Employee monitoring in Australia and what the law requires of employers

There is no single Australian law that tells employers what they can and cannot do when monitoring their staff. Instead, employee monitoring sits at the intersection of several legal regimes: state and territory workplace surveillance laws, recording or surveillance device laws, the federal Privacy Act 1988 (Cth), and employment law obligations under the Fair Work Act 2009 (Cth).

Whether a particular monitoring arrangement is lawful depends on where your employees work, what you are monitoring, whether you have told them about it, and how you use the information afterwards. Most monitoring is lawful if it is transparent, tied to a genuine business purpose, and proportionate. The risk areas are the ones employers tend to rush: audio recording, covert surveillance, and switching on monitoring without notice.

This article sets out who the monitoring laws apply to, the core duties they impose on employers, what happens if you get it wrong, and a checklist you can work through before you roll out monitoring. It is general information, not legal advice, and the rules differ between states and territories.

Who the monitoring laws apply to

Two states have dedicated workplace surveillance laws, and the rules differ everywhere else:

• NSW: the Workplace Surveillance Act 2005 (NSW) applies to employers with employees working in NSW. It regulates three kinds of surveillance: camera surveillance, computer surveillance (including emails, internet use and keystrokes) and tracking surveillance (such as GPS on vehicles or devices).
• ACT: the Workplace Privacy Act 2011 (ACT) applies in ACT workplaces and covers similar ground, with additional duties such as consulting workers before surveillance starts.
• Recording laws: audio surveillance is regulated by state and territory surveillance device legislation, and the law that applies is the law of the state or territory where the recording happens.
• Federal privacy law: the Privacy Act 1988 (Cth) applies to businesses whose annual turnover in the previous financial year exceeded $3 million, subject to exemptions.
• Employment law: the Fair Work Act 2009 (Cth) governs how monitoring evidence can be used in performance management and dismissal decisions.

In the states and territories without a dedicated workplace surveillance act, monitoring is still regulated. Surveillance device and listening device laws apply, privacy expectations still matter, and employment law protections still bite. If your team works across more than one state, including remotely, you generally need to comply with the strictest of the applicable regimes.

The duty to give written notice before monitoring starts

The clearest, and most easily missed, duty is notice. In NSW and the ACT it is a legal requirement, and in every other state it is the most effective protection you have against a dispute about how monitoring data was gathered.

Under s 10 of the Workplace Surveillance Act 2005 (NSW), surveillance of an employee must not start without prior written notice. The notice must be given at least 14 days before the surveillance starts, although an employee can agree to a shorter period. It must state the kind of surveillance (camera, computer or tracking), how it will be carried out, when it will start, whether it will be continuous or intermittent, and whether it will run for a limited period or indefinitely. Notice by email counts as written notice.

Tracking surveillance has an extra requirement. If you are tracking a vehicle or other thing, s 13 of the Act requires a notice clearly visible on the vehicle or thing itself.

The ACT regime works the same way. Under s 13 of the Workplace Privacy Act 2011 (ACT), an employer may only conduct surveillance of a worker if it gives written notice at least 14 days in advance (or an agreed shorter period) and conducts the surveillance in line with the notice. The ACT adds a consultation duty: s 14 requires the employer to consult with the worker in good faith during the notice period, giving the worker a genuine opportunity to influence how the surveillance is carried out.

Both Acts also deal with new starters. If surveillance is already running when someone joins, notice must be given before the new employee starts work.

For employers outside NSW and the ACT, notice is not always a statutory requirement, but it should be treated as one. A written notice given before you switch anything on prevents the two most common problems: employees discovering the monitoring later and claiming it was unfair, and evidence being challenged because it was gathered secretly.

The duty to keep surveillance out of private areas

Even with notice, some places are off limits. In NSW, s 15 of the Workplace Surveillance Act 2005 (NSW) absolutely prohibits surveillance of an employee in any change room, toilet facility, or shower or other bathing facility, with a maximum penalty of 50 penalty units. In the ACT, s 41 of the Workplace Privacy Act 2011 (ACT) prohibits surveillance of a worker in a list of prohibited non-work areas: toilets, change rooms, showers or bathing facilities, parent or nursing rooms, prayer rooms, sick bays and first-aid rooms. The maximum penalty is also 50 penalty units.

Courts recognise that some areas carry a heightened expectation of privacy even where they are not absolutely protected. In NSW, when deciding whether to authorise covert surveillance, a Judge must have regard to the heightened privacy expectation of employees in recreation rooms and meal rooms.

For employers in other states, the same principle applies as a matter of trust and fairness. Surveillance in bathrooms or change rooms is the fastest way to destroy workplace trust, and it will make any subsequent disciplinary action very hard to defend.

The duty to avoid covert surveillance

Covert surveillance is surveillance the employee does not know about. It is not a lawful shortcut for investigating suspicions. In NSW, s 19 of the Workplace Surveillance Act 2005 (NSW) prohibits covert surveillance of an employee at work unless it is authorised by a covert surveillance authority, with a maximum penalty of 50 penalty units.

