Video: Social Media Background Checks - Privacy and human rights legal considerations

New on my YouTube Channel.

Presentation: Social Media Background Checks

I was invited to present to the IAPP Halifax Knowledgenet today on social media background checks, focusing on both the privacy and human rights dimensions. Here it is in case it's of interest:

Supreme Court of Canada finds reasonable expectation of privacy in work-issued laptop

The Supreme Court of Canada just released its decision in R v Cole, 2012 SCC 53, in which a majority of justices of the Court held that a teacher at a school had a reasonable expectation of privacy in the contents of his work-issued laptop. Nevertheless, evidence of child pornography found on it by the school, which was then given to the police, was found to be admissible evidence.

This is bound to be a controversial decision that will have repercussions in the employment law context as well as in criminal trials.

Here's the headnote from the case:

R v Cole, 2012 SCC 53

ON APPEAL FROM THE COURT OF APPEAL FOR ONTARIO

Constitutional law — Charter of Rights — Search and seizure — Information contained on computer — Pornographic pictures of child found on employer-issued work computer — Whether accused had reasonable expectation of privacy in employer-issued work computer — Whether warrantless search and seizure of laptop computer and disc containing Internet files breached accused’s rights under s. 8 of Charter — If so, whether evidence ought to be excluded pursuant to s. 24(2) of Charter.

The accused, a high-school teacher, was charged with possession of child pornography and unauthorized use of a computer. He was permitted to use his work-issued laptop computer for incidental personal purposes which he did. While performing maintenance activities, a technician found on the accused’s laptop a hidden folder containing nude and partially nude photographs of an underage female student. The technician notified the principal, and copied the photographs to a compact disc. The principal seized the laptop, and school board technicians copied the temporary Internet files onto a second disc. The laptop and both discs were handed over to the police, who without a warrant reviewed their contents and then created a mirror image of the hard drive for forensic purposes. The trial judge excluded all of the computer material pursuant to ss. 8 and 24(2) of the Canadian Charter of Rights and Freedoms. The summary conviction appeal court reversed the decision, finding that there was no s. 8 breach. The Court of Appeal for Ontario set aside that decision and excluded the disc containing the temporary Internet files, the laptop and the mirror image of its hard drive. The disc containing the photographs of the student was found to be legally obtained and therefore admissible. As the trial judge had wrongly excluded this evidence, the Court of Appeal ordered a new trial.

Held (Abella J. dissenting): The appeal should be allowed. The exclusionary order of the Court of Appeal is set aside and the order of a new trial is affirmed.

Per McLachlin C.J., and LeBel, Fish, Rothstein, Cromwell and Moldaver JJ.: Computers that are reasonably used for personal purposes — whether found in the workplace or the home — contain information that is meaningful, intimate, and touching on the user’s biographical core. Canadians may therefore reasonably expect privacy in the information contained on these computers, at least where personal use is permitted or reasonably expected. Ownership of property is a relevant consideration, but is not determinative. Workplace policies are also not determinative of a person’s reasonable expectation of privacy. Whatever the policies state, one must consider the totality of the circumstances in order to determine whether privacy is a reasonable expectation in the particular situation. While workplace policies and practices may diminish an individual’s expectation of privacy in a work computer, these sorts of operational realities do not in themselves remove the expectation entirely. A reasonable though diminished expectation of privacy is nonetheless a reasonable expectation of privacy, protected by s. 8 of the Charter. Accordingly, it is subject to state intrusion only under the authority of a reasonable law.

The police in this case infringed the accused’s rights under s. 8 of the Charter. The accused’s personal use of his work-issued laptop generated information that is meaningful, intimate, and organically connected to his biographical core. Pulling in the other direction are the ownership of the laptop by the school board, the workplace policies and practices, and the technology in place at the school. These considerations diminished the accused’s privacy interest in his laptop, at least in comparison to a personal computer, but they did not eliminate it entirely. On balance, the totality of the circumstances support the objective reasonableness of the accused’s subjective expectation of privacy. While the principal had a statutory duty to maintain a safe school environment, and, by necessary implication, a reasonable power to seize and search a school-board issued laptop, the lawful authority of the accused’s employer to seize and search the laptop did not furnish the police with the same power. Furthermore, a third party cannot validly consent to a search or otherwise waive a constitutional protection on behalf of another. The school board was legally entitled to inform the police of its discovery of contraband on the laptop. This would doubtless have permitted the police to obtain a warrant to search the computer for the contraband. But receipt of the computer from the school board did not afford the police warrantless access to the personal information contained within it. This information remained subject, at all relevant times, to the accused’s reasonable and subsisting expectation of privacy.

