Fair Work Commission’s surprising interpretation of the Australian Privacy Principles

The recent Fair Work Commission (FWC) decision of Jeremy Lee v Superior Wood Pty Ltd [2019] FWCFB 2946 has provided interesting insight on the extent to which an employer can request your personal data.

Background

Jeremy Lee was employed at Superior Wood for approximately 3 ¼ years, before he was dismissed on 12 February 2019 for failing to comply with Superior Wood’s Site Attendance Policy. The Site Attendance Policy required employees to use newly introduced fingerprint scanners to sign on and off the work site.

Mr Lee refused to provide his fingerprint for the purposes of signing on and off the worksite, citing concerns about the control of his biometric data and the inability of Superior Wood to guarantee no third party would be provided access or use of the data once stored electronically.

Fair Work Commission’s initial decision

In the initial decision of the FWC, the Commissioner found that the Policy was not unjust or unreasonable because, amongst other reasons, Superior Wood had the right to require employees to comply with the Policy, and refusal to comply after adequate warning would not render any dismissal invalid.

The Commissioner also found that although biometric data is ‘sensitive information’ for the purposes of the Privacy Act 1988 (Cth) (Privacy Act), it was reasonably necessary to collect the information for one or more of Superior Wood’s functions or activities under Australian Privacy Principle (APP) 3.3.[1]

The Commissioner found that although Mr Lee was entitled to withhold consent, in doing so he failed to meet a reasonable request of his employer and consequently Superior Wood had a valid reason for dismissal.[2]

Appeal Decision

Mr Lee was granted the right to appeal on 9 grounds, including:

1. the finding that failure to comply with the Policy was a valid reason for dismissal, given potential breaches of the Privacy Act and despite the finding that Mr Lee was entitled to refuse to provide his biometric data; and
2. the finding that there was no breach of the Privacy Act with respect to the collection of information from Mr Lee, because his data was never collected.

Contractual requirement to comply with the Policy

The FWC found that a strict reading of Mr Lee’s employment contract could be read to suggest that Mr Lee was only bound by any policies, procedures and work rules in place at the time of entry into the contract.[3] As the policy in question came into existence following Mr Lee’s employment and there was no variation to the contract, the Commission was not satisfied that compliance with the Policy was a term of Mr Lee’s employment.[4] Consequently, Mr Lee’s obligation to comply with the Policy was dependent on whether the direction to comply was reasonable and lawful.[5]

APP 3

APP 3 outlines when a regulated entity may collect solicited personal information. The FWC’s interpretation of APP 3 is that it applies both to solicitation and collection of personal information and therefore operates at a time before the information is collected. Consequently, any collection of personal information that occurs without first having obtained consent to that collection would be in breach of APP 3.[6] Although Superior Wood did not breach APP 3 in collecting Mr Lee’s information, the direction to collect was directly inconsistent with APP 3.[7] Mr Lee was entitled to refuse to provide his biometric data to Superior Wood.[8]

Employee records exemption

Section 7B(3) of the Privacy Act contains an exemption from an employer’s requirement to comply with the APPs in regards to an employee record held by the organisation and relating to the individual directly related to a current or former employment relationship.

The FWC did not agree that the fingerprint scanners fell under the employee records exemption, as it was inconsistent with the plain words of the statute, which are in the present tense and refer to a record in the possession or control of the organisation.[9] The FWC stated that a record is not held if it has not yet been created or is not yet in the possession or control of the organisation and consequently the exemption will not apply to a thing that doesn’t exist or to the creation of future records.[10]

As the employee records exemption does not apply in these circumstances, the APP applied to Superior Wood in connection with the solicitation and collection of sensitive information, up until the point of collection. Once collected, the employee records exemption will apply and the Privacy Act will no longer regulate the information’s use or disclosure.[11]

Was the direction lawful?

The FWC found that the direction given to Mr Lee and other employees was not lawful. Any consent Mr Lee may have provided once informed he may be disciplined or dismissed for failing to provide consent would likely not be considered genuine consent.

Although it was not necessary to determine whether the direction was reasonable, the FWC stated that the direction was not reasonable, finding:

A necessary counterpart to a right to consent to a thing is a right to refuse it. A direction to a person to give consent does not vest in that person a meaningful right at all.[12]

Decision

The FWC decided to uphold the appeal and quash the decision,[13] which in turn required a rehearing of the case. The FWC was then required to weigh up the factors listed in section 387 of the Fair Work Act as to whether there was a valid reason for the dismissal.

At the rehearing, it was found that the fact there was no valid reason for the dismissal was a significant factor in the circumstances of the case. Although Superior Wood followed the rules of procedural fairness, the weight given to this was not sufficient to outweigh the significance of an absence of valid reason.[14] Accordingly, the dismissal was unjust because Mr Lee was not guilty of the alleged conduct.[15] As the direction Mr Lee was provided was unlawful, he was entitled to refuse to follow it.[16]