Are fingerprints employee records? Biometric data in the workplace

In an age driven by technology, employers are increasingly using biometric technologies, such as fingerprint scanning and facial recognition, as a way to deal with employee identification, absenteeism, and workplace surveillance.

A decision of the Fair Work Commission in Jeremy Lee v Superior Wood Pty Ltd [2019] FWCFB 2946 provides valuable insight for employers about directing employees to provide their biometric information. Importantly it also considers the extent to which an employer must comply with obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles when collecting that biometric information.

Key takeaways

Introducing biometric systems (such as fingerprint scanning) into the workplace is not straightforward and it is important that an employer:

• seeks the genuine consent of its employees to the collection, including by providing each employee with a collection notice;
• has a clearly expressed and up-to-date privacy policy;
• has employment contracts with effective privacy provisions and which also provide for ongoing amendments to policies;
• ensures that any contractor involved in collecting or storing biometric information on behalf of the employer complies with all requirements under privacy laws.

Jeremy Lee v Superior Wood case

In December 2017, Superior Wood formally introduced the Site Attendance Policy (the Policy) requiring all employees to record site attendance using a Biometric Scanner.

Mr Lee refused to use the fingerprint scanner and expressed concern about the ownership, control and possible misuse of his biometric data.  Superior Wood warned Mr Lee that his employment would be terminated if he continued to refuse to follow the Policy. After further discussions, the issue could not be resolved and Mr Lee’s employment was terminated. Mr Lee brought an application to the Fair Work Commission seeking a remedy for unfair dismissal under s 394 of the Fair Work Act 2009 (Cth).

While at first instance Mr Lee was found to have been fairly dismissed, this decision was overturned on appeal.

The Full Bench of the Fair Work Commission held that the employer’s direction to Mr Lee to consent to the fingerprint scanning was unlawful because:

• it was not a term of Mr Lee’s employment to comply with policies beyond those existing at the time of entry into his employment contract;
• the employee record exemption did not apply at the time of collection;
• Mr Lee could not be directed to provide his biometric information without his consent;
• there was no evidence that it was reasonably necessary for Superior Wood’s functions or activities that the biometric information be collected; and
• Superior Wood failed to comply with its obligations under privacy laws.

The Full Bench found that a direction that Mr Lee consents to his fingerprint being scanned which was accompanied by a threat of disciplinary action was unreasonable.  His refusal to comply was not a valid reason for dismissal. 

Superior Wood was ordered to pay compensation to Mr Lee of $24,117.08 (plus 9.5% superannuation).  Reinstatement was not appropriate as there was a mutual loss of trust and confidence and the ongoing hostility between the parties was likely to hinder restoration of the employment relationship.

Commentary

The Fair Work Commission’s view that the collection of personal information from an employee by an employer is subject to the requirements of the Privacy Act, appears not to be consistent with comments made by the Office of the Australian Information Commissioner (OAIC). The OAIC has stated that the employee records exemption applies to an employer’s act or practice if it is directly related to either:

• a current or former employment relationship between the employer and an individual;
• an employee record held by the organisation relating to the individual.

In this decision the Full Bench notes that the relevant act must be both directly related to the current or former employment relationship and an employee record held by the organisation and relating to the individual.

At this stage, there has been no commentary by the Federal Court of Australia on the interpretation of this aspect of the employee records exemption.