How does the Privacy Act apply to a workplace investigation?
Workplace investigations are typically used to investigate matters such as misconduct, bullying accusations or breaches of an organisation’s Policies or Code of Conduct. Any workplace investigation involves balancing the sensitive nature of the allegations, and work health and safety obligations. However, it is also important to consider privacy implications around workplace investigations.
The Privacy Act 1988 (Cth) (the Act) governs the way in which organisations handle personal information. Personal information is often collected, used and disclosed as part of the investigation process. It may be information already held by the employer and then used in the investigation or it may be new information collected throughout the course of the investigation. Either way, privacy considerations arise during an investigation process.
Employee Record Exemption
As a starting point, employee records are not covered by the Act and employers are not required to handle employee records in the same way client records are handled, as long as the record is being used in the course of the employee’s employment. An employee record means a record of personal information relating to the employment of the employee, including information about discipline, performance, and conduct.
Employee records also include things like:
- the employee’s name, date of birth and personal phone number
- an employee’s TFN and salary
- the nature and status of the employee’s employment, including terms of engagement
- the Award or Agreement governing the employee’s employment
- the details of the employee’s emergency contact
- health information about an employee
The connection to the employment relationship must be “absolute, exact or precise” in order for the information to be classified as an employee record and exempt from privacy obligations.
Can I collect and use personal information in a workplace investigation?
Workplace investigations are considered to be a “genuine operational reason” for an employer to require employees to provide sensitive/personal information so long as that collection is proportionate.
However, there are many parties involved in a workplace investigation, not all of whom are employees.
Privacy obligations continue during the course of a workplace investigation. The Act applies to workplace investigators to the extent that it applies to them. Workplace investigators should carefully consider whose personal information they are collecting, what the purpose is of collecting the information and how it will be disclosed, and to who it will be disclosed.
Similarly, employers need to consider the reports produced at the conclusion at of an investigation and how they will store the personal information in these reports. Witnesses and respondents may not be entitled to the personal information of others included in the workplace investigation, and in fact only in rare circumstances will be entitled to receive it.
Privacy obligations
Before conducting an investigation, an employer and workplace investigator should consider their privacy framework and how privacy obligations will be complied with throughout the course of the investigation. An organisation should also consider any privacy obligations which may arise in the employee’s employment contract, Code of Conduct or any other policy applicable to the investigation.
When conducting the investigation, it is important to remember:
- Employers/Investigators may be under an obligation to notify employees of the use of their personal information where reasonable
- Not all participants in the investigation are entitled to see investigation materials, so make sure investigation materials are only provided to the individuals permitted to view them
- Employers may need to restrict access to investigation materials and the final report where there are privacy concerns, or consent has not been provided for disclosure.
- One tactic is to use pseudonyms such as Employee A and Employee B
- Another tactic is to prepare an executive summary report which can be provided to other parties, reducing the information shared and thus the privacy concern
Griffin Legal routinely provide workplace investigation services to a variety of different clients. Our familiarity with the investigation process perfectly positions us to provide privacy advice with respect to the administration of a workplace investigation. Contact our team to discuss further.