Fishing, footage and Facebook: why employers can't ignore privacy issues
Most organisations are well aware of their privacy obligations to their customers, but many assume that they don't have to worry about privacy when dealing with their employee's personal information because of the employee record exemption in the Privacy Act 1988 (Cth).
The employee record exemption is, however, quite narrow - for example, it doesn't cover job applicants, contractors or employees' personal information which doesn't directly relate to the employment relationship.
It's common for employers to trawl through an employee's inbox, or to look at posts on social networking pages such as Facebook to gather information as part of a workplace investigation.
The problem for employers is that, at first glance, it is almost impossible prior to collection to determine if information in an email or Facebook post relates to an employee's employment, or is truly personal. So evidence of misconduct that will be accepted by the Fair Work Commission may also breach the employer's privacy obligations.
Some recent cases illustrate some of the potential difficulties for employers in the privacy space.
In the decision of Jurecek v Director, Transport Safety Victoria, a public service employee complained that her employer had breached her privacy by collecting posts from her anonymous Facebook page as part of a workplace investigation.
Although the Court held that there had been no breach (because the manner and notification of collection was reasonable in the circumstances), the decision clarifies that even information from an anonymous Facebook page could be 'personal information' if the employer holds other information sufficient to identify the individual. A more detailed discussion of the decision is available in our recent HR&IR Update newsletter.
Privacy breaches which adversely affect an individual's employment will also affect the compensation which might be payable. In EQ v OAIC, a (former) marine researcher was awarded $8,000 after the Great Barrier Reef Authority confirmed a media enquiry that he had been fined for fishing in a protected part of the reef.
Although not strictly a privacy decision, the Federal Court recently granted an employee injunctive relief restraining the employer from using certain video footage in any disciplinary proceedings against him because the employee had not been made aware of the body camera being wore by a security guard (Chappell v Griffin Coal Mining Company).
All-in-all, prevention is the best cure. Well-drafted policies, with the most recent version appropriately notified to all employees, will be an employer's best defence to an allegation that they have collected personal information unreasonably or used it for an impermissible purpose.