Case

Which case won?

casea
The case for the employer
  • Our requirement that employees use biometric fingerprint scanning is lawful, reasonable and practical.
  • This measure is part of our site attendance policy. It improves safety in the event of an emergency by avoiding the need to locate the paper sign in and out book to ascertain attendance on site.
  • The site attendance policy formed part of the employee’s contract of employment, so he was obliged to comply with its terms.
  • The biometric data collected by the fingerprint scanners is secure and confidential, as are all employee records.
  • There was no breach of privacy, due to the exemption in the Privacy Act with respect to employee records.
  • We have the right to manage our affairs by requiring employees to comply with company policies.
  • The commission should find that he was not unfairly dismissed.
caseb
The case for the employee
  • My fingerprints and the biometric data they contain constitute “sensitive information” according to the Privacy Act. They are my personal and private property.
  • Employers are not entitled to collect an employee’s sensitive information without proper notice and without their consent.
  • The company did not talk to me or to any other employees about its legal obligations and responsibilities in handling sensitive information.
  • The company supplying the scanners also failed to provide adequate information about the collection and use of personal and sensitive information in accordance with Australian privacy laws.
  • Once my personal biometric data is digitised, it could be difficult to contain its use by third parties, including for commercial purposes. I was never told exactly who was likely to have access to this sensitive information.
  • The Privacy Act exemption does not apply to my records, because the company failed to issue a privacy collection notice as required by the Privacy Act.
  • It is not true that the fingerprint scanners would improve safety, nor that their introduction was reasonably necessary. The commission should find that I was unfairly dismissed.

So, which case won?

Cast your judgment below to find out
Case A Case B

Case B won. You were right!

How people voted
case a34%
case b66%

Expert commentary on the court's decision

“An Australian employer’s knowledge of workplace law must include an appreciation of the Privacy Act and Principles. Compliance with privacy legislation and the need for the adoption of a privacy policy should not be underestimated. Employers should take care and seek advice when implementing new systems and technology that require collecting personal information from their employees.”
Fair Work Commission initial decision in favour of employer

In the case Mr Jeremy Lee v Superior Wood Pty Ltd T/A Superior Wood [2018] FWC 4762, the Fair Work Commission at first instance determined that the dismissal of the employee, Mr Jeremy Lee, was valid. It said that the site attendance policy of the company, Superior Wood, was “reasonably necessary” to improve safety and payroll efficiency.

In considering the application of the Privacy Act, the commission said that despite the fact the company did not have a privacy policy, more weight should be given to the reasonable necessity of the site attendance policy. The commission found that there had been a valid reason for the dismissal.

Having regard to potential breaches of the Privacy Act, the commission concluded that the dismissal was not, in all the circumstances, harsh, unjust or unreasonable.

Successful appeal to Full Bench of Fair Work Commission

In Jeremy Lee v Superior Wood Pty Ltd [2019] FWCFB 2946, Mr Lee appealed the decision to the Full Bench of the Fair Work Commission on several grounds. The main argument centered on the key questions of whether failure to comply with the company’s policy was a valid reason for dismissal and whether the employer’s obligations under the privacy laws had been breached.

Overturning the initial decision, the Full Bench found that the company’s reasons for the dismissing Mr Lee were not valid, and that the dismissal had contravened Australian privacy laws.

Superior Wood had not complied with its privacy obligations. Mr Lee was within his rights to refuse to provide his fingerprint data. The company’s directions to him after he had refused consent were in breach of privacy laws.

Concerns related to confidentiality of fingerprint data found to be valid

The Full Bench also upheld Mr Lee’s concerns regarding management of the fingerprint data and its confidentiality, finding that the company was not aware of and did not comply with its obligations.

Prior to introducing the scanners, Superior Wood should have sought and provided employees with detailed information. It should have given notice to employees that it was seeking to collect what was in fact sensitive information. It should have had a privacy policy and a mechanism to manage and protect the fingerprint data after its collection.

Policies in force at commencement of employment contract

While Superior Wood maintained that Mr Lee’s failure to comply with its site attendance policy amounted to a breach of his employment contract and was a valid reason for his dismissal, the Full Bench determined that compliance with the site attendance policy was not a term covered by the contract:

A strict reading suggests that only those policies, procedures and work rules in place at the time of entry into the contract of employment were within the scope of the requirement to comply.

