Diminished expectation of privacy for regulated professionals

In Law Society of Ontario v Marusic, the Law Society Tribunal held that licensees have a reasonable—albeit diminished—expectation of privacy in work computers and work-related emails as compared to personal accounts¹. This decision raises important considerations for both regulated professionals in terms of reasonable expectations of privacy when it comes to devices used in their professional capacity and regulators when evaluating the scope of an individual’s privacy interests in the context of cooperative investigations.

What you need to know

• Members of regulated professions have a lesser expectation of privacy vis-à-vis their regulator. In Ontario, members of the Law Society accept constraints that do not apply to others and must expect that the regulator may examine their work.
• Individuals who co-mingle their emails by using a business account for personal matters have a diminished expectation of privacy in those personal emails.
• The fact that an individual consented to providing access to their devices for the purposes of a regulatory investigation does not diminish their reasonable expectation of privacy, nor does it provide the regulator with permission to review and use the entire contents of the searched device. 
• The scope of an individual’s consent to a review of their devices as part of a regulatory investigation will be construed narrowly and in accordance with the parameters of the investigation and what was agreed by the parties at the time the individual consented to the search.

Background

In 2017, the Law Society commenced an application in connection with the alleged misconduct of a lawyer, Ms. Marusic. As part of its investigation, the Law Society requested disclosure of electronic documents relating to a specific file, referred to as Client B. Ms. Marusic cooperated with investigators, allowing them to image (copy) her firms’ hard drives and servers. She did so after it was agreed that the Law Society would only view and take documents that “related to” the Client B matter during the relevant period. It was on this basis that Ms. Marusic gave her consent to the imaging of the entire hard drive, something she was not obligated to do.  

In 2019, the Law Society commenced a second application. Relying on emails it discovered during its initial investigation—including emails of a personal nature—the Law Society raised new allegations of misconduct relating to matters other than the Client B matter.

Ms. Marusic brought a motion in the second proceeding to exclude from evidence the various emails that the Law Society obtained from her firm’s computer and server. She argued that the Law Society went beyond their agreement and improperly searched for and seized other emails not related to Client B.

The parties agreed that the Charter applied to the Law Society’s actions. In carrying out its regulatory functions, the Law Society was exercising its legislative authority and is therefore required to comply with the Charter. 

Decision

The motion was granted in part. At the first stage of the inquiry, the panel found that Ms. Marusic had a subjective expectation of privacy in the emails, and that her subjective expectation of privacy was objectively reasonable. Ms. Marusic had stored personal emails and documents on her computer. Relying on the Supreme Court’s decision in Cole, the panel affirmed that a subjective expectation of privacy can be inferred from the use of a work computer to store personal emails. The panel concluded that the search was not authorized by law and violated section 8 of the Charter. The Law Society failed to limit the scope of its search to the agreed-upon criteria and viewed emails, including personal emails, that went beyond the scope of the investigation^2,3.

Balancing the competing interests under section 24(2) of the Charter, the panel excluded the personal emails but admitted the work-related emails. The panel found that the seriousness of the Charter-infringing conduct favored exclusion. However, it found that the remaining two factors—the impact on Ms. Marusic’s Charter-protected interests and society’s interest in an adjudication on the merits—favoured admission of the case-related emails and exclusion of the personal emails.

In considering the impact on Ms. Marusic’s Charter-protected interests under section 24(2), the panel looked to Ms. Marusic’s status as a member of a regulated profession. Interestingly, it held that Ms. Marusic must expect that her regulator may examine her work while exercising its various powers. However, the panel also considered the varying degrees of privacy that may reasonably be expected in the contents of computers, as suggested by the Supreme Court in Cole. In Cole, the laptop was “owned by the employer, which had workplace policies allowing others access, stating that the employer owned all data on its computers and warning users not to expect privacy in their files”⁴. Noting that “none of those factors are present here”, the panel found that Ms. Marusic “had a greater expectation of privacy than had it been in a work computer to which an employer had access to” and that “these differences point to a greater expectation of privacy here than in Cole”⁵.

Implications  

While this decision is not binding on other tribunals and regulatory bodies, it has important implications for regulated professionals:

• individuals working in industries governed by regulatory bodies may have a lesser expectation of privacy in electronic devices and accounts used for professional purposes⁶;
• however, regulated professionals who are not employees (i.e., sole practitioners or business owners) may have a greater expectation of privacy than employees who use devices owned by their employer and who are bound by workplace policies that govern the use of those devices;
• employers in industries that employ regulated professionals should have clear policies governing employee use of personal devices to conduct work-related business; and
• a regulated professional’s reasonable expectation of privacy is further diminished if they comingle personal and professional information.

_________________________

¹ 2020 ONLSTH 18.

² The panel rejected the Law Society’s alternate argument that the search and seizure was authorized by section 49.3(2) of the Law Society Act. The Act authorizes the Law Society to “require the production of” documents that “relate to” the matters under investigation. It does not authorize the Law Society to conduct a search or to take documents that a licensee objects to producing, and the Law Society cannot use this power to search through unrelated documents “to see if they might be connected to the matters at issue”: Marusic at para. 55.

³ Para. 55.

⁴ Cole, paras. 8-9.

⁵ Paras. 74, 76.

⁶ Despite acknowledging that Ms. Marusic owned the computers at issue, and despite the absence of any workplace policy, the panel concluded that “the expectation of privacy is lower than if this had been a home computer”: Marusic at para. 75.