Your policy is what you do, not what you have written down.

Here’s a trickier question: if more privacy disclaimers wouldn’t have helped, what should Ontario have done? Was the root problem that a police lieutenant was in charge of the pagers and probably wasn’t familiar with the AUP and the legal consequences of telling employees that their personal text messages could stay private? Or was it the more general problem that line managers can tell employees something different than what’s in the AUP?

I think Ontario should have had a policy specifically covering text pagers, and a procedure for handling overages. That would have eliminated the need for the lieutenant to make up his own procedure. The procedure could have even incorporated additional privacy disclaimers—for example, by including the privacy disclaimer in the overage payment request. Formalizing the overage process would have avoided informal promises and made sure that officers knew that text messages could still be audited. Additional disclaimers would have been useful in that context.