Compliance with Privacy Act necessary for company’s conduct to be lawful

The Full Bench determined that the legality of Mr Lee’s obligation to comply with his employer’s site attendance policy depended on whether the company’s conduct in directing him to provide fingerprints for scanning by the biometric scanners amounted to “reasonable and lawful” conduct.

Superior Wood’s conduct would have been lawful if it had complied with the Privacy Act, which expressly prohibits acts and practices that breach the Australian Privacy Principles. Mr Lee submitted that Superior Wood’s direction to him to register his fingerprints was captured by prohibitions under the Privacy Act.

Relevance of Australian Privacy Principles

In determining Mr Lee’s appeal, the Full Bench provided considerable detail and invaluable analysis of the relevant sections of the Privacy Act. In particular it gave a detailed review of the relevant Australian Privacy Principles.

Australian Privacy Principle 1 requires the company or business entity to have an up-to-date and clearly expressed policy and about its management of personal information and how it manages storage of that personal information in an open and transparent way.

The Full Bench noted that at the time it was introducing its site attendance policy and directing employees to provide their fingerprints for scanning, Superior Wood did not have the necessary privacy policy, as required by this principle.

The direction to Mr Lee to provide his fingerprints for collection was issued in circumstances where Superior Wood had no privacy policy and no controls in place for the collection, use and storage of the information or data in question.

In addition, Superior Wood had provided no evidence that it or any related entities were able to protect and manage information collected according to privacy obligations.

Members of company management had made little effort to make themselves aware of privacy laws and their obligations. While it had the means to do so, Superior Wood had received no expert advice, nor had it engaged any human resources personnel to provide specialist knowledge about privacy protection and private information management.

Australian Privacy Principle 3 prohibits the collection of an individual’s sensitive information without consent, unless the information is “reasonably necessary” for the company’s activities or for the company’s functioning. Any collection of personal information can only occur by lawful and fair means.

The Full Bench found Superior Wood’s direction for Mr Lee to provide his fingerprints, after he had clearly refused consent, was not “reasonably necessary”, and therefore it was unlawful. Mr Lee was entitled to refuse to follow those directions.

Australian Privacy Principle 3 also defines “sensitive information” to include biometric information to be used for the purpose of automated biometric verification or biometric identification. The Full Bench noted that collection of fingerprint data by the scanners fits the description of sensitive information: “Fingerprint data is unique to the individual and it is derived from an individual’s biometric characteristics, both above and beneath the skin”.

A person is entitled to seek to protect private information if this type. The privacy principle in question applies not only to the collection, but also to the solicitation of sensitive information.

It was further asserted by legal counsel for Mr Lee that even if he had given his consent after being threatened with disciplinary action or dismissal, that consent would have been prompted by the threat and therefore would not have been a genuine consent.

Australian Privacy Principle 5 provides that before or as soon as practicable after collection of personal information, reasonable steps must be taken to notify individuals of a certain number of matters, some of which are to be included in the entity’s privacy policy.

Such notice to employees about the nature of the collection of personal information is to include details about who is doing the collecting, the purposes for which the private information is being collected, the consequences if the information is not collected, how the information may be accessed and corrected, how to make complaints about breaches of the Australian Privacy Principles, how complaints will be dealt with, whether it is likely the information would be disclosed to overseas recipients, and if so, in which countries those recipients may be located.

In addition, it was noted that Superior Wood had failed to issue a privacy collection notice. This fact had weighed considerably in Mr Lee’s favour in the appeal.

The Full Bench of the FWC found that Mr Lee was within his rights to refuse consent to having his fingerprints scanned and registered. Superior Wood had no valid reason to dismiss him.

It was found that the safety and convenience factors, asserted by Superior Wood, did not sufficiently establish that it was reasonably necessary for the employer to collect Mr Lee’s fingerprints, “particularly in circumstances where other options had been identified and had not yet been considered.”

Outcome a hollow victory for employee

Mr Lee’s dismissal was found to be unjust and procedurally unfair. However, it was also found that his reinstatement would be inappropriate. He received 26 weeks’ pay as compensation for unfair dismissal, but was out of a job.

For more information please see our July 2022 article Crackdown on facial recognition on social media.

NOTICE: This article is accurate as at the time of publication and does not constitute legal advice. Please see our legal notices page for more information. Information related to coronavirus can be outdated very quickly.

Latest from Stacks

Fill out this form and one of our local law professionals will be in contact

By submitting this form you agree to the terms of our Privacy policy