Introduction and summary

Monitoring and surveillance technology continues to evolve, including through the use of artificial intelligence technology. The law surrounding the use of such technology is also evolving to address the need to preserve privacy and protect against abuse.

In Australia, there is a complex web of regulation governing workplace surveillance, with the states and territories adopting non-harmonised compliance regimes – in addition to the overlay of Federal law which is now set to significantly change.

On 16 February 2023, the Federal Attorney-General released the long anticipated Australian Privacy Act Review Report 2022 – setting out proposals for sweeping changes to the regime governing the privacy of employees in the workplace.

Proposed regulation follows:

• a number of recent high profile data breaches and cyber attacks in Australia; and
• the Federal Government in late 2022:
  • increasing the penalties associated with serious breaches of the federal privacy law¹; and
  • enhancing the enforcement, information gathering and sharing powers of Australia’s national privacy regulator².

Australian federal law imposes a significant maximum penalty for serious or repeated interferences with privacy for body corporates – increased late last year from AU$2.2 million to the greater of the following:

• AU$50 million;
• three times the value of the benefit obtained attributable to the breach; and
• if the court cannot determine the value of the benefit, 30% of the adjusted turnover of the body corporate during the breach turnover period for the contravention.

The laws now catch organisations that carry on business in Australia (even if they do not collect or hold information in Australia). Further, company directors of employers or their service providers risk being held personally liable for acts of their companies which breach or commit an offence under an employee surveillance law of some Australian state or territory jurisdictions.

In short, the stakes for employers and service providers are high when it comes to getting it right about workplace privacy and the laws are set to get tougher again.

In this article, we detail the current legal regime in Australia and what is about to change. Below we provide recommendations on what you need to be doing now. This article will be relevant to any organisation who is an employer with employees in Australia as well as any company who processes employee data for Australian employees. Specific employment and privacy law advice is strongly recommended.

Background overview of the current Australian legal regime governing employee workplace surveillance

Currently, the main federal privacy legislation³ in Australia does not contain specific provisions to regulate workplace surveillance although it does provide general laws which govern employer management of employee records (discussed further below).

Employers with employees in the states and territories of Australia are mainly regulated by the workplace surveillance laws in those states and territories.

State and territory based law

In summary, there are three main types of workplace surveillance laws of the states and territories.

Category one: Workplace surveillance specific laws

Only the state of New South Wales and the Australian Capital Territory have legislated specifically for surveillance in the workplace through the Workplace Surveillance Act 2005 (NSW) and the Workplace Privacy Act 2011 (ACT).

1. Prior notice requirement for certain types of surveillance: The primary obligation under each of these laws is that an employer must not commence surveillance of an employee without giving its employee at least 14 days prior notice (this may be hard to anticipate for an employee’s first day at work). Surveillance includes:
   1. optical surveillance (i.e. cameras, CCTV, video recording, etc);
   2. data surveillance (i.e. computer monitoring, emails sent and received from a computer, accessed internet websites from a computer, etc); and
   3. tracking surveillance (i.e. GPS tracking and recording on mobile phones, GPS tracking and recording on vehicles, etc).

For each form of surveillance, there are additional legislative obligations that must be followed, such as developing and adhering to an appropriate surveillance policy and introducing signage in relevant areas.

2. Prohibited conduct: There is also prohibited conduct, such as surveillance in bathrooms and changerooms, surveillance when the employee is not at work for the employer, blocking an employee’s email or internet access, covert surveillance and inappropriately using any surveillance records. Each instance of prohibited conduct carries a penalty for breach. Covert surveillance is any of these forms of prohibited being conducted without notice to the employee.
3. Reasonable steps: The Australian Capital Territory further imposes a unique offence for employers who fail to take reasonable steps to protect any surveillance records from misuse, unauthorised access or loss and failing to destroy or de-identify any surveillance records that are no longer needed by that employer.

Category two: General surveillance laws

In the states of Victoria, Western Australia and South Australia and in the Northern Territory, broad general surveillance legislation deals with recording or surveillance of private conversations and activities as set out in the Surveillance Devices Act 1999 (Vic), Surveillance Devices Act 1998 (WA), Surveillance Devices Act 2016 (SA) and Surveillance Devices Act 2007 (NT).

