Due to increasing technological developments and the focus on efficiencies in the workplace, we are seeing an evolution in the different ways employers are looking to collect and use employee information.
In Australia, the rising use of workplace fingerprint scanning devices to collect biometric data has raised some important privacy issues for employers.
In a recent decision of the Full Bench of the Fair Work Commission, Jeremy Lee v Superior Wood Pty Ltd  FWCFB 2946, an employee was found to have been unfairly dismissed for refusing to use a fingerprint scanner to record on-site attendance. There is no doubt that this case raised ‘important, novel and emerging issues’1 surrounding the collection of employee data in the workplace.
Jeremy Lee was employed by Superior Wood as a casual General Hand at a sawmill in Queensland.
Citing safety and payroll efficiency reasons, Superior Wood introduced fingerprint scanners to replace their paper-based ‘sign in’/’sign out’ system and implemented a policy requiring all employees to use the new biometric scanning system to record on-site presence.
Mr Lee was concerned about the collection and storage of his personal information (fingerprint) and Superior Wood’s inability to guarantee that no third party would be allowed access to the personal information once electronically stored.
On this basis, he refused, from the outset, to register his fingerprint for scanning.
Employees other than Mr Lee had given their implied consent to the collection of their personal information by registering their fingerprint for use by the scanners. Mr Lee did not give express or implied consent to the collection of his sensitive personal information by the scanners.
Superior Wood met on multiple occasions with Mr Lee ‘to discuss his concerns’2 and warn him that his continued failure to comply with the new scanning policy could result in his employment being terminated. Mr Lee maintained his refusal and proposed to instead continue using the old paper-based method or a swipe-card system.
Eventually, Mr Lee was dismissed for not complying with the policy.
Mr Lee then commenced unfair dismissal proceedings.
First instance decision
At first instance, the Fair Work Commission held that Mr Lee was not unfairly dismissed and it was reasonable for Superior Wood to request the biometric data (fingerprints) from its employees.3
Commissioner Hunt reasoned that while Mr Lee was entitled to refuse to consent to Superior Wood collecting his fingerprint, in doing so he was in breach of their policy and therefore validly dismissed.
Mr Lee appealed the decision.
Full Bench decision
The Full Bench upheld Mr Lee’s appeal and quashed the original decision.
In taking a strict view of Mr Lee’s employment contract, it was found that he was only bound by Superior Wood’s policies, procedures and workplace rules that were in place at the time he entered into his contract.4 Accordingly, Mr Lee was not contractually obliged to comply with the new scanning policy (that came into existence after he commenced employment).
The Full Bench also considered whether Superior Wood’s direction to Mr Lee to comply with the policy and use the scanners to sign in and out of work, was a reasonable and lawful direction.
Superior Wood submitted that by requiring Mr Lee to consent to the collection of his biometric data it did not breach the Privacy Act 1998 (Cth) (Privacy Act) as the ‘employee records exemption’5 applied in relation to the collection of personal information via the fingerprint scanner. However, the Full Bench indicated that the exemption applies only to ‘records obtained and held by an organisation’6 but not to records that have not yet been created or to the creation of future records.
Consequently, the exemption was held not to apply and the direction by Superior Wood was held to be unlawful, being directly inconsistent7 with Mr Lee’s rights under the Privacy Act. This is because the Privacy Act prohibits both the collection and solicitation of sensitive personal information (such as fingerprints), unless an individual consents to that collection.
It was noted, however, that once collected, the exemption would apply and Superior Wood’s obligations under the Privacy Act would cease.
Then, in weighing up relevant factors in the Fair Work Act 2009 (Cth)8 the Full Bench determined on balance, that Mr Lee’s termination was unjust and he was dismissed unfairly.9
Key lessons for employers
A number of significant implications arise for employers from this landmark decision, particularly for those entities subject to the Privacy Act10 due to the novel application of the employee records exemption.
We recommend employers adopt the following risk minimisation strategies:
- Review employment contracts, specifically to ensure employees are required to comply with all current and future workplace policies.
- Ensure there are proper systems and mechanisms in place to alleviate employee concerns surrounding potential breaches of the privacy of their personal information.
- In respect of the collection of sensitive personal information (for example, fingerprints or health information), ensure that voluntary consent is obtained from employees where required under the Privacy Act, or that an employee’s employment contract provides for this consent.