A recent decision by the Full Bench of the Fair Work Commission (FWC) may seriously impact the way employers collect personal information from employees and use fingers scanners as a means of recording attendance at work.
In the decision of Lee v Superior Wood [2019] FWCFB 2946, the Full Bench of the FWC found that a direction to require an employee to provide his biometric data scanning for the purposes of fingerprint scanning was not a lawful direction as it impinged upon the employee’s rights under the Privacy Act and therefore the employee’s dismissal for refusing to follow that direction was unfair.
Significantly, the Full Bench found that the employee records exemption under the Privacy Act only applied to records actually held by the employer, meaning the Privacy Act applied to practices engaged in by the employer up to the point of collecting personal information.
The Case
In this case, Superior Wood introduced fingerprint scanners in the workplace to log employees’ start and finish times. One employee, Mr Lee, refused to register his fingerprint and continued to manually sign in and out for his shifts.
However, a site attendance policy was then introduced which required all employees to use the fingerprint scanning. Superior Wood attempted to discuss Mr Lee’s concerns with him, and warned him that a continued failure to follow the policy would result in his employment being terminated. Lee continued to refuse to comply and Superior Wood terminated his employment.
Lee then brought an unfair dismissal application in the FWC. At first instance, the Commission held that Lee’s dismissal was not unfair because the direction was reasonable in the circumstances. That decision was appealed by Lee to the Full Bench of the FWC.
Appeal Decision
The Full Bench overturned the original decision, finding that there was no valid reason for the termination. The Full Bench concluded that:
- The site attendance policy did not apply to Lee because the drafting of his employment contract meant that he was only bound by policies in place at the time his contract was signed. Because the Policy was introduced some four years later, it did not form part of Lee’s terms and conditions of employment.
- Lee’s obligation to comply with the Policy (having already established that it was not a term of his employment) depended on whether the direction to do so was a ‘reasonable and lawful’ direction.
- Because Lee did not give consent and there were other options open to Superior Wood to log his start and finish times, the direction to submit to mandatory fingerprint scanning was not a lawful direction and could not form the basis of the decision to terminate Lee’s employment.
The implications for employers?
The implications for employers could be far ranging (beyond finger scanning) including now throwing into doubt many commonly held views regarding the rights of employers, including the view that employers have the right to request an independent medical assessment, and drug and alcohol testing.
It is unclear if the Full Bench decision will be appealed, but it is easy to see the unintended – and serious – consequences which could result.
What do employers need to do now?
Employers should take some immediate steps to minimise the risk of a privacy complaint by taking the following steps:
- Have a compliant privacy policy: the FWC was critical of Superior Wood’s lack of a privacy policy or any measures to protect employee personal information.
- Review your policies and privacy clauses in your employment contracts: Employment contracts should include a clause requiring employees to comply with all current and future workplace policies (including any amendments to these policies, and without incorporating policy terms into the contract), including that they must provide consent if reasonably required as part of any process as a fundamental obligation of employment.
- Your policies should be clear about what, how and when employee personal information may be collected, and obtain the employee’s consent where required.
- For the collection of sensitive personal information, you will need a mechanism to obtain consent from employees. If you need to collect sensitive information pursuant to one of your policies (eg a drug and alcohol testing regime) then consider seeking written consent from all employees now in relation to those policies.
Employment contracts should include a privacy clause which sets out the types of personal information which will be collected, how that information will be used and who it may be disclosed to It is also important that employees are made aware of any new policies or changes to existing policy
Greg Arnold – Director & Principal Consultant
Disclaimer: This article provides a summary only of the subject matter without the assumption of a duty of care by Effective Workplace Solutions. No person should rely on the contents as a substitute for legal of other professional advice.