Social Media in the Canadian Workplace: A Live ExchangeOctober 15, 2012
This exchange, part of a recent audio session conducted by Lancaster House, deals with the issue of social media at the workplace, and in particular balancing the right of employees to privacy against the right of employers to access information on employer-owned devices. The session is moderated by Rob Boswell and Leanne Chahley, who pose the questions, and includes as discussants Dan Michaluk, a management labour lawyer from Toronto law firm Hicks Morley, and David Wallbridge, a union-side labour lawyer from Halifax law firm Pink Larkin.
Q: Currently, do employees have a freestanding right to privacy in Canadian law?
David: The short answer is yes. In the recent decision of the Ontario Court of Appeal, Jones v. Tsige, 2012 ONCA 32 (CanLII), the court unanimously found that there is an independent right of action for 'intrusion upon seclusion'. This is a new tort that that can be applied in labour arbitration, and for those in the non-union sector this will open up an avenue that can be pursued in the civil courts. The issue in the case involved a client/employee of the Bank of Montreal who had her private bank information accessed by another co-worker who happened to be in a common-law relationship with her former husband at least 174 times over 4 years. The court commented that this was "deliberate, prolonged and shocking," and that the law in the province would be "sadly deficient" if the plaintiff were sent away without a legal remedy. After reviewing past cases and law in other jurisdictions, it summarized the requirements that must be established to assert a right to privacy. One, the defendant's conduct must be intentional and reckless; two, the defendant must have invaded the plaintiff's private affairs without lawful justification; and three, a reasonable person would regard the invasion of privacy as 'highly offensive', causing distress, humiliation or anguish. The court also put a cap of $20,000 on what it thought would be reasonable damages. In this case the plaintiff was awarded $10,000.
Dan: I don't think Jones v. Tsige is going to change the balance between management rights and privacy rights in the workplace. In the unionized workplace we've had to balance the two for a long time, and though in the non-unionized context the tort is new, it is very limited. It rests on proof of a reasonable expectation of privacy, and requires not only an unauthorized intrusion but a "highly offensive" intrusion. The area where I see it becoming an issue relates to outside-the-workplace video surveillance. Non-union employers are likely to see claims, whether meritorious or not.
Q: Does personal information stored on smart phones, laptops or other electronic devices that employees get from their employers and take home attract greater protection, in terms of privacy, than information stored on computers or other devices that do not leave the workplace?
Dan: To me it's less a question of where the computer goes, but rather whether it's being used for personal reasons. In the absence of a clear policy, an employee will have some limited expectation of privacy, but that certainly won't preclude a reasonable exercise of management rights. The traditional arbitral view is that clear policy can erase any expectation of privacy, but I think that view is questionable now. At the same time nobody is questioning that an employer has some right to access data on its system. For example, in R. v. Cole, 2011 ONCA 218 (CanLII), the Ontario Court of Appeal ruled that employees have Charter-based privacy rights over personal information on work computers. In that case, a high school teacher's laptop computer, provided and owned by the school, was found to contain sexually explicit photos of a grade 10 student at the school on its hard drive by a school technician who, after noticing a large amount of activity between the teacher's laptop and the school's server, remotely accessed the hard drive to perform a virus scan and verify the integrity of the system. While the Court of Appeal held that the employer's subsequent actions, including searching the laptop, copying the temporary files of the teacher's surfing history and the images onto disks, and turning the laptop and disks over to the police, were justified by its authority under the provincial Education Act, which imposes a statutory duty on a principal of a school to ensure a safe school environment, it held that the subsequent warrantless search conducted by the police violated the individual's right in s.8 of the Charter of Rights to be secure against unreasonable search and seizure. Thus, the Cole case affirms the privacy rights of employees, while also confirming that these rights may be subject to an employer's duty to manage the employment relationship, and that this may justify a collection of otherwise private or personal information in certain circumstances.
[Editors' Note: The Supreme Court of Canada heard and reserved an appeal of this decision on May 15, 2012. The Supreme Court of Canada ruling is expected to be released on October 19, 2012.]
David: I think it turns not only on the policies of the employer, but also the circumstances that trigger the employer's desire to investigate. Arbitrators will look at factors such as whether it is a safety-sensitive situation, the limit on how much information can be accessed, and whether the information actually needs to be accessed.
