Typically, courts give school boards wide latitude to conduct school safety-related searches. Nonetheless, the Court of Appeal for Ontario recently issued a decision in which it held that a school board breached teachers' right to privacy under the Canadian Charter of Rights and Freedoms (Charter) by searching a classroom computer. Though the facts render the case extraordinary, the court's reasoning is cautionary and warrants the attention of school boards across Canada.
Background
A teachers' federation brought a discipline grievance on behalf of two elementary school teachers. The two teachers received a written reprimand for misusing board technology. They had created a "log" to record concerns about another teacher in their work group who they believed to be receiving preferential treatment. The possible existence of the log caused other teachers to complain about their work environment, which led the principal of the school to investigate.
The principal found the log, which the grievors had written in the cloud - " i.e., using an online application that they could only access through their password-protected Google accounts. The principal was in a classroom and touched the trackpad on a laptop. It is not clear whether this was intentional or accidental. . The computer displayed the log, which the principal examined and took pictures of with his phone.
The arbitrator held that the grievors had a reasonable expectation of privacy, albeit a diminished one, given that they left the log unsecured on a computer used by both students and teachers. In light of the diminished expectation of privacy, the arbitrator held that each step in the principal's process of investigation was reasonable and did not violate teachers' privacy rights or the Charter's "reasonable search" requirement.
Court of Appeal decision
The Court of Appeal held that the arbitrator's decision was erroneous, stating that she erred in her analysis of the grievors' expectation of privacy, particularly in finding that the grievors had a diminished expectation of privacy given they were using the school's computer and failed to secure the log.
According to the court, the subject matter of the search was the grievors' private correspondence stored and secured in the cloud, and little significance came out of them using a school computer to access it. The court was also forgiving of the failure of one of the grievors to secure the log, stating that the grievors were not "indifferent to their privacy" and that they "did all they could to protect their privacy." It characterized the grievors' failure as mere "inadvertence."
The court also held that the arbitrator erred in finding the principal's search was reasonable. Although the principal had the power to conduct a search given his Education Act duty to "maintain proper order and discipline in the school," the court said this particular search could not be justified:
Once the principal realized he was looking at the grievors' log, it was as though he had found their diary. He had no legitimate purpose in reading it, let alone taking screenshots of it and submitting it to the Board. The principal failed to respect the grievors' reasonable expectation of privacy.
The court also minimized the principal's concern because it related to a concern about employees and not students. It said:
School authorities such as principals are not responsible for the welfare of teachers and staff in the same way as students, and the need to act quickly concerning teachers and staff is less likely to arise. In my view, concerns arising out of employment relationships in the workplace are unlikely to justify a similarly broad and flexible search and seizure authority. Branding workplace relationships "toxic" does not alter this.
The court declared a violation of the right to be free from unreasonable search under the Charter and quashed the arbitration award.
Commentary
School boards should beware that searches of school board owned computers must be done in a manner that is "reasonable" - i.e., based on sound justification and in a manner that minimizes their privacy impact. This has been the law since the Supreme Court of Canada's decision in R. v. Cole (Cole).
Cole established that privacy expectations of employees will normally be diminished. Although the Court of Appeal in this particular case did not recognize this diminishment, the facts are unique in that the principal had accessed a cloud-based account. School boards should be very cautious in gaining access to content stored in teachers' and students' private (cloud-based) accounts, even if they are left unsecured on school computers.
As a matter of law, the court's decision deserves critique.
First, the forgiveness the court showed to the grievors' treatment of the log poses a data security problem. The law recognizes that one can abandon their expectation of privacy. For example, the Supreme Court of Canada has held that police can search garbage bags left out for pickup without prior judicial authorization because any expectation of privacy for the contents of the bag has been abandoned.
The concept of abandonment is important because its application encourages individuals to take steps to secure their private information. The failure to apply the abandonment principle (or equivalent analysis) in this case encourages computer users to rely on law for protection of their privacy rather than good data security practices. In plainer terms, the law should encourage us to log out of our cloud accounts when we access them on work computers as much as it encourages us to shred our receipts before we throw them in the trash.
Second, the court's treatment of the workplace concern that motivated the principal's search is not consistent with employers' duties under occupational health and safety legislation and the seriousness with which employers ought to treat workplace harassment. Indeed, the Supreme Court of Canada (in the Robichaud case) has imposed strict liability on employers for workplace harassment because they "control [the workplace] and are in a position to take effective remedial action to remove undesirable conditions." Toxicity amongst a group of elementary school teachers would be of serious concern to any school board, particularly given the role of a teacher in respect of elementary school pupils. Hence the Education Act duty to "maintain proper order and discipline in the school." The arbitrator was alive to this serious concern, but the Court of Appeal was not.
We would be pleased to discuss how to address school and computer search risks as part of your school board data and privacy governance program.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