1. Types of surveillance captured

   Under these laws, surveillance is classified broadly into certain categories:

   1. optical surveillance - recording visually or observing an activity of a person; 
   2. data surveillance⁴ - recording the input or output of information from a computer (i.e. websites accessed, cookies, emails, etc);
   3. tracking surveillance - determining the geographical locations of a person (i.e. GPS, Google Maps history, etc); and
   4. listening surveillance – recording or listening to a conversation or words spoken by a person.
2. Privacy for listening and optical

   With respect to listening and optical surveillance, the laws generally focus on the concept of ‘private conversations and activities’. Broadly, these terms are defined as conversations or activities that are carried on in circumstances where it may be indicated that a party or all parties desire or intend for that conversation or activity to be heard or viewed only between themselves.

   This creates a point of ambiguity for workplaces - as there are areas of a workplace where there is free and uninhibited access for other employees (i.e. kitchens, common rooms, open plan offices, etc) and where conversations and activities may not fall under the definition of ‘private’. Various factors may be relevant to make those conversations and activities ‘private’ (i.e. body language, topic, tone and volume of the conversations, closed doors or moving to a secluded area of the common space, etc).

3. Consent

   For listening, optical and tracking surveillance, surveillance is allowed provided that each primary party (which is a party contributing or actively involved in that conversation or activity) to that conversation or activity (or the tracked party in the case of tracking surveillance) gives express or implied consent to that surveillance.

To this end, employers often use the method of instituting workplace surveillance or employee monitoring policies and either issue:

4. these as part of a bundle of induction documentation to a new employee and require consent to abide by those policies when they accept the job; or
5. a notice to all employees of the implementation of the policy (aimed at obtaining implied consent through notice and no objections).

Both forms of consent have been considered (and continue to be considered) by Australian courts and tribunals – and so a close watch on developments in this area is necessary for most employers.

Category three: More limited laws

The states of Queensland and Tasmania have limited laws governing surveillance in general. Surveillance in these states is regulated by the Invasion of Privacy Act 1971 (Qld) and the Listening Devices Act 1991 (Tas).

These laws are limited to listening surveillance, although the interpretations and rules concerning the requirements of a ‘private conversation’ and ‘consent’ as similar to the general laws set out in the Category two section above and similarly apply.

Federal laws

The main federal legislation in Australia governing privacy is set out in the Privacy Act 1988 (Cth) (Privacy Act).

1. Current employee records exemption

   Relevantly, section 7B(3) of the Privacy Act contains an exemption for employers in Australia from the operation of the Privacy Act for an act or practice directly related to its employment relationship with an individual and an employee record it holds relating to the individual.

   An employee record is a record of personal information relating to the employment of the employee⁵.

2. The exemption applies to acts or practices of organisations (which broadly covers non-public sector entities in their capacity as employers or former employers). Personal information in an employee record that is used or disclosed for a purpose not directly related to the employment relationship is subject to the Privacy Act. Additionally, the exemption also extends to the notifiable data breach scheme established under the Privacy Act (and so extends to any data breach involving personal information of employees in an employee record that is likely to result in serious harm is not subject to the scheme’s reporting requirements).
3. This exemption was originally included as it was thought that the handling of employee records was a matter better dealt with under workplace relations laws (which, at that time, was primarily governed by state and territory legislation).⁶

What is the proposed change for employers and their service providers?

1. On 16 February 2023, the Federal Attorney-General released the Australian Privacy Act Review Report 2022 (Report) foreshadowing proposals for sweeping changes to the regime governing the privacy of employees in the workplace.
2. This proposes sweeping changes to the Privacy Act - noting legitimate concerns regarding the amount and highly sensitive nature of employees’ personal and sensitive information being collected, used and disclosed in the context of the employment relationship and limited transparency about what employees’ personal and sensitive information is being used and disclosed for and whether it is in fact reasonably necessary to administer the employment relationship.
3. The Report commented on the difficulties which requiring employees’ consent to collect their sensitive information poses for employers and employees, including whether consent can be considered to be freely given in the employment and pre-employment context and the fact that employee records containing often highly sensitive information are not subject to security and destruction or data breach reporting requirements.
4. The Report also noted the path to enhance protections for private sector employees was not straight forward and options included extending enhanced protections under the federal Privacy Act (which has the advantage of a national cohesive framework as distinct from fragmented state based privacy regulation). The Report comments on the appeal of enforcement by a national privacy regulator (the Office of the Australian Information Commissioner (OAIC)) given its role as a specialised privacy regulator responsible for complaint resolution, enforcement and code development. However, the Report also noted that there might be benefits in using some of the existing architecture within the federal workplace laws (the federal Fair Work Act 2009 (Cth)).

