By Calum Woods and Lindsay Carroll, NRA Legal
Once thought to be only within the realm of science fiction, biometric time and attendance systems have been steadily replacing timesheets for the past decade.
In its truest sense, a biometric scanner is anything that can track the metrics of a person’s body, including: facial features, fingerprints, or even the gait of a person’s walk. The advantage of biometrics is that they are unique to an individual, and are significantly more difficult to manipulate than traditional forms of identification.
While these systems have been linked to reduced administrative costs and increased safety in workplaces, they are not infallible. In one recent example, a former franchisee of 7-Eleven Pty Ltd (7-Eleven) who had been required to implement fingerprint scanners as a means to prevent underpayments, introduced an unlawful “cash back” system to deliberately circumvent the system. The former franchisee was later fined $154,225 for the contraventions.
Despite the increasing prevalence of biometric scanners, there has not been a significant challenge to the legality of such systems in the workplace. Given the significant concerns around privacy in today’s climate, it is critical that businesses considering implementing these scanners have a firm grasp of their obligations.
The recent case of Mr Jeremy Lee v Superior Wood Pty Ltd T/A Superior Wood [2018] FWC 4762 represents the first significant challenge to the collection of employees’ biometric data, and the application of the Australian Privacy Principles in an employment context.
Background
In October 2017, Superior Wood Pty Ltd (Superior Wood) announced plans to implement a new biometric time and attendance system that, like 7-Eleven, required employees to sign-in using their fingerprint.
Mr Jeremy Lee was an employee of Superior Wood with over 3 years’ service across two sites in regional Queensland. Of the 400 employees at Superior Wood’s site at Imbil, Mr Lee was the only employee who refused to use the scanners, citing concerns around the collection of his private information.
Superior Wood held meetings with Mr Lee between November 2017 and February 2018 to discuss his concerns, however Mr Lee insisted on continuing to use a paper-based timesheet. Superior Wood dismissed Mr Lee for failing to comply with its Site Attendance Policy, which required employees to use the scanners.
Mr Lee subsequently filed an application for relief from unfair dismissal with the Fair Work Commission. In short, Mr Lee alleged that the Site Attendance Policy did not amount to a lawful and reasonable direction, as it was in contravention of the Privacy Act.
Commissioner Hunt expressed concern that neither Superior Wood nor the provider of the biometric scanners had a suitable privacy policy in place at the relevant time, as required by the Australian Privacy Principles.
In dealing with the exemption in the Privacy Act with respect to employee records, the Commissioner considered that the exemption would only apply “if the record had been obtained or held.” Commissioner Hunt found that the exemption did not ameliorate Superior Wood of its obligation under the Australian Privacy Principles to issue to Mr Lee with a “privacy collection notice.”
Furthermore, the Commissioner found that Superior Wood could not lawfully direct Mr Lee to provide his consent to Superior Wood collecting his biometric data. Instead, when Mr Lee’s consent was not forthcoming, Superior Wood informed him that termination was a likely outcome.
While finding that a breach of the Privacy Act may have occurred in the manner in which a “privacy collection notice” was given to employees, the Commissioner nonetheless found that the Site Attendance Policy itself was lawful.
Accordingly, it was held that Mr Lee had failed to follow a lawful and reasonable direction, and that there was a valid reason for dismissal.
Issues on appeal
Mr Lee subsequently filed an appeal of the Commissioner’s decision, arguing that the decision “overrules” his ownership of his biometric information.
In deciding to grant permission for Mr Lee to appeal the Commissioner’s decision, the Full Bench of the Commission found that there was an arguable case of error.
The Full Bench identified that the following questions to be determined on appeal, raised important and novel issues that had not been the subject of any previous Full Bench decision:
- whether the direction for Mr Lee to comply with the Site Attendance Policy, which required him to use the biometric scanners, was lawful and/or reasonable;
- whether Superior Wood was required to notify Mr Lee of its obligations under the Privacy Act prior to the collection of his biometric data; and
- whether the employee records exemption in the Privacy Act includes the process by which the employee record is obtained or created.
This case has the potential to significantly impact how employers are required to deal with the records of employees, and we will be closely monitoring any developments.
What this means for employers
While in most cases the employee record exemption in the Privacy Act will apply to records held by employers relating to employees, this case raises two important issues:
- Whether the process of obtaining an employee record is exempt from the requirements in the Privacy Act; and
- Whether a direction from an employer is reasonable and/or lawful where it would require an employee to do something that they cannot be required to do without their consent.
The employee record exemption in section 7B of the Privacy Act applies to “an act done, or practice engaged in… if the act or practice is directly related to: (a) a current or former employment relationship between the employer and the individual; and (b) an employee record held by the organisation and relating to the individual.”
It seems apparent that the employee record exemption will only apply if and once the employee record is held by an organisation. It follows that until the record is held, the exemption will not apply, and the requirements in the Privacy Act relating to the collection of the information must be adhered to.
The result of the appeal will have serious ramifications for employers who utilise biometric clocks in their workplaces – the outcome being that employees will be potentially able to exercise a right to refuse to provide their employers with their biometric information.
If you have concerns around the collection of employee’s personal information or how time and attendance is being tracked in your workplace, contact the NRA workplace relations hotline on 1800 RETAIL (738 245).