Unconstitutionally obtained evidence should be excluded under s. 24(2) if, considering all of the circumstances, its admission would bring the administration of justice into disrepute. The conduct of the police officer in this case was not an egregious breach of the Charter. While the police officer did attach great importance to the school board’s ownership of the laptop, he did not do so to the exclusion of other considerations. The officer sincerely, though erroneously, considered the accused’s Charter interests. Further, the officer had reasonable and probable grounds to obtain a warrant. Had he complied with the applicable constitutional requirements, the evidence would necessarily have been discovered. Finally, the evidence is highly reliable and probative physical evidence. The exclusion of the material would have a marked negative impact on the truth-seeking function of the criminal trial process. The admission of the evidence would not bring the administration of justice into disrepute and therefore the evidence should not be excluded.

Generally speaking, the decision to exclude evidence under s. 24(2) should be final. In very limited circumstances however, a material change of circumstances may justify a trial judge to revisit an exclusionary order. In this case, the Court of Appeal invited the trial judge to re-assess the admissibility of the temporary Internet files disc if the evidence becomes important to the truth-seeking function as the trial unfolds. Unconstitutionally obtained evidence, once excluded, will not become admissible simply because the Crown cannot otherwise satisfy its burden to prove the guilt of the accused beyond a reasonable doubt.

Per Abella J. (dissenting): While it is agreed that there has been a Charter breach, the evidence in this case should be excluded under s. 24(2). The Charter-infringing conduct in this case was serious in its disregard for central and well-established Charter standards. The police officer had years of experience in investigating cyber-crime and was expected to follow established Charter jurisprudence. Further, the police officer’s exclusive reliance on ownership to determine whether a warrant was required, was unreasonable and contradicted a finding of good faith for the purposes of s. 24(2). There were also no exigent circumstances or other legitimate reasons preventing the police from getting a warrant. The decision not to get a warrant mandates in favour of exclusion.

The impact of the breach on the accused’s Charter-protected interests, even assuming that his reasonable expectation of privacy was reduced because it was a workplace computer, was significant given the extent of the intrusion into his privacy. The warrantless search and seizure in this case included the entire contents of the accused’s computer. It had no restrictions as to scope. The extent of the search of the accused’s hard drive and browsing history was significant and weighs in favour of exclusion.

Finally, while the evidence in this case is reliable, its importance to the prosecution’s case is at best speculative given that the pornographic photographs themselves were admitted.

Balancing these factors, and in light of the deference owed to trial judges in applying s. 24(2), the evidence should be excluded.

Bozeman rescinds password requirement for job applicants

Further to my previous posting, City in Montana requires job applicants to hand over all social network logins and passwords, the City of Bozeman has faced a huge backlash over its incredibly intrusive policy of requiring job applicants to hand over social networking login information. As a result, it has apparently rescinded the policy. See: Bozeman drops password requirement - Montana's News Station.

Managing privacy in employee relations

I was invited to co-chair and present at the Canadian Institute's "Meeting Your Privacy Obligations" conference in Toronto. My presentation was specifically about managing privacy in the workplace, which is below if you're interested.

Here's a link if Google Docs aren't giving you due respect: Managing Privacy in Employee Relations

I have to say it was one of the best conferences of its kind that I've been to recently. The stellar speakers included Federal Privacy Commissioner Jennifer Stoddart, Alberta Information and Privacy Commissioner Frank Work and fellow bloggers Brian Bowman and Dan Michaluk. (Note: If you're reading my blog, you'll find theirs to be equally interesting and useful. So after you've read all my postings, head over there ...)

Pre-employment polygraph screening

While my blog was down, I wrote on slaw.ca about an interesting story from Nova Scotia that made national news. For those who missed it on slaw, here it is:

Slaw: Pre-employment screening

A recent story from Nova Scotia has focused a lot of attention on pre-employment screening and the use of polygraphs. Hopefully, it will encourage a larger discussion on both sides of the issue.

According to media reports, anybody applying for a job that falls within the purview of the Halifax Police Service and Fire Service is required to pay for a polygraph examination that includes a range of questions, some of which have been considered to be objectionable. (See the full questionnaire here (pdf).)

Others have objected to the use of a polygraph, as many assert it is not a reliable indicator of truthiness truthfulness. (If you want a refresher on how Canadian courts are to treat polygraphs, check out R. v. Béland, 1987 CanLII 27 (S.C.C.)).

The media coverage has been plentiful, from the local papers to CBC's The National (Quicktime). The former FOIPOP Review Officer has made his thoughts known (Ex-watchdog: Ditch polygraphs) as has his successor Dulcie McCallum (Nova Scotians deserve same privacy protection as others).

Any debate and discussion is a good thing. It should, hopefully, focus the mind on one of the principes of privacy best practices that appears in almost every public and private sector privacy law: only collect information that's reasonably necessary for the (reasonable) purposes. If it's not necessary or not reasonable, don't collect it. Other important principles to consider: who has access to the information, how is it used and how long is it kept around?

And now for something completely different somewhat relevant, yet inadmissible:

Here's CBC The National's report:

Micromanaging employee expenditures

I'm not sure how I feel about this. Apparently, MasterCard is introducing a feature for corporate cards that allows employers to set very strict parameters on spending. Economy class? Ok. Business class. Nope. HoJo's? Ok. Strip clubs? Not so much. The card also has detailed reporting that allows employers to keep close tabs on spending.