Q: Would an employee have a reasonable expectation of privacy in respect of notes or other work-related documents created by the employee on a notebook or computer that belongs to the employee rather than the employer?
Dan: They would, and the governing case would probably be the Supreme Court of Canada's decision in R. v. Morelli, 2010 SCC 8 (CanLII), which concerned the use of a personal computer. The Supreme Court spoke eloquently about how personal devices like that are receptacles for one's innermost thoughts and feelings. For that reason, a very strong prescription for employers is not to let employees perform work from personal computers, unless there is a "Bring Your Own Device" policy in place that allows for employer control over what is on that personal device.
Q: Are employers permitted to monitor employees' computer or internet use at work to be sure that they are being productive, and are not spending their time doing other things? Can an employer use specific software to track employees' computer use?
Dan: Yes, but their actions must be driven by legitimate interests and framed by policy. The one kind of surveillance that all employers conduct, in the exercise of their duty to take reasonable care, is routine traffic monitoring, so that they know, for example, if employees are downloading three times more than they should. I think that's fine if it's supported by a policy. Routine content monitoring, or audits (which are periodic checks to ensure compliance with company policy) are also options for some employers, again if they're supported by policies and linked to legitimate interests. Finally there are investigations which are about searching for misconduct, and which typically involve a detailed look at information. I think that, if employers meet a standard of reasonable suspicion, they're fine, but nowadays investigations should be structured by a policy.
David: Having a clear policy is important. However, in terms of employer monitoring, there seem to be a number of examples where employers just go too far. You have to make sure that the people who are looking at employees' information can control their urge to investigate beyond their mandate. In R. v. Cole, which has been mentioned, the Court of Appeal found no fault with the school board's actions, once the photos had been discovered, in searching the laptop, and even handing over the laptop to the police, noting that the school board was investigating a serious allegation of teacher misconduct and a threat to the school environment. While there was no longer an immediate threat to the school, its students or the school's computer network, the Court of Appeal acknowledged that the school board had an ongoing obligation to take steps to ensure a safe and secure learning environment for its students and to protect the students' privacy rights and that the search of the laptop and preservation of the evidence constituted a legitimate means for doing so. At the same time, the Court held that the subsequent warrantless search by the police violated the teacher's s.8 Charter right to be secure against unreasonable search and seizure, recognizing that the fact that the discs and laptop had been lawfully examined by the principal and the school board did not affect the continuing privacy expectations of the teacher with respect to the searching of the computer by the police.
Q: In what circumstances would engaging in relatively common time-wasting activities, like browsing the internet, amount to time theft? How have decision-makers treated employees who engage in these activities, compared with those who access inappropriate materials like pornography at work?
Dan: There is no question that excessive internet use is a less serious offence than accessing porn at work. Accessing porn is serious because of human rights-related duties and obligations. Some recent decisions have said that we shouldn't apply the "time theft" moniker to excessive internet use, because it's not really fraudulent activity. One of those cases, Health Sciences Association of British Columbia v. Health Sciences Employers' Association of British Columbia  B.C.C.A.A.A. No. 125 (QL), also highlights the difficulties in proving the amount of time spent online through internet logs. The employer had pages of logs that showed the employee accessing certain sites at certain times, but there was no "ticker," and the employer had to infer what amount of time the employee wasted, which is sometimes difficult from log information. But this is where it gets difficult. Does that justify the installation of spyware that captures the time in the course of a time-theft or wasting-time investigation? Employers regard Health Sciences Employers' Association case as an example of the frailty of log information. However, they also have to deal with another case, Order F07-18 – Re University of British Columbia,  B.C.I.P.C.D. No. 30 (QL), in which the B.C. Privacy Commissioner found a violation of privacy legislation because UBC installed spyware which the Commissioner found unnecessary because the university had internet logs. So internet logs are key evidence in these cases, and whether or not they are good enough, and whether employers are justified in seeking better evidence, are questions that are outstanding right now.
David: What troubles me is that it seems that in these cases the employers quickly move to logs or spyware or some other invasive technique before they sit down and have a frank, honest discussion with their employees, and actually manage them. I think that when we look at balancing rights and at reasonableness, we should consider alternatives to discipline. Maybe there are some employees who will lie no matter what, but sometimes if you say to an employee, "hey, every time I go by your office you seem to have Facebook up," it plants a seed, it makes that employee think twice, and it corrects the problem without going down the path of discipline or of invasive intrusion.
