Digital Rights, Privacy, Data Protection and Retention
Meta Platforms Ireland
Closed Expands Expression
Global Freedom of Expression is an academic initiative and therefore, we encourage you to share and republish excerpts of our content so long as they are not used for commercial purposes and you respect the following policy:
Attribution, copyright, and license information for media used by Global Freedom of Expression is available on our Credits page.
This case is available in additional languages: View in: Español View in: العربية
On October 25, 2017, an Australian company, Superior Wood Pty Ltd, convened a meeting with its employees announcing the introduction of fingerprint scanners for attendance purpose. On November 2, 2017, one employee, Jeremy Lee, expressed concerns about the control of his biometric data and the inability of Superior Wood to guarantee no third-party access or use of that data once stored electronically. On November 7, 2017, Lee again informed Superior Wood setting out his concerns regarding the use of the scanners and collection of his biometric data. On November 22, 2017, Superior Wood responded in writing and provided a document from the scanner’s supplier, explaining the nature of the data collected and stating that it could not be used “for any other purpose other than linking your payroll number to a clock in/out time” [para. 8 ].
Subsequent meetings about Lee’s ongoing refusal to use the scanners to sign in and out of work were held throughout December 2017. On December 21, 2017, the policy was officially introduced and on January 2, 2018, the scanners were formally implemented after a seven-week trial period. On January 9, 2018, Lee was given a verbal warning for refusing to use the scanner and warned that a continued failure to follow the policy would result in termination of employment. After subsequent deliberations, Lee’s employment was finally terminated on February 12, 2018.
Lee filed an application regarding an unfair dismissal to the Fair Work Commission which was heard before Commissioner Hunt. On November 1, 2018, the Commissioner concluded that the policy was not harsh, unjust or unreasonable because it improved safety in the event of an emergency by avoiding the need to locate the paper sign in and out book to ascertain attendance on site and the scanners improved the integrity and efficiency of payroll. The Commissioner also noted that Superior Wood had the right to manage its affairs by requiring employees to comply with the policy, and refusal to comply with the policy after adequate caution could lead to valid dismissal. The Commissioner held that the policy was in accordance with the Privacy Act, 1988 (the Act) since it was reasonably necessary and all the employees other than Lee had given their implied consent to the collection of their data by registering their fingerprint for use by the scanners.
Lee filed an appeal to the Commission against the dismissal by Commissioner Hunt.
Deputy President Sams, Deputy President Gostencnik and Commissioner Mckinnon of the Fair Work Commission (Australia) presided over this case. The central issue was whether refusal to give sensitive personal information to Lee’s employer could be a valid reason for termination of Lee’s employment.
Lee appealed against nine aspects of the Commissioner’s finding, namely:
The Commission observed that the Act applied to “APP entities”, which includes organizations that are body corporate, and that the Superior Wood constituted an APP entity and so was governed by the Act [para. 29]. It assessed the case with reference to the Privacy Principles, contained within the Act.
In respect of Lee’s appeal against the Commissioner’s finding that the failure to comply with the Policy was a valid reason for dismissal, the Commission examined principle 3. Principle 3 deals with the collection of personal information that is solicited by an APP entity and prohibits the collection of sensitive information about an individual, unless that person consents to the collection of the information, and the information is reasonably necessary for one or more of the entity’s functions or activities. ‘Sensitive information’ includes biometric information that is to be used for the purpose of automated biometric verification or biometric identification. While applying this principle to the facts of the present case, the Commission observed that Superior Wood did not breach this principle by collecting Lee’s sensitive information without his consent. However, the Commission emphasized that principle 3 had a much broader application and applied to cases of the solicitation of information in addition to the actual collection of information, contrary to what was contended by Superior Wood. In the present case, direction was issued to Lee and his fingerprint was solicited (or requested) for attendance purposes. The Commission held that this direction issued by Superior Wood was therefore directly inconsistent with principle 3 [para. 47].
