The ongoing issue of employer access to personal information stored on workplace devices, or on personal devices used for work, is one which can be troublesome for employers. Decisions on whether and how to initiate searches of such devices require balancing employee privacy interests against an employer’s legitimate right to investigate workplace misconduct.
In AMAPCEO and Ontario (Ministry of Government and Consumer Services) (Bhattacharya Grievance), a USB storage device bearing no identifying marks was found on the public employer’s premises. A human resources employee viewed the files on the device before giving it to management, explaining that the device appeared to contain the personal files of a coworker, Bhattacharya, as well as government files. Management reviewed the device and saw that there were highly sensitive and confidential government files on the device. The presence of such files on the device was unauthorized and, in the employer’s view, constituted misconduct. In order to gather further evidence in support of discipline of the employee, a forensic investigation was conducted of the device. This investigation found a draft of one of several anonymous emails that had been sent to the employer that falsely alleged management misconduct. Due to Bhattacharya’s involvement with the anonymous emails and because the USB contained documents that were highly confidential and contained prejudicial information, Bhattacharya’s employment was terminated.
The main issue to be decided in the ensuing grievance was whether or not the evidence from the device should be excluded on the basis that its admission would infringe upon the privacy interests of the grievor. Even though the device belonged to the grievor, and the union argued that the grievor had a reasonable expectation of privacy, the Arbitrator found that this expectation of privacy yielded to the interests of the employer in several ways. First, because the device was used for work-related purposes, the grievor’s expectation of privacy in relation to the device was subject to a limited right of access of the employer related to monitoring its use for work-related functions. Put another way, the device fell within the organization’s technology policy, despite the fact that it was the grievor’s personal device. The technology policy provided that unacceptable use of technology resources (including memory sticks) may result in discipline up to and including termination.
Second, the mixed contents of personal and work-related material on the device meant that the grievor’s reasonable expectation of privacy was diminished, although not extinguished. The fact that there were work documents found on the device was a factor that was considered under the reasonableness of the search. The expectation of privacy only attached to personal files, not work-related ones. Since the device was simply found in the workplace, with no identifying features on it, it was reasonable for the employer to search it in case it may have contained sensitive files, which it ultimately did. As a result, the arbitrator decided that the employer conducted a reasonable search.
Another key factor was that the search was conducted in a minimally intrusive manner. Out of all the files on the device, very few personal documents were accessed. The search exposed little in the way of details of the grievor’s life. The Arbitrator was mindful of the fact that the use of the device for both personal and work related purposes made some degree of intrusion into the personal documents during the course of the search inevitable.
The Arbitrator also relied on R. v. Cole, 2012 SCC 53, where the Supreme Court of Canada found that an employer has the power to seize and search a digital device if it has reasonable grounds to believe that the device contains evidence of serious misconduct. The fact that the employer was told that the device appeared to have sensitive government documents on it provided a legitimate reason for it to be examined. Further, the fact that the device proved to eventually contain a highly sensitive and confidential document provided a legitimate reason to escalate the investigation.
This case serves as a reminder to employers to ensure that any sort of investigation into the use of technology by employees must be conducted in a reasonable manner, with as little intrusion as possible, in order to adhere to relevant privacy legislation. It is also a reminder to establish, maintain and enforce clear workplace technology and internet use policies.
[2016] O.G.S.B.A. No. 29
Questions relating to the content of the article may be directed to Suzanne Kennedy.