Dan: Yes, the less intrusive means that is open to employers in probably a wide range of cases is just confronting the employee and having a talk about it. But employers argue that they are entitled to investigate, that they aren't required to be 'trusting' in most cases, and that they are justified in looking for hard data of misconduct before they intervene. I think you'll find cases both ways. The case that I like as an employer counsel is Health Sciences Association of British Columbia v. Fraser Health Authority (Surrey Memorial Hospital),  B.C.C.A.A.A. No. 60 (QL), in which Arbitrator Glass says that employers are entitled to investigate, that reasonableness rather than necessity should be the prevailing test, and that in some cases requiring resort to less intrusive means tends to distort the analysis.
Q: Does an employee have a reasonable expectation of privacy in his or her use of social media websites? Does it matter if the employee restricts access to those social media pages through privacy settings, or through invitation-only safeguards so that only friends can look?
David: What I would say to a client is that it's all public, forget about privacy settings. If you're putting something up there it's just like hanging a banner in front of your house and saying it. That shouldn't stop employees from enjoying the benefits of having a Facebook page or Twitter account or that kind of thing. What it means is that before you hit send, you exercise common sense and good judgment.
Dan: The most recent statement I know of is from Canada Post Corp. v. Canadian Union of Postal Workers,  C.L.A.D. No. 85 (QL), by Arbitrator Ponak. He accepts that the grievor had a genuine belief that her Facebook page was private, but the speech in that case was extreme. He said that, even if she believed it was private, it was reckless to post that stuff to her friends. It's OK to sit in a bar with a friend and vent a little, but if you put it online, even if you're only posting to six friends and it's password-protected, when there's a reasonable expectation of harm to the employer that venting isn't justified.
David: One exception is if a restricted-access forum hosted by a union contains legitimate discussion about workplace or bargaining issues, including disagreements with management, a lot of that content would be protected under Canadian labour legislation. An attempt by an employer to restrict that, or discipline people for participating in it would end up at the labour board.
Q: What about the situation where an employer starts tracking an employee's social media use? Is that different than just running across it, and does it amount to collecting personal information, in violation of privacy legislation such as in the Federal jurisdiction or B.C. or Alberta?
Dan: It depends on whether the privacy legislation makes an exception for publicly available information. Privacy legislation doesn't rest on a reasonable expectation of privacy, it protects personal information, which is pretty broadly defined, and which can apply to most of the personal stuff that we talk about online. But private sector privacy legislation in B.C. and Alberta, for example, has exemptions for information that is publicly available, so an employer would argue that the consent rules in privacy legislation don't apply when an employee has put the information "out there." Indeed, in a recent decision of the Alberta Court of Appeal, United Food and Commercial Workers, Local 401 v. Alberta (Attorney General), 2012 ABCA 130, the question is raised as to whether privacy legislation is constitutional if it doesn't have a broad "publicly available information" exemption.
Q: Can and should an employer run a social media check, similar to a credit check or background check, of potential job applicants?
David: You've got to be careful when you go out and find these things. I know employers are probably looking at them to determine if there's something inappropriate, but what they'll inevitably also find out may result in a conflict with human rights legislation. You can't ask someone if they're pregnant, or what their sexual orientation is, but when you access their social media account, you've found all that stuff out. So you effectively have asked the question, and now you run the risk that decisions you make could be alleged to be based upon what you have found out.
Q: Can an employer ask for the password to your Facebook account, or your Twitter account, or any of the other places where you might keep information about yourself or your preferences, either personal or professional?
Dan: What's odd about this is that the Facebook password request has raised so much ire – and I agree that it seems quite aggressive, and I'm not endorsing it in any way – but we have just been talking about how public Facebook is, and how when you publish to your friends it's generally treated as a publication to the world. It's different from looking in someone's personal diary, because writing in a diary poses no risk of harm to an employer or prospective employer, but what someone says online might. It may be subject to privacy legislation, but the bigger risk is the human rights risk. Still, I think there's an easy solution to that: use a filter. Give objective, bona fide, non-discriminatory criteria to a search agent, and have the search agent do the search and fill out a form which says that this person cleared a background check. I have some trouble with asking for passwords themselves, because it's not reasonable in light of IT security issues, but to do a supervised review of a candidate's page – though I think it would likely fail if challenged – conceptually I could make the case for it.
