Case Summary and Outcome

The Australian Fair Work Commission held that the refusal to give sensitive personal information to an employer cannot be a valid reason for termination of employment. An employee had refused to consent to the use of biometric data through fingerprint scanning for attendance monitoring at his work place and was dismissed when the new system was introduced. The employee had noted his concerns around the use of the scanners and the data and the lack of a guarantee that the data would be securely stored and not shared with third-parties.  He brought an application for unfair dismissal to the Fair Work Commission, and a single Commissioner initially held that the dismissal was fair. On appeal, the Commission emphasized that the employees have a right to protect their sensitive personal information under the country’s Privacy Act, 1988, and held that the employers’ lack of a privacy collection notice and a privacy policy was unlawful. The Commission held that it was not “reasonably necessary” for the employer to have introduced the biometric scanners.

---

Facts

On October 25, 2017, an Australian company, Superior Wood Pty Ltd, convened a meeting with its employees announcing the introduction of fingerprint scanners for attendance purpose. On November 2, 2017, one employee, Jeremy Lee, expressed concerns about the control of his biometric data and the inability of Superior Wood to guarantee no third-party access or use of that data once stored electronically. On November 7, 2017, Lee again informed Superior Wood setting out his concerns regarding the use of the scanners and collection of his biometric data. On November 22, 2017, Superior Wood responded in writing and provided a document from the scanner’s supplier, explaining the nature of the data collected and stating that it could not be used “for any other purpose other than linking your payroll number to a clock in/out time” [para. 8 ].

Subsequent meetings about Lee’s ongoing refusal to use the scanners to sign in and out of work were held throughout December 2017. On December 21, 2017, the policy was officially introduced and on January 2, 2018, the scanners were formally implemented after a seven-week trial period. On January 9, 2018, Lee was given a verbal warning for refusing to use the scanner and warned that a continued failure to follow the policy would result in termination of employment. After subsequent deliberations, Lee’s employment was finally terminated on February 12, 2018.

Lee filed an application regarding an unfair dismissal to the Fair Work Commission which was heard before Commissioner Hunt. On November 1, 2018, the Commissioner concluded that the policy was not harsh, unjust or unreasonable because it improved safety in the event of an emergency by avoiding the need to locate the paper sign in and out book to ascertain attendance on site and the scanners improved the integrity and efficiency of payroll. The Commissioner also noted that Superior Wood had the right to manage its affairs by requiring employees to comply with the policy, and refusal to comply with the policy after adequate caution could lead to valid dismissal.  The Commissioner held that the policy was in accordance with the Privacy Act, 1988 (the Act) since it was reasonably necessary and all the employees other than Lee had given their implied consent to the collection of their data by registering their fingerprint for use by the scanners.

Lee filed an appeal to the Commission against the dismissal by Commissioner Hunt.

---

Decision Overview

Deputy President Sams, Deputy President Gostencnik and Commissioner Mckinnon of the Fair Work Commission (Australia) presided over this case. The central issue was whether refusal to give sensitive personal information to Lee’s employer could be a valid reason for termination of Lee’s employment.

Lee appealed against nine aspects of the Commissioner’s finding, namely:

1. The finding that a failure to comply with the Policy was a valid reason for dismissal.
2. The finding that Lee’s dismissal for protecting ownership of his sensitive information was not harsh, unjust and unreasonable in circumstances where he was threatened with dismissal for refusing to allow the collection of his biometric data.
3. A mistake of fact in finding that the new scanners improved safety.
4. A mistake of fact in finding that Lee did not consent to the collection of his biometric data, when he was never asked for his consent.
5. The finding that the introduction of biometric scanners was reasonably necessary.
6. The finding that other employees gave implied consent by registering their fingerprints, and the collection of data was lawful.
7. The failure to find that implied consent is not sufficient for the purposes of collecting sensitive information.
8. The finding that there was no breach of the Privacy Act with respect to the collection of information from Lee, because his data was never collected.
9. The finding that consent is implied by providing a scan, but that a breach of the Privacy Act only arises if a scan is taken, with the result that Superior Wood could never breach Lee’s privacy if no scan was taken.

Superior Wood submitted that despite the absence of a privacy policy and privacy collection notice, it did not breach the Act because an exemption applied in relation to the fingerprint scanner under section 7B(3) of the Act. This provision states that an act done, or a practice engaged in, by an employer that is directly related to a current or former employment relationship between the employer and the individual and an employee record held by the organization and relating to the individual, is exempt from the obligation to comply with the Australian Privacy Principles. Superior Wood argued that all the records generated by an employer, including the future records, were within the scope of that exception.

The Commission observed that the Act applied to “APP entities”, which includes organizations that are body corporate, and that the Superior Wood constituted an APP entity and so was governed by the Act [para. 29]. It assessed the case with reference to the Privacy Principles, contained within the Act.

In respect of Lee’s appeal against the Commissioner’s finding that the failure to comply with the Policy was a valid reason for dismissal, the Commission examined principle 3. Principle 3 deals with the collection of personal information that is solicited by an APP entity and prohibits the collection of sensitive information about an individual, unless that person consents to the collection of the information, and the information is reasonably necessary for one or more of the entity’s functions or activities. ‘Sensitive information’ includes biometric information that is to be used for the purpose of automated biometric verification or biometric identification. While applying this principle to the facts of the present case, the Commission observed that Superior Wood did not breach this principle by collecting Lee’s sensitive information without his consent. However, the Commission emphasized that principle 3 had a much broader application and applied to cases of the solicitation of information in addition to the actual collection of information, contrary to what was contended by Superior Wood. In the present case, direction was issued to Lee and his fingerprint was solicited (or requested) for attendance purposes. The Commission held that this direction issued by Superior Wood was therefore directly inconsistent with principle 3 [para. 47].

The Commission applied principle 5 which deals with the notification of the collection of personal information, and provides that, at, before or (if that is not practicable) as soon as practicable after the time that an APP entity collects personal information, it must take reasonable steps to notify the individual of certain specified matters, or to otherwise ensure the individual is aware of those matters. The Commission made three important observations. First, that Superior Wood had failed to issue a privacy collection notice to Lee (or any other employee). While Lee was informed of the purpose for collection of the information, and consequences for refusal, he was not reasonably notified of additional matters required by principle 5 such as the entities that would have access to his sensitive information, Superior Wood’s privacy policy, information in relation to privacy complaints and how to access his personal information. Second, the Commission observed that Superior Wood did not have a privacy policy in place, which violated Principle 1 as well. Third, it was completely practicable for Superior Wood to provide this information to Lee, either before or at the time it sought to register his fingerprint for use with the scanners since the formal implementation of the scanners was trialled throughout November and December 2017 and only commenced from early January 2018.

The Commission rejected Superior Wood’s contention that they were exempt from compliance with the Privacy Principles, finding that “it is inconsistent with the plain words of the statute, which are in the present tense and refer to a record “held by” the organization” [para. 56]. The Commission emphasized that the exemption section was applicable only to the records that had already been obtained and held by the organization, and did not encompass future records of the employee.

Accordingly, the Commission held that “the direction to Mr. Lee to submit to the collection of his fingerprint data, in circumstances where he did not consent to that collection, was not a lawful direction” and so “not a valid reason for dismissal” [para. 58]. It noted that any consent given only after being told that he faced dismissal “would not have been genuine consent” [para. 58].

The Commission upheld Lee’s argument that his dismissal was harsh, unjust and unreasonable. It reiterated the lack of genuine consent and rejected Superior Wood’s argument that Lee’s position in relation to the use of his biometric data by the scanners was at odds with his position in relation to DNA in connection with drug and alcohol testing. The Commission held that there was no evidence of Lee’s position in respect of drug and alcohol testing, and so Superior Wood could not rely on any alleged contradiction.

The Commission held that it was not “reasonably necessary” for Superior Wood to introduce the biometric scanners. It highlighted that Superior Wood had not evaluated the costs of data capture alternatives to fingerprint scanners like key fobs and swipe cards, computer and mobile login systems, and SMS and email options, and noted that even though the company gave evidence that Lee would not have been able to be paid through the payroll system if he did not use the scanners, he was in fact paid after the scanners were formally introduced. The Commission also noted that there was no evidence that the scanning would help with more accurate time recording or allow Superior Wood to locate Lee in an emergency. Accordingly, the Commission held that it was not “reasonably necessary” for Superior Wood to proceed with the collection of Lee’s fingerprint, particularly in circumstances where other options had been identified and had not yet been considered.

The Commission emphasized that none of the entities which had access to biometric information collected by Superior Wood, had an actual mechanism in place to protect and manage information, consistent with its obligations under the Act, and stressed that Lee was entitled to protect his biometric information.

In respect of Lee’s argument that there was no evidence of improved safety with the new scanners, the Commission conceded that point but found that there was a sufficient evidentiary basis for the Commissioner to find that the scanners, through their capacity to display attendance records on supervisor’s phones, offered safety benefits, even though the main function was clearly to improve its payroll operation by helping to keep track of people on site. Accordingly, the Commission rejected this ground of appeal.

The Commission rejected Lee’s argument that the Commissioner could not have found that he had consented to the collection of his data as he had never been asked for his consent. It observed that Lee was indeed asked to consent as he himself admitted that Skene Finlayson, Director of Superior Wood, asked him if he would use the scanner, to which he had refused.

The Commission also rejected Lee’s argument that a higher standard of consent was required for sensitive information and that the collection of data from the other Superior Wood employees was obtained through unlawful and unfair means. The Commission noted that Commissioner Hunt did not have to look at issues outside of those directed related to Lee’s dismissal and, in any event, the other Superior Wood employees had given implied consent by registering their fingerprints.

In conclusion, the Commission ruled that there was no valid reason for the dismissal under section 387(a) of the Fair Work Act, 2009 which states that, “in considering whether it is satisfied that a dismissal was harsh, unjust or unreasonable, FWA must take into account: whether there was a valid reason for the dismissal related to the person’s capacity or conduct (including its effect on the safety and welfare of other employees)” [para. 91]. Accordingly, the Commission upheld the appeal and quashed the decision passed by Commissioner Hunt. It found that, while there were no procedural irregularities in dismissing Mr. Lee under section 387 of the Fair Work Act, the scales tilted in favor of Mr. Lee since he was not guilty of the conduct alleged and he had right to protect his sensitive personal information.

---