An authority is not something you apply for casually. Under s 23, an employer may apply to a Judge for an authority to establish whether particular employees are involved in unlawful activity while at work. The application must set out the grounds for suspicion and what other investigative steps have already been tried. Under s 25, the Judge may only issue the authority if satisfied there are reasonable grounds, taking into account the seriousness of the unlawful activity. The ACT scheme is similar: covert surveillance requires an authority from the Magistrates Court, and the employer must report to the court on how the authority was used.

The practical translation is simple. Hidden cameras or secretly installed tracking software are almost always unlawful. If you genuinely suspect theft or serious misconduct, the lawful path is an application to a court for an authority, or getting advice first, not installing a hidden device.

The duty to get audio recording right

Audio is the area where employers most often commit an offence by accident. Recording customer calls, meetings or conversations is regulated by state and territory surveillance device laws, and the rules differ significantly between jurisdictions.

In NSW, s 7 of the Surveillance Devices Act 2007 (NSW) makes it an offence to knowingly use a listening device to record a private conversation, whether or not you are a party to it, unless an exception applies. The maximum penalty is 500 penalty units for a corporation, or 100 penalty units and up to five years' imprisonment for an individual. Publishing or communicating an unlawfully obtained recording is a separate offence under s 11.

Other states and territories have their own regimes: the Surveillance Devices Act 1999 (Vic), the Invasion of Privacy Act 1971 (Qld), the Surveillance Devices Act 1998 (WA), the Surveillance Devices Act 2016 (SA), the Listening Devices Act 1991 (Tas), the Surveillance Devices Act 2007 (NT) and the Listening Devices Act 1992 (ACT). The consent model differs: some jurisdictions require every party to a conversation to consent before it can be recorded, while others allow a participant to record with their own consent. What is lawful in one state can be an offence in the state next door.

For call recording, this means the consent and notification model you need depends on where the person being recorded is located, not just where your business is based. A recorded phone call involving someone in one state may be subject to a different rule than one involving someone in another. This is an area where a small amount of legal advice up front is usually worth the cost.

Privacy Act duties for monitoring data

Monitoring generates personal information: footage, recordings, location logs, and message and browsing histories. The Privacy Act 1988 (Cth) regulates how that information is collected, used, stored and disclosed, but only for organisations it covers.

Under s 6D of the Privacy Act 1988 (Cth), a business is a small business, and generally outside the Act, if its annual turnover in the previous financial year was $3 million or less. If your turnover was over $3 million, the Australian Privacy Principles apply to your handling of monitoring data. Some small businesses are caught regardless of turnover, for example health service providers, credit reporting bodies and contracted service providers for Commonwealth contracts.

The employee records exemption is narrower than it sounds. s 7B(3) of the Act exempts handling of an employee record only where the act or practice is directly related to a current or former employment relationship and to an employee record held by the organisation. Surveillance footage, location logs and web browsing histories may not qualify as employee records, and the exemption never covers independent contractors, who are not employees at all. Treating the exemption as a blanket licence to do anything with monitoring data is a common and costly mistake.

If you are covered, the Australian Privacy Principles require you to collect personal information only where it is reasonably necessary, use it only for the purpose it was collected, keep it secure, and be open about your practices. A monitoring program that collects far more than needed, or holds recordings indefinitely without adequate security, will struggle to meet those standards. If monitoring data is lost or accessed without authorisation and creates a real risk of serious harm, the Notifiable Data Breaches scheme in the Act may require you to notify affected individuals and the Office of the Australian Information Commissioner.

Using monitoring evidence fairly in employment decisions

Monitoring data frequently ends up in performance management, disciplinary processes and dismissal decisions. The monitoring itself can be perfectly lawful and still land you in trouble if you use the results unfairly.

Under the Fair Work Act 2009 (Cth), a dismissal must not be harsh, unjust or unreasonable, and an employer must not take adverse action against an employee for a prohibited reason. If monitoring evidence is the basis for a dismissal, an employer should be able to show that the employee knew the monitoring was happening, that the expectations were clear, and that the employee was given a genuine chance to respond to the allegations. Secretly gathered evidence, or monitoring rolled out as a targeted response to one individual, is much harder to defend.

Procedural fairness matters as much as the evidence itself. An employer that can show a documented policy, consistent application and a fair process will almost always be in a stronger position than one that cannot, regardless of what the footage or logs show.

What happens if you get it wrong

The consequences of getting monitoring wrong range from criminal fines to dispute costs and damaged trust:

• NSW offences: surveillance in change rooms or bathrooms, covert surveillance without an authority, and blocking emails without a notified policy each carry a maximum penalty of 50 penalty units under the Workplace Surveillance Act 2005 (NSW). Failing to secure covert surveillance records carries a penalty of 20 penalty units.
• Recording offences: under s 7 of the Surveillance Devices Act 2007 (NSW), recording a private conversation without consent can attract 500 penalty units for a corporation, or 100 penalty units and up to five years' imprisonment for an individual. Other states impose their own penalties.
• Privacy penalties: a serious interference with privacy under s 13G of the Privacy Act 1988 (Cth) can attract a civil penalty for a body corporate of up to $50 million, three times the value of any benefit obtained, or 30% of adjusted turnover, whichever is greatest. For an individual or other entity the cap is $2.5 million. Non-serious interferences carry up to 2,000 penalty units under s 13H.
• Employment exposure: an unfair dismissal or adverse action claim can result in reinstatement or compensation, plus legal costs.

Then there are the