Q: Are employers obliged to ask if an employee is being harassed or maligned by other employees online if the harassment doesn't involve employer technology or takes place during off-duty hours?
David: Should employers get involved in the soap-opera of everyday life between employees? No. Do they have an obligation to address situations where one employee is being harassed and maligned by another employee online, and it may have consequences in terms of the workplace relationship? Yes. The notable Canadian example is Alberta Union of Provincial Employees v. Alberta,  A.G.A.A. No. 20 (QL) in which the board found that you cannot simply invoke free speech to make derogatory comments about a co-worker. In this case it was a blog, and the arbitrator found that the material contained in the blog was destructive to the workplace relationship. If that type of off-duty conduct between employees is involved, conduct that is going to have an impact on the workplace, then employers do have the ability to intervene; but only in those extreme cases.
Q: What does an employer do when the comments or videos posted by an employee might harm the reputation of the employer?
Dan: There's a hierarchy, and I think reputation falls on the low end. The basis for acting is much stronger when it's about interference with your duty to protect an employee from harassment, or about conduct that interferes with an employer's ability to discharge his or her own duties. Mere harm to commercial or reputational interests is the weakest basis for engaging, and that's reflected in the case law. You certainly can engage, but adjudicators look for a significant, non-speculative risk. This risk was found in International Union of Elevator Constructors, Local 50 v. ThyssenKrupp Elevator (Canada) Ltd., 2011 CanLII 46582 (ON LRB), a remarkable case about an employee who nailed a piece of wood to his scrotum – excuse me for the imagery – and that video got posted online. The Ontario Labour Relations Board decided that there was a significant risk to reputational harm, because why would anyone hire a contractor who sends people out to the workplace that do this sort of thing?
David: That case, and many other recent decisions, are really instances of 21st century facts being governed by 1960s caselaw. And what I mean by 1960s caselaw, is the Oil, Chemical & Atomic Workers Int'l Union, Local 9-670 v. Millhaven Fibres Ltd.,  O.L.A.A. No. 4 (QL), with its five-part test: that off-duty conduct can result in discipline if it harms the company's reputation; if the behaviour renders the employee unable to perform duties satisfactorily; if it leads to a refusal, reluctance, or inability of others to work with that employee; if the grievor is guilty of some serious breach of the Criminal Code which then renders the conduct harmful to the employer's reputation; or if it places difficulty in the way the company can properly carry out its function effectively and efficiently.
Q: Do employees have freedom to criticize their employers online during off-duty hours?
David: In the public sector, it depends on the employee's place within the public service, the importance of the public's perception of that employee and whether the conduct impairs that employee's ability to do his or her job. It comes down to the balance between free speech and loyalty. In Fraser v. P.S.S.R.B., 1985 CanLII 14 (SCC), the court upheld an employee's suspension and subsequent termination where the employee had continuously made vicious public statements against what were at the time highly controversial government policies, and because he had already been asked by his supervisor on multiple occasions to refrain from engaging in such public criticism. In a couple of private sector cases, Air Line Pilots Association, International v. Wasaya Airways LP,  C.L.A.D. No. 297 (QL) and United Food and Commercial Workers International Union, Local 1518 v. Lougheed Imports Ltd. (c.o.b. West Coast Mazda),  B.C.L.R.B.D. No. 190 (QL), which were both social media cases, there were some pretty inflammatory, disparaging comments posted online, and in both cases it was found that the employees went too far. In the first case, a pilot at a First Nations airline posted a note on his Facebook page that contained racial overtones. Although the note was viewable only to the employee's friends, the arbitrator held that discipline was appropriate, but that given certain mitigating factors, discharge was an excessive response. I must say, though, that even though the Board found no anti-union animus in the West Coast Mazda case, which involved the dismissal of some supporters of the union during an organizing campaign, the case has always troubled me. In this case, management saw these postings going up on the employees' social media accounts, waited until there was a great accumulation of them, and then swooped in to discipline and terminate the employees. I've had discussions with employer counsel who have told me that, when one of their clients calls them up and says that one of their employees has posted something offensive, the advice right off the top is to go have a discussion with the employee and tell them to take it down, and end everything there – there doesn't have to be discipline.
Dan: I completely agree with that. If you don't tell them to remove it, you prejudice your ability to argue harm, because if it was harmful you would have acted.