.

The principal seized the laptop and board technicians eventually gained access, making a compact disc containing his temporary Internet files, including pornographic images. A police officer went to the school and the board office the next day, seizing the laptop and CDs: one contained photographs of the student, the other Cole’s temporary Internet files. The officer reviewed the contents at the police station and then sent the laptop away for forensic examination. A mirror image of the hard drive was created for that purpose.

In the Ontario Court of Justice Cole brought a pre-trial motion seeking exclusion of the computer evidence pursuant to s. 24(2) of the Charter. The trial judge found Cole had a reasonable expectation of privacy in the contents of his laptop hard drive. The warrantless search violated his s. 8 Charter rights and all of the computer evidence was excluded.

The Crown challenged the decision in the Ontario Superior Court of Justice. The appeal judge found Cole did not have a reasonable expectation of privacy in the contents of the drive. The Crown’s appeal was allowed, the lower court’s decision set aside and the matter remitted back for trial.

Cole challenged that ruling and the Ontario Court of Appeal held he did have a reasonable expectation of privacy in the informational content of the laptop, but this expectation was “modified to the extent that (the accused) knew his employer’s technician could and would access the laptop as part of his role in maintaining the technical integrity of the school’s information network.”

The technician’s initial remote access wasn’t a “search” for s. 8 purposes, but the examinations by the police, principal and school board (assuming the Charter applied) did engage it. However, the principal and board’s search and seizure of the laptop was reasonable and authorized by law. The creation of the photograph disc wasn’t unreasonable and, since Cole had no privacy interest in the photos, the police search and seizure of the disc did not breach s. 8. Cole, however, retained a continuing reasonable expectation of privacy in the laptop and the disc with his temporary Internet files.

Just because the seizure by school officials was reasonable, police were not endowed with the same authority. The school board could not consent to their search; police had no other lawful authority so the s. 8 breach was established.

The laptop and mirror drive image were excluded under s. 24(2) of the Charter, as was the disc containing the Internet files. The photo cd should have been ruled admissible and therefore a new trial was ordered.

The Crown appealed to the Supreme Court of Canada, again arguing Cole did not have a reasonable expectation of privacy in his employer-issued laptop and therefore its seizure and disc copying were not unreasonable.

Justice Fish, speaking for the entire court, noted that “Section 8 of the Charter guarantees the right of everyone in Canada to be secure against unreasonable search or seizure. An inspection is a search and a taking is a seizure, where a person has a reasonable privacy interest in the object or subject matter of the state action and the information to which it gives access.”

He continued:

Privacy is a matter of reasonable expectations. An expectation of privacy will attract Charter protection if reasonable and informed people in the position of the accused would expect privacy

Where, as here, a search is carried out without a warrant, it is presumptively unreasonable. To establish reasonableness, the Crown must prove on the balance of probabilities (1) that the search was authorized by law, (2) that the authorizing law was itself reasonable and (3) that the authority to conduct the search was exercised in a reasonable manner (references omitted, paras. 35-37).

Privacy

The test for determining whether a person has a reasonable expectation of privacy depends on the “totality of the circumstances,” requiring a four part inquiry:

(1) An examination of the subject matter of the alleged search: The court found the subject matter of the search wasn’t the devices themselves but the informational content (data) on the laptop’s hard drive, its mirror image and the Internet files disc (informational privacy).

(2) A determination as to whether the claimant had a direct interest in the subject matter: This was inferred by Cole’s use of the laptop and the storage of his personal information on the drive.

(3) An inquiry into whether the claimant had a subjective expectation of privacy in the subject matter: The court found a subjective expectation of privacy could again be inferred from Cole’s use of the laptop to browse the Internet and to store personal information on the drive.

(4) An assessment as to whether this subjective expectation of privacy was objectively reasonable, having regard to the totality of the circumstances: Although there is no definitive list of factors to consider, the court found the subjective expectation of privacy was objectively reasonable because it involved highly revealing and meaningful information about an individual’s personal life, even though it was a work-issued laptop and not a personal computer found in a private residence.