If an employee is spending the employer's money, it makes sense that the employer can set parameters on it. Business Week's article (You've Been Pre-Rejected) on the topic suggests that it smacks of big brother, but a lot of thinking about privacy depends upon peoples' expectations. If people understand what information is being collected and how it will be used (and it is reasonable), it is less likely that whatever is at issue will be seen as an invasion of privacy. Employees who use a corporate card where they know that the bill goes to the employer first can't reasonably be surprised if their employer gets upset over use of the card that does not fit within company policy. If employees know that the employer can set strict controls on the use of the card, I don't see the problem. If employees similarly are informed that the employer can see the bill in detail, it shouldn't be a problem.

Where the problems arise (and I'm sure they will) is that employers will use this product without telling the employees. The surveillance will be covert, which is much more pernicious and DOES lead to the big brother syndrome. You don't know when you're being observed and thsi leads to mistrust and insecurity. And it can also backfire: if an employee does not feel trusted, many will not act trustworthily (if that's a word!).

The product is also being touted as a tool for parents to keep track on kids' spending. Again, if you're spending someone elses' money they probably have a right to control how it is spent. But similarly, they'll have to make sure that their kids' expectations are tempered by the knowledge that Big Father (or Big Mother) is watching.

At the same time, I think the new MasterCard feature can be a benefit for privacy. Your (personal) credit card number and your (personal) credit card account are your personal information and you have a right to know how it is being used. I'd pay extra for a card that sent me a text message to advise of each charge. I'd be immediately alerted to any fraudulent use of the card and would be in a much better position to protect my own personal information. Whether this will be demanded as a card feature remains to be seen. But it is an example of a technology that can be intrusive and a boon to privacy at the same time. It depends upon how it is used and whether the user knows all about its features.

Alberta Commissioner considers reference checks under PIPA

From Alberta:

Commissioner rules reference check was in compliance with Personal Information Protection Act

January 8, 2008

Commissioner rules reference check was in compliance with Personal Information Protection ActInformation and Privacy Commissioner, Frank Work, has determined that information collected in an employment reference check was in compliance with the Personal Information Protection Act (PIPA).

An individual had complained that a former employer had disclosed information not related to her job to a prospective employer in contravention of PIPA and that the prospective employer had collected the information in contravention of the Act. The individual also complained that the former employer had not responded to her request for her personal information.

Following an inquiry into the matter, the Commissioner determined that the information collected in the reference check was personal employee information as defined in PIPA and that no unrelated personal information about the individual was collected. The Commissioner found no evidence that personal information, aside from work related information, had been disclosed or collected.

The Commissioner did find, however, that the former employer did not properly respond to the Complainant’s request for her personal information and has ordered the former employer to respond to that request.To obtain a copy of Orders P2006-006 and P2006-007, visit our website, http://www.oipc.ab.ca/.

Privacy and pre-employment screening

Yesterday, I spoke at the McInnes Cooper labour and employment group's annual conference. It's been going on for years, but it was my first time to attend. I was greatly impressed with the turnout of more than two hundred attendees.

I gave a presentation on privacy and pre-employment screening, which is here: Pre-employment screening.

Investigator: Employer did not violate PIPA by investigating whether staffer was looking for another job

An interesting investigation report from the Information and Privacy Commissioner of Alberta, in which the investigator found that an employer did not violate PIPA by seeking information about whether a current employee had sought employment with another company:

OIPC

April 10, 2007

EPCOR Utilities Inc. found in compliance with Personal Information Protection Act

The Office of the Information and Privacy Commissioner has found that EPCOR Utilities Inc. (EPCOR) complied with the Personal Information Protection Act (PIPA) when it collected, used and disclosed personal employee information without consent. EPCOR’s collection, use and disclosure of the employee’s personal information was also found to be reasonable for purposes of an investigation.

The complainant, an EPCOR employee at the time, took a leave of absence from EPCOR. Shortly thereafter, EPCOR received unsolicited information suggesting the complainant was about to begin work for another company. EPCOR contacted the other company to verify the complainant’s alleged employment there. The complainant complained that EPCOR collected, used and disclosed his personal information without consent.

The Investigator found that EPCOR had collected, used and disclosed the complainant’s personal information to investigate a possible contravention of the complainant’s employment agreement. As such, consent was not required.

Further, the Investigator found that the information qualified as personal employee information under PIPA: the information was reasonably required to manage the complainant’s employment relationship with EPCOR, and consisted only of information related to that employment relationship. The complainant was notified at the time of hire that his personal information could be collected, used or disclosed for investigation purposes. As such, EPCOR did not require consent to collect, use and disclose the complainant’s personal employee information in these circumstances.

For more information about investigation report P2007-IR-004, please visit our website at: http://www.oipc.ab.ca/