Workplace biometric scanning: Emerging issues in employment law

Due to increasing technological developments and the focus on efficiencies in the workplace, we are seeing an evolution in the different ways employers are looking to collect and use employee information.

In Australia, the rising use of workplace fingerprint scanning devices to collect biometric data has raised some important privacy issues for employers.

In a recent decision of the Full Bench of the Fair Work Commission, Jeremy Lee v Superior Wood Pty Ltd [2019] FWCFB 2946, an employee was found to have been unfairly dismissed for refusing to use a fingerprint scanner to record on-site attendance. There is no doubt that this case raised ‘important, novel and emerging issues’¹ surrounding the collection of employee data in the workplace.

Case Example

Jeremy Lee was employed by Superior Wood as a casual General Hand at a sawmill in Queensland.

Citing safety and payroll efficiency reasons, Superior Wood introduced fingerprint scanners to replace their paper-based 'sign in'/'sign out' system and implemented a policy requiring all employees to use the new biometric scanning system to record on-site presence.

Mr Lee was concerned about the collection and storage of his personal information (fingerprint) and Superior Wood’s inability to guarantee that no third party would be allowed access to the personal information once electronically stored.

On this basis, he refused, from the outset, to register his fingerprint for scanning.

Employees other than Mr Lee had given their implied consent to the collection of their personal information by registering their fingerprint for use by the scanners. Mr Lee did not give express or implied consent to the collection of his sensitive personal information by the scanners.

Superior Wood met on multiple occasions with Mr Lee ‘to discuss his concerns’² and warn him that his continued failure to comply with the new scanning policy could result in his employment being terminated. Mr Lee maintained his refusal and proposed to instead continue using the old paper-based method or a swipe-card system.

Eventually, Mr Lee was dismissed for not complying with the policy.

Mr Lee then commenced unfair dismissal proceedings.

First instance decision

At first instance, the Fair Work Commission held that Mr Lee was not unfairly dismissed and it was reasonable for Superior Wood to request the biometric data (fingerprints) from its employees.³

Commissioner Hunt reasoned that while Mr Lee was entitled to refuse to consent to Superior Wood collecting his fingerprint, in doing so he was in breach of their policy and therefore validly dismissed.

Mr Lee appealed the decision.

Full Bench decision

The Full Bench upheld Mr Lee’s appeal and quashed the original decision.

In taking a strict view of Mr Lee’s employment contract, it was found that he was only bound by Superior Wood’s policies, procedures and workplace rules that were in place at the time he entered into his contract.⁴ Accordingly, Mr Lee was not contractually obliged to comply with the new scanning policy (that came into existence after he commenced employment).

The Full Bench also considered whether Superior Wood’s direction to Mr Lee to comply with the policy and use the scanners to sign in and out of work, was a reasonable and lawful direction.

Superior Wood submitted that by requiring Mr Lee to consent to the collection of his biometric data it did not breach the Privacy Act 1988 (Cth) (Privacy Act) as the ‘employee records exemption’⁵ applied in relation to the collection of personal information via the fingerprint scanner. However, the Full Bench indicated that the exemption applies only to ‘records obtained and held by an organisation’⁶ but not to records that have not yet been created or to the creation of future records.

Consequently, the exemption was held not to apply and the direction by Superior Wood was held to be unlawful, being directly inconsistent⁷ with Mr Lee’s rights under the Privacy Act. This is because the Privacy Act prohibits both the collection and solicitation of sensitive personal information (such as fingerprints), unless an individual consents to that collection.

It was noted, however, that once collected, the exemption would apply and Superior Wood’s obligations under the Privacy Act would cease.

Then, in weighing up relevant factors in the Fair Work Act 2009 (Cth)⁸ the Full Bench determined on balance, that Mr Lee’s termination was unjust and he was dismissed unfairly.⁹

Key lessons for employers

A number of significant implications arise for employers from this landmark decision, particularly for those entities subject to the Privacy Act¹⁰ due to the novel application of the employee records exemption.

We recommend employers adopt the following risk minimisation strategies:

• Review employment contracts, specifically to ensure employees are required to comply with all current and future workplace policies.
• Ensure employers have in place a privacy policy that is compliant with the Privacy Act that clearly sets out the requirements relating to the collection of an employee’s personal information i.e. the kinds of personal information collected, how and why it collects that information, and whether the personal information is likely to be disclosed to another entity.
• Ensure there are proper systems and mechanisms in place to alleviate employee concerns surrounding potential breaches of the privacy of their personal information.
• In respect of the collection of sensitive personal information (for example, fingerprints or health information), ensure that voluntary consent is obtained from employees where required under the Privacy Act, or that an employee’s employment contract provides for this consent.

Our Employment and Privacy team would be pleased to assist your business to navigate the complexities arising from the intersection of employment and privacy law.

¹Jeremy Lee v Superior Wood Pty Ltd t/a Superior Wood [2019] FWCFB 95 at [35]
²Ibid at [6]
³Jeremy Lee v Superior Wood Pty Ltd t/a Superior Wood [2018] FWC 4762
⁴Jeremy Lee v Superior Wood Pty Ltd [2019] FWCFB 2946 at [23]
⁵Privacy Act 1988 (Cth) s 7B(3)
⁶Ibid at [56]
⁷Ibid at [48]
⁸Fair Work Act 2009 (Cth) s 387
⁹Ibid at [102]
¹⁰Generally, private organisations with an annual turnover exceeding $3 million and Commonwealth or Federal agencies