Who Can Access Your Email? Custody and Control of Faculty Records

By Mark Diotte

A significant portion of all faculty communication takes place through email, and using email to reach out to students, to transfer files, to set up meetings, and to hold discussions takes up a significant portion of faculty time. Many of us feel “email anxiety”—especially when it comes to who may be able to access our email content.

Does the university have the unfettered, unilateral right to access our email or other records?

The short answer is: “No, they do not.”

The longer answer is: “No, they do not have an absolute right to all of our communications and documents, but there are some significant exceptions.” During the years between 2009 and 2019, several precedent-setting University cases have been arbitrated, brought before provincial privacy commissioners, or brought before the courts.[1] Building on initial cases in 2010 and 2011, the more recent cases confirm that emails produced for personal purposes, or emails involving teaching, learning, and research, and which would traditionally be covered under academic freedom, are not within the custody and control of the employer.[2] In short, records not directly related to the mandate and administration of the university are not in the custody or control of the university, and the university is not allowed automatic access to these records.

Yet, there are important exceptions where some records are within the custody and control of the employer. These exceptions are records directly related to the mandate of the institution—for example, administrative records created or received as part of an administrative role in the university (e.g. chair or committee member) as well as communications with a university administrator.

In July 2013, the Canadian Association of University Teachers (CAUT) issued a CAUT Advisory bulletin titled “Custody & Control of Academic Staff Records” that provides further information on the topic. The bulletin includes two scenarios illustrating the principles of custody and control over academic records: 

1.     Imagine “if, coming into your office on a weekday morning, you found the dean going through your file cabinet or reading your email. The typical response would rightly be outrage because your files and records are your files and records, not the university’s.”

2.     “Similarly, if you retire or take a job in another university, the practice is not that you must leave all your records, notes, and files — taking only pictures of your family and your coffee cup with you — as is the norm in most workplaces where the departing person is given a box in which to put ‘personal effects.’” 

While university employers may suggest that the ownership or location of servers indicates the automatic right to access electronic records, the case law concludes that the “physical location of a record is not determinative of ‘custody’ or ‘control’”—as in the CAUT analogies above.[3] In other words, the fact that your emails and documents may be stored on an employer’s server rather than in an office filing cabinet doesn’t mean that the employer has free, unregulated access to them.

The custody and control of faculty records has a long legal, legislative, and academic history including British Columbia legislation, Canadian case law, collective agreements, employer policy documents, principles of academic freedom, and past practice. If your emails or records are being requested by administration, your first step is to contact the KFA so that we can ensure the request is appropriate.  If you are feeling pressured into a decision, you should decline to turn over your records until you have had time to consult with the KFA.  

If you have any questions about this subject, please feel free to contact the KFA.

Updated August 2021

[1] Of particular interest are: University of Ottawa (Re), 2011 CanLII 74312 (ON IPC), <http://canlii.ca/t/fp08t>; University of Alberta v. Alberta (Information and Privacy Commissioner), 2012 ABQB 247 (CanLII), <http://canlii.ca/t/fr16q>;University of Ottawa (Re), 2013 CanLII 41283 (ON IPC), <http://canlii.ca/t/fzl1t>;McMaster University (Re), 2016 CanLII 80387 (ON IPC), <http://canlii.ca/t/gvrcx>; Denike v Dalhousie University, 2018 NSSC 111 (CanLII), <http://canlii.ca/t/hrx30>; University of Western Ontario (Re), 2018 CanLII 121437 (ON IPC), <http://canlii.ca/t/hwn0q>

[2] City of Ottawa v. Ontario (2010) https://www.ipc.on.ca/wp-content/uploads/2018/01/mo2408-divct.pdf   2011 finding of the Ontario Privacy Commission regarding a dispute between the University of Ottawa and the Association of Professors of the University of Ottawa (APUO) https://www.canlii.org/en/on/onipc/doc/2011/2011canlii74312/2011canlii74312.html

[3] CAUT Advisory