09 August 2019
8 min read
#Workplace Relations & Safety, #Local Government
Published by:
Technology enabling facial, fingerprint and iris scans offers employers an efficient and accurate means to secure their workplaces, monitor and record their employees’ time and attendance.
Yet there are serious privacy concerns when it comes to biometric technology.
Once you collect the data it is vulnerable to be misused or hacked. You can change passwords, but you can’t change your fingerprint or iris scan.
There are also broader privacy considerations. Privacy is an important human right that is fundamental to a person’s autonomy and dignity.
In the context of the workplace, employee privacy needs to be balanced against the competing interests of employers in seeking the most commercially efficient ways of running their businesses.
Privacy law
An organisation or agency subject to the Privacy Act 1988 (Cth) (Privacy Act) must deal with personal information in a manner consistent with the Australian Privacy Principles (APPs). The Privacy Act covers Australian Government agencies and organisations with an annual turnover of more than $3 million, and some other organisations.
Biometric data is “sensitive information” as defined by s 6(d) of the Privacy Act. Sensitive information generally attracts a higher level of privacy protection than other personal information.
Under APP 3 an organisation may only solicit or collect sensitive information where the person whose information it is consents to its being collected and it is reasonably necessary for one or more of the organisation’s functions or activities (APP 3.3). Absent such consent, collection is only possible if the law authorises or requires them to collect it or it’s necessary to prevent a serious threat to the life, health or safety of any individual.
APP 6.2(a) imposes a stricter requirement on the use of sensitive information for a secondary purpose to the primary purpose for which it was collected: this must be “directly related” to the primary purpose (whereas for ordinary personal information it need only be related).
In summary, privacy law authorises the collection and use of information about a person that is not publicly available, provided the person consents to this freely and voluntarily and without fraud or duress. In a workplace, however, how free consent may not be realistic given the disparity in power manifest in most employment relationships. Individual workers may be required to agree to collection of their biometric data to obtain or keep their job, and may fear reprisal if they refuse.
Jeremy Lee v Superior Wood Pty Ltd
In Jeremy Lee v Superior Wood Pty Ltd [2019] FWCFB 2946 (Lee) the Full Bench of the Fair Work Commission examined the boundaries of an employer’s ability to compel their employees to provide their biometric data in order to comply with sign-in policies that rely on this information.
The finding at first instance in Lee was that a sawmill employee was not unfairly dismissed because his failure to comply with an Attendance Policy requiring fingerprint scanning to sign on and off from work was a valid reason for the dismissal. The Full Bench upheld an appeal against this finding and reversed it.
Compatibility of biometric sign-in policy with privacy law
The Commission found the policy did not form part of the applicant’s employment contract, having come into existence well after he was employed. Therefore, his obligation to comply with it, and thus the validity of his dismissal, “[depended] on whether the direction to do so, using the scanners to sign in and out of work each day, was a reasonable and lawful direction”.
This was found not to be the case as the requirement contravened the Privacy Act by:
Further, none of the exemptions in the Act, namely ss 16A and 7B(3), applied to the employer in this case. In particular, s 7B(3), creating an exemption for the use of information held as employee records was confined to presently held information and did not apply to the prospective holding of information.
The subsequent finding that “the direction to Mr Lee to submit to the collection of his fingerprint data, in circumstances where he did not consent to that collection, was not a lawful direction” meant that his failure to comply with it was not a valid reason for his dismissal.
“Genuine consent”
Crucial to the finding that the requirement contravened privacy law was not only the absence of the Applicant’s actual consent, but the Full Bench’s consideration of the quality of any consent that he could have given once compliance with the policy was made a condition of his continued employment:
“…we consider that any ‘consent’ that he might have given once told that he faced discipline or dismissal would likely have been vitiated by the threat. It would not have been genuine consent.”
Implications of Lee for the viability of compulsory biometric sign-on
The result in Lee indicates that attempts by employers to implement compulsory tracking or sign-on systems which require the collection of biometric data are likely to come up against a combination of privacy and unfair dismissal laws – that is, the failure to gain the meaningful consent of employees subject to any such system will bring not only the collection of their data, but the direction of employees to provide the data into conflict with the Privacy Act. Failure to comply with such a policy will therefore in many circumstances not provide a valid reason for dismissal and this may limit the capacity for employers to compel compliance.
Read more about this case here.
The reality of consent in the workplace context
As outlined above, the finding in Lee that a sign-on system based on the compulsory collection of biometric information contravened the Privacy Act turned largely on the issue of consent.
However, this particular finding, and its protection of this particular employee from dismissal for refusing to provide his biometric information, depended heavily on his actively withholding his consent. The Full Bench’s finding that, even had he ultimately submitted to having his fingerprint scanned, such ‘consent’ would have been vitiated by the knowledge that his job depended on his doing so, depends upon his having initially objected to the policy in order for the vitiating threat to have been made.
The Full Bench did not disturb the single Commissioner’s initial holding that all other employees had impliedly consented to the collection of their biometric information by complying with the policy.
Implications for employers
If you are an employer who wishes to impose a requirement for employees and other persons performing work in your workplace to provide biometric data as part of a system to track employees’ time and attendance, you need to do the following:
You need a Privacy Policy: You need to develop a clearly-expressed and up to date privacy policy that complies with the Privacy Act regarding the collection, use and storage of personal information. At a minimum, a clearly expressed policy should be easy to understand (avoiding jargon, legalistic and in-house terms), easy to navigate, and only include information that is relevant to the management of personal information by the entity. Ensure that any related entity or third party provider is covered by a policy of this kind.
APP 1.4 contains a non-exhaustive list of information that must be included in a privacy policy:
APP 3.3 imposes an additional requirement for collecting sensitive information about an individual. ‘Sensitive information’ is defined in s 6(1) of the Privacy Act and includes biometric information that is to be used for the purpose of automated biometric verification or biometric identification. For the collection of sensitive information, an employer must ensure that (a) the collection of the sensitive information is reasonably necessary for one or more of the employer’s functions or activities and (b) the individual about whom the sensitive information relates to consents to its collection (APP3.3(a)).
You need to give employees’ proper notice: You need to give employees written notice of intention to collect data. The notice should refer to the privacy policy. For new employees this can be done at the induction stage when you are taking the employee through all the workplace policies that apply to them in their employment. For existing employees, you need to embark on appropriate consultation.
You need employee consent: Ideally, you should get express consent from them signing the collection notice. If they refuse then, if the above steps are met, you will have a valid reason for dismissal.
Author: Charles Power
Disclaimer
The information in this publication is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, we do not guarantee that the information in this newsletter is accurate at the date it is received or that it will continue to be accurate in the future.
Published by:
