Case Note: Unfair Dismissal and Employee Privacy


In this case, the Fair Work Commission found that it was unlawful to dismiss an employee for refusing to use fingerprint scanners to sign in and out of work.

EMPLOYMENT – PRIVACY

Jeremy Lee v Superior Wood Pty Ltd [2019] FWCFB 2946

Introduction

The Full Bench of the Fair Work Commission (the Full Bench) recently upheld an appeal from sawmill employee Jeremy Lee (Lee), determining that he was unfairly dismissed for refusing to use fingerprint scanners to sign in and out of work.

Lee’s claim was based on ownership of the biometric data contained within his fingerprint. Lee submitted that a direction from his employer, Superior Wood Pty Ltd (Superior Wood), to register fingerprints was captured by prohibitions under the Privacy Act 1988 (Cth) (the Privacy Act). The Full Bench accepted that the fingerprint data was subject to collection restrictions as “sensitive personal information” which, significantly, required consent from individual employees.

Superior Wood’s failure to consider its obligations under the Privacy Act lead to the conclusion that, given Lee’s refusal to consent, the direction to register fingerprints was unlawful and his dismissal was invalid.

Facts

On 25 October 2017, Superior Wood introduced a biometric fingerprint scanning system as part of a new Site Attendance Policy (the Policy) for employees to check in and out of work sites, requiring employees to register their fingerprints with the company.

Despite several meetings with Superior Wood to discuss the benefits of the Policy, Lee continually refused to comply with this direction, citing concern over Superior Wood’s inability to guarantee “no third party access or use” of the data once it was stored electronically. After several verbal and written warnings advising that a failure to comply with the Policy would result in termination of employment, Lee was dismissed on 12 February 2018.

Lee applied to the Fair Work Commission for unfair dismissal. However, the Fair Work Commissioner (the Commissioner) determined that the Policy was “reasonably necessary” in the context of Superior Wood’s business (its purpose was to improve safety and payroll efficiency) and that the dismissal was consequently valid.

The Commissioner also considered the application of the Privacy Act, and despite acknowledging that it was concerning that Superior Wood did not have a privacy policy in place, she gave more weight to the reasonable necessity of the Policy, ultimately concluding that:

“…having regard to potential breaches of the Privacy Act, there was a valid reason for dismissal…The dismissal was not, in all the circumstances, harsh, unjust or unreasonable and therefore not unfair.”

The Full Bench granted Lee leave to appeal, in order to re-evaluate the reasonableness of the Policy and the purported breaches of the Privacy Act. The most significant grounds of the appeal upon which the case turned are addressed below.

The Appeal

Application of the Policy

The Full Bench considered whether Lee’s failure to comply with the Policy was a valid reason for his dismissal. Lee’s employment contract required him to comply with the “various policies, procedures and work rules that exist… that were attached to his contract in November 2014.” The Full Bench determined that the Policy did not apply to Lee as it was introduced nearly 3 years after his employment commenced and there was no evidence of an agreement to vary his employment contract to incorporate the Policy. The Full Bench, applying a strict reading of the terms of the employment contract, put it this way:

“A strict reading suggests that only those policies, procedures and work rules in place at the time of entry into the contract of employment were within the scope of the requirement to comply.”

The Full Bench was satisfied that compliance with the Policy was not a term of Lee’s employment contract. Therefore, an obligation to comply with the Policy would be contingent upon whether the direction to use the new biometric fingerprint scanners was a “reasonable and lawful direction.”

Lawfulness of the direction

Superior Wood’s conduct could only be lawful if it complied with its obligations under the Australian Privacy Principles (the Principles). Acts and practices that breach the Principles are prohibited under the Privacy Act.

The Full Bench held that Superior Wood failed to comply with the Principles, specifically it:

  • failed to have a privacy policy in place when issuing the Policy and the direction to register fingerprints;
  • did not establish that the collection of sensitive personal information was reasonably necessary for the entity’s functions;
  • failed to obtain genuine individual employee consent;
  • did not issue a comprehensive “privacy collection notice” covering the circumstances of the collection.

Superior Wood’s direction was consequently unlawful and Lee’s failure to comply was not a valid reason for dismissal.

It should be noted that, although a determination as to the “reasonableness” of the direction was now redundant, the Full Bench nevertheless concluded that the direction was in fact unreasonable. The Full Bench further stated that any “consent” that Lee may have given once threatened with dismissal would likely have been invalidated as ingenuine, explaining that:

“A necessary counterpart to a right to consent to a thing is a right to refuse it… A direction to a person to give consent does not vest in that person a meaningful right at all.”

Exemption

Superior Wood argued that the “employee records exemption” applied to its direction to register fingerprints. The exemption applies in circumstances where:

“An act done, or practice engaged in, by an organisation that is or was an employer of an individual, is exempt for the purposes of paragraph 7(1)(ee) if the act or practice is directly related to:

  • a current or former employment relationship between the employer and the individual; and

  • an employee record held by the organisation and relating to the individual.”

The Full Bench rejected this argument, instead interpreting the provision as applying only to records already in possession of the organisation, stating:

“It does not encompass employee records that are yet to be held by an organisation. Nor is the act or practice of generating employee records an act or practice directly related to the relationship between an employer and a particular employee. It is an act or practice in relation to employees generally.”

“A record is not held if it has not yet been created or is not yet in the possession or control of the organisation. The exemption does not apply to a thing that does not exist or to the creation of future records.”

Superior Wood was still in the process of “soliciting” the information and, materially, did not yet “hold” the information for the purposes of the exemption. The Full Bench excluded the application of the exemption, determining that the direction requiring Lee to register his fingerprints in circumstances where he did not consent remained unlawful.

Reasonableness of introducing biometric scanners

The Commissioner originally determined that the Policy was reasonably necessary based on its practicality, safety benefits and overall administrative convenience for Superior Wood’s business.

However, importantly, the Commissioner also noted that:

“Mr Lee had made a concerted effort to identify alternatives to compliance with the Policy and there was no evidence that Superior Wood had taken any steps to evaluate the costs of those alternative data collection methods.”

The Full Bench took this one step further, determining that there was no evidence that it even considered those alternatives at all.

The Commissioner was correct in her determination that some evidence existed indicating small improvements to safety and administrative efficiency under the Policy. However, the Full Bench concluded that these factors did not sufficiently establish that it was reasonably necessary for Superior Wood to collect Lee’s fingerprints, “particularly in circumstances where other options had been identified and had not yet been considered.”

Compliance Impact

This case is an important reminder that organisations need to be cautious when implementing new systems and technology that require collecting an employee’s personal information.

The Full Bench made it clear that Superior Wood, and in turn all Australian organisations, should be aware of, and compliant with, any obligations under the Privacy Act before introducing new policies.

In order to avoid similar unfair dismissal claims, Subscribers should ensure that they:

  • set up a clearly expressed and up-to date privacy policy about the management of personal information;
  • have controls in place when collecting sensitive information to ensure that it is reasonably necessary for the organisation’s functions and that genuine employee consent is obtained;
  • give notice to employees about the nature of the collection of personal information;
  • consult human resource specialists when introducing new policies.

Subscribers should also consider including requirements to consent to the collection of sensitive personal information as a condition when drafting employment contracts.