Privacy: Your obligations, your rights

Background checks, email monitoring, internet usage limits – ripe ground for an employer to either trip up on the laws or miss out on proper safeguards. PETER VITALE of VECCI runs through the rulebook.

Doing background checks or monitoring emails might seem like a reasonable way for employers to monitor prospective or existing staff, but it is easy to cross an expensive line into invasion of privacy.

By Peter Vitale

Employers are faced with some thorny issues if they want to read staff email, do background checks on prospective employees or anything else dealing with information about staff or prospective employees.

Tread carefully on privacy issues, because without realising it, employers can be legally liable unless they deal correctly with information provided as part of a resume, identified through background checks, or uncovered during routine email monitoring.

Privacy issues

In 2000, the Federal Government amended the Privacy Act to include a collection of 10 “national privacy principles” (NPPs) to give guidance in dealing with private information and the Privacy Commissioner broad powers to investigate and remedy interferences of privacy.

Small businesses with less than $3 million turnover are exempt from the regime unless they are related to a larger business, are a health service (and hold personal health information), perform contract services for the Commonwealth or trade in personal information.

Employee records

Employers can collect, use and store information directly related to an employment relationship without needing to comply with the NPPs, but as soon as the employer wants to use the records used for purposes beyond the employment relationship, the NPPs come into play.

For instance, employers shouldn’t use information about contractors for commercial purposes. Even though contractors are not employees, the lines are often blurred. And information provided by unsuccessful job applicants is covered by the privacy rules.

Monitoring email and internet usage

The legal position in regard to monitoring employee email and internet usage is both complex and unclear, and the issue is under review by most state and territory governments.

In New South Wales, covert email monitoring was prohibited by the Workplace Surveillance Act 2005. Employers in that state are not entitled to monitor or block emails or internet access unless prior notice has been given to employees.

There are exceptions, for example for material that could damage a computer system or that is offensive. But if employees are aware of the monitoring, there is no prohibition against it.

Care must be taken in how that information is stored and used. It could be argued that private emails carry the protections of the NPP regime, whereas work-related emails and internet logs may well constitute ‘employee records’ as discussed above. Any monitoring of emails or internet usage should be the subject of a clear employer policy.

Recruitment – police checks and criminal records

The Human Rights and Equal Opportunity Commission Act provides some protection against discrimination on the basis of criminal record. There is also ‘spent convictions’ legislation in most states and territories, except Victoria and South Australia.

In general terms, these laws mean that an employer may not discriminate against a prospective employee on the basis of ‘old’ criminal convictions, usually at least 10 years old. Exceptions may apply for serious offences and for offences involving dishonesty.

If a police check is to be used as part of a recruitment process, this should be stated in any advertisements for the position. Unless the nature of the position requires otherwise, it should also note that people with a criminal record will not be automatically rejected. Written consent of the applicant will be required for the police check application.

If information is sought informally regarding past convictions, care must be taken in eliciting the information to avoid discrimination claims. Only ask for specific convictions if they are relevant to the inherent requirements of job.

Do not ask questions that would require discussing spent convictions (usually this means various minor convictions over 10 years old, or five years in the case of juvenile offenders) unless specific exemptions to the spent convictions laws apply. In Victoria, police usually apply a policy of not disclosing offences of this nature.

Use of the information

Treat any information obtained confidentially, and use it only for necessary purposes. If a criminal record will be taken into account as part of a recruitment process, it may be wise to give the applicant a chance to explain the circumstances surrounding the conviction and the chance to provide character references, etc.

Recently the Human Rights and Equal Opportunity Commission found against the Victoria Police for refusing to interview a woman with drink driving convictions. The woman had applied for a position with the Emergency Services Telecommunications Authority. The commission found that Victoria Police had discriminated against her by applying the same ‘inherent requirements’ to the position as it would have for a sworn officer.

If a criminal conviction, which is not a ‘spent’ conviction, is disclosed for a current employee, the employer may have grounds for terminating employment on the basis that the employer can no longer have full faith and confidence in the employee. In a decision of the Queensland Industrial Relations Commission, the Brisbane City Council was found justified in terminating the employment of an accounts receivable officer, who it discovered had convictions for theft and forgery.

Information provided by referees

Occasionally a referee relied on by a prospective employee will not be as effusive as everyone might have hoped. In communicating this information back to employees, employers should be extremely careful not to expose themselves, or the referee, to a claim of defamation.

The lesson for employers:

• Make sure employees understand how you treat their private information and email and internet usage. Take care with information collected in a recruitment process as exemptions from privacy obligations do not apply.
• Not all criminal convictions exclude employees from working for you; you must always consider whether there is a genuine inherent requirement affected by the conviction.
• Exercise care in communicating referee feedback to a job applicant.