Upcoming Webinar: August 22, 2024 @ 12:30 P.M. (ET)  |  How to Investigate Anonymous Complaints |  Register Today!

Serious insight for serious situations.

Serious insight for serious situations.

<< Back to all posts

Somewhere over the rainbow: Dealing with evidence stored on a cloud

While you’re here, you may wish to attend one of our upcoming workshops:

Workplace Restoration Workshop
7 Aug at
in Online
Have you experienced complex disruptions in your workplace that have affected productivity, staff morale, and the overall feeling of safety in your workplace? In such situations, would you know how to restore your workplace, or where to start? This course is designed to teach an approach to restoration that is non-adversarial and focuses on rebuilding by considering the interests of employees and creating an environment that promotes safety and productivity.
Event is fullJoin waiting list

In our digital era, investigators must be increasingly technologically savvy. Evidence can take on many forms, including texts, emails and social media accounts. Many employers provide company-issued phones, which, more often than not, happen to be iPhones that are controlled by Apple IDs and rely on virtual storage. As the workplace is further digitized, and as more offices become mobile or virtual, investigations will naturally be dealing with evidence that is stored virtually on a cloud. As the decision District of Houston v. Canadian Union of Public Employees, Local 2086 (“District of Houston”) illustrates, sometimes when evidence is stored virtually, it is not so easy to access.

The Complaint

The Grievor, who was a Water and Wastewater Plant Operator and Equipment Operator with the District of Houston (the “District”), was the subject of a complaint from four of his female colleagues who alleged that he was watching them, and possibly taking photographs of them, while they were working at various sites throughout the region. The complainants stated that they often saw the Grievor in areas that they felt were not related to his job, sometimes sitting in his parked car and talking on his cell phone. One complainant stated that she saw the Grievor hold up his cell phone, as if it was pointed at her. The Grievor denied watching any of his female colleagues and stated that his work took him to remote places involving water, sewers, visual inspections and mapping of water systems. He also noted that he was frequently on his work cell phone in the course of his duties, which was a company-issued iPhone.

The iPhone

When the iPhone was first issued to the Grievor, it was set up by the District using a personal Apple ID that was provided by the Grievor and which belonged to his wife. After the District started the investigation, and had seized the iPhone, they refused to allow the Grievor to be present as the iPhone was examined, notwithstanding the fact that his phone contained personal information (and that District policy did not prohibit personal information from being on the phone). The Grievor, who was upset by this decision, maintained that he called his wife and told her what was happening.

Soon after, the District found that the contents of the iPhone had been erased and the account was inaccessible. The Grievor maintained that his wife had deactivated the iPhone after she was advised of the allegations and the investigation. She refused to provide the Grievor with the password and the account could not be reactivated. Once the iPhone was deactivated, the District lost all access to its contents.

The employer took the position that the deactivation of the iPhone had effectively destroyed evidence relevant to the investigation and that the Grievor had refused to provide the password for reactivation.

The Arbitration

At the arbitration, the Grievor’s wife testified that she had deactivated the iPhone and that it was unlikely she would have unlocked the account even if she was fully informed of the reasons for the request. The District was found to be wrong in its assertion that the Grievor could not have personal information on his phone because it was clear that a personal Apple ID was being used with the iPhone was being set up. The District did not allow the Grievor to be present when his personal information was being accessed as part of the investigation and the arbitrator determined that this resulted in the chain of events that led to the Grievor’s wife deactivating the iPhone. Some accommodation for the privacy rights of the Grievor would have been expected in this situation.

The arbitrator determined that the evidence of the complainants was not sufficient to establish that the Grievor was “spying” on them and that the interview of the Grievor was “cursory at best.” Overall, the employer was found to have had insufficient evidence to terminate the Grievor.


Storage mechanisms, such as Apple IDs and iClouds, add a layer of complexity in accessing evidence during an investigation. In the District of Houston, the employer could have taken steps both before and during the investigation to protect itself from losing access to virtually stored evidence, such as making efforts to ensure that company-issued technology is not set up using an employee’s personal account and that the employer maintains some form of access to the data (i.e. the employee cannot delete the account and information).

When conducting an investigation, an investigator needs to consider how best to deal with virtual data, in particular when that data includes a party’s personal information. As detailed in the District of Houston, the seizure and search of a company-issued phone does not eliminate the privacy rights of the employee.

Assessing evidence and deciding what did (or did not) happen when a complaint arises in the workplace is at the heart of what we do as investigators. To ensure that there is a sufficient evidentiary foundation for our findings of fact, investigators must make best efforts to obtain all evidence relevant to the investigation, including evidence that exists somewhere, out there, on a cloud.

Webinars: Registration is now open!

This means that you can take our courses across Canada wherever you may be located. All you need is an internet connection and your computer. Click here to view our courses and to register.