Cole did not own the computer, which was a relevant consideration but not determinative. There were factors pulling in opposite directions – some supporting the objective reasonableness of the search (he was permitted to use his work-issued laptop for personal purposes) and others against (he didn’t own it, policy and practice and technology – others including technicians could access the contents of his drive when connected to the network).

Fish found Cole did have an objectively reasonable expectation of privacy, although it was diminished from what one might have in a personal computer in their home. Since he had a reasonable expectation of privacy in his Internet browsing history and the informational content of his work-issued laptop, any non-consensual examination by the police was a “search” and any taking, a “seizure.”

The school search

Assuming school officials are state agents for the purpose of the Charter (a decision left for another day), the principal had a statutory duty to maintain a safe school environment under Ontario’s Education Act. Therefore, by necessary implication, it had a reasonable power to seize and search a board-issued laptop if the principal believed, on reasonable grounds, that the drive contained compromising photographs of a student.

The police search

The school’s implied power of search and seizure, however, wasn’t endowed to police.

The police may well have been authorized to take physical control of the laptop and CD temporarily and for the limited purpose of safeguarding potential evidence of a crime until a search warrant could be obtained. However, that is not what occurred here. Quite the contrary: The police seized the laptop and CD in order to search their contents for evidence of a crime without the consent of Mr. Cole and without prior judicial authorization…

Where a lower constitutional standard is applicable in an administrative context, as in this case, the police cannot invoke that standard to evade the prior judicial authorization that is normally required for searches or seizures in the context of criminal investigations (references omitted, paras. 65-69).

Cole retained a reasonable and “continuous” expectation of privacy in the personal information on his work-issued laptop. The board was legally entitled to tell police what it discovered but it did not afford their warrantless access to the personal information contained within it. “This information remained subject, at all relevant times, to Mr. Cole’s reasonable and subsisting expectation of privacy,” said Fish. Police could have obtained a warrant to search it.

Nor could the employer, as a third party, validly consent to the warrantless search or seizure of a laptop issued to one of its employees.

“For consent to be valid, it must be both voluntary and informed. The adoption of a doctrine of third party consent in this country would imply that the police could interfere with an individual’s privacy interests on the basis of a consent that is not voluntarily given by the rights holder and not necessarily based on sufficient information in his or her hands to make a meaningful choice,” said Fish.

Admissibility – s. 24(2)

The six member majority would have admitted the evidence. The officer did not act negligently or in bad faith. The case law governing privacy expectations in work computers was still unsettled at the time. He believed “erroneously but understandably, that he had the power to search without a warrant.”

The Charter breach was therefore not egregious or high on the scale of seriousness. Cole had a diminished, but subsisting, expectation of privacy and the evidence was discoverable – police had reasonable grounds to obtain a warrant.

Finally, the laptop, mirror drive image and disc containing the temporary Internet files were all highly reliable and probative physical evidence. Excluding them would have a marked negative impact on the truth-seeking function of the criminal trial process and admitting them would not bring the administration of justice into disrepute.

The Crown’s appeal was allowed, the Ontario Court of Appeal’s exclusionary rule was set aside and a new trial ordered.

A different view on admissibility

Justice Abella, although agreeing there was a Charter breach, would have excluded the disc containing the temporary Internet files and the drive copy. In her view, the detective, an experienced officer with years of experience in investigating cyber-crime, failed to follow established Charter jurisprudence – a serious breach. His exclusive reliance on ownership to determine whether a warrant was required was unreasonable and could not be relied upon to establish good faith for the purposes of s. 24(2).

Moreover, there were no exigent circumstances or other legitimate reasons to proceed without a warrant. He had ample time to obtain one and reasonable grounds to do so. The search was highly intrusive, regardless of whether there is a diminished expectation of privacy, and the importance of the reliable evidence in this case was speculative at best.