   The Report concluded that further consideration was required as to how the privacy and workplace relations laws should interact.

5. In any event, it is clear that significant changes will be brought in which will require employers to comply with additional obligations when handling employee records – and these are likely to be imposed on their service providers.

   It seems inevitable that certain Privacy Act obligations will be extended to private sector employees – such as those relating to transparency of collection and use of employee information, protection against unauthorised access or interference, and eligible data breach reporting.

6. Another aspect of the Report were proposals to increase the regulation of artificial intelligence (and any automated decision making) (AI). Using personal information in automated decision making will in the future need to be transparent where that use has a legal or significantly similar effect on an individual’s rights. Individuals are set to have rights to request information about how automated decisions using their personal information are made.

   This is likely to affect use of facial recognition technology, use of biometric data, use of AI for screening employee candidates or assessing employees and handling of former employees.

7. Service providers should be aware that the proposals in the Report also include proposals to introduce specific obligations for data processors (who are processing personal information for a controller – each concept of data controller and data processor being imported from the General Data Protection Regulation governing privacy in the European Union). These are likely to be less onerous than for data controllers – but many data controllers will seek to cascade down obligations onto their service providers in contractual arrangements as a result of their own new compliance obligations.
8. We recommend a watching brief is maintained if you monitor or conduct surveillance of your employees or for their employers in Australia or if you share their employee records data outside the employer entity (whether with your affiliated companies or third party service providers).

What employers and service providers should do now

• Check you currently comply with the laws: Given the material risks of non-compliance including large penalties and potential for director personal liability, businesses with workplace surveillance or data collection policies and employee consent forms should obtain specialist legal advice on their document formation and contents to ensure that they are compliant and suitable for the purposes of the surveillance laws in each jurisdiction as it currently sits. You should review these policies and your processes – and prepare for compliance with the new laws, as draft legislation is brought forward and enacted.
• Keep up with proposed changes in law: Employers of Australian employees and their service providers should keep abreast of changes in Australia’s complex workplace surveillance laws which is set to be amended as complicated new industrial laws are also being progressively implemented under the Fair Work Act 2009 (Cth) – and monitor developments which contain proposals to amend the federal or state / territory based laws relating to privacy and workplaces.
• If implementing new technology such as AI which impacts employees – get legal advice and conduct privacy impact assessments: Specialist legal advice should be sought to ensure compliance in the rapidly changing area – especially if you are implementing technology to monitor employees or prospective employees or implementing any automated decision making processes which impact employees in your capacity as employer. Conducting a privacy impact assessment on the new technology and its impact is a good first step.
• Consider making submissions in response to the Report proposals: The Attorney-General has sought feedback on the proposals contained in the Report. Submissions are open until 31 March 2023.

Dentons' Privacy and Employment & Safety teams in Australia can assist you with monitoring legal developments, making submissions and your current and compliance regimes. Our experience also covers the legal issues surrounding the use of workplace surveillance and artificial intelligence technology.

More information

For further information please visit our:

• Privacy team (Australia)
• Employment team (Australia)
• Dentons AI Hub

1. Privacy Act 1988 (Cth) ↩
2. The Office of the Australian Information Commissioner (OAIC)↩
3. As set out in the Privacy Act 1988 (Cth)↩
4. Western Australia legislation does not include for data surveillance but covers the other three forms of surveillance↩
5. The employee records exemption does not apply in some circumstances – such as it does not extend to acts or practices of ‘agencies’ under the Privacy Act (which includes Commonwealth Departments and other bodies established under Commonwealth statute). These agencies are bound by the Act per section 7B(3).↩
6. See Explanatory Memorandum, Privacy Amendment (Private Sector) Bill 2000 (Cth) 4-5 and Commonwealth, Parliamentary Debates, House of Representatives, 12 April 2000, 15752 (Daryl Williams, Attorney-General).↩