The Commission rejected Superior Wood’s contention that they were exempt from compliance with the Privacy Principles, finding that “it is inconsistent with the plain words of the statute, which are in the present tense and refer to a record “held by” the organization” [para. 56]. The Commission emphasized that the exemption section was applicable only to the records that had already been obtained and held by the organization, and did not encompass future records of the employee.
Accordingly, the Commission held that “the direction to Mr. Lee to submit to the collection of his fingerprint data, in circumstances where he did not consent to that collection, was not a lawful direction” and so “not a valid reason for dismissal” [para. 58]. It noted that any consent given only after being told that he faced dismissal “would not have been genuine consent” [para. 58].
The Commission upheld Lee’s argument that his dismissal was harsh, unjust and unreasonable. It reiterated the lack of genuine consent and rejected Superior Wood’s argument that Lee’s position in relation to the use of his biometric data by the scanners was at odds with his position in relation to DNA in connection with drug and alcohol testing. The Commission held that there was no evidence of Lee’s position in respect of drug and alcohol testing, and so Superior Wood could not rely on any alleged contradiction.
The Commission held that it was not “reasonably necessary” for Superior Wood to introduce the biometric scanners. It highlighted that Superior Wood had not evaluated the costs of data capture alternatives to fingerprint scanners like key fobs and swipe cards, computer and mobile login systems, and SMS and email options, and noted that even though the company gave evidence that Lee would not have been able to be paid through the payroll system if he did not use the scanners, he was in fact paid after the scanners were formally introduced. The Commission also noted that there was no evidence that the scanning would help with more accurate time recording or allow Superior Wood to locate Lee in an emergency. Accordingly, the Commission held that it was not “reasonably necessary” for Superior Wood to proceed with the collection of Lee’s fingerprint, particularly in circumstances where other options had been identified and had not yet been considered.
The Commission emphasized that none of the entities which had access to biometric information collected by Superior Wood, had an actual mechanism in place to protect and manage information, consistent with its obligations under the Act, and stressed that Lee was entitled to protect his biometric information.
In respect of Lee’s argument that there was no evidence of improved safety with the new scanners, the Commission conceded that point but found that there was a sufficient evidentiary basis for the Commissioner to find that the scanners, through their capacity to display attendance records on supervisor’s phones, offered safety benefits, even though the main function was clearly to improve its payroll operation by helping to keep track of people on site. Accordingly, the Commission rejected this ground of appeal.
The Commission rejected Lee’s argument that the Commissioner could not have found that he had consented to the collection of his data as he had never been asked for his consent. It observed that Lee was indeed asked to consent as he himself admitted that Skene Finlayson, Director of Superior Wood, asked him if he would use the scanner, to which he had refused.
The Commission also rejected Lee’s argument that a higher standard of consent was required for sensitive information and that the collection of data from the other Superior Wood employees was obtained through unlawful and unfair means. The Commission noted that Commissioner Hunt did not have to look at issues outside of those directed related to Lee’s dismissal and, in any event, the other Superior Wood employees had given implied consent by registering their fingerprints.
In conclusion, the Commission ruled that there was no valid reason for the dismissal under section 387(a) of the Fair Work Act, 2009 which states that, “in considering whether it is satisfied that a dismissal was harsh, unjust or unreasonable, FWA must take into account: whether there was a valid reason for the dismissal related to the person’s capacity or conduct (including its effect on the safety and welfare of other employees)” [para. 91]. Accordingly, the Commission upheld the appeal and quashed the decision passed by Commissioner Hunt. It found that, while there were no procedural irregularities in dismissing Mr. Lee under section 387 of the Fair Work Act, the scales tilted in favor of Mr. Lee since he was not guilty of the conduct alleged and he had right to protect his sensitive personal information.
Decision Direction indicates whether the decision expands or contracts expression based on an analysis of the case.
By recognizing employees’ right to privacy and the need for genuine consent to the collection of data which cannot be obtained through threat of dismissal, the decision of the Fair Work Commission has expanded expression. This is an important judgment for workplace privacy rights.
Global Perspective demonstrates how the court’s decision was influenced by standards from one or many regions.
Case significance refers to how influential the case is and how its significance changes over time.
Let us know if you notice errors or if the case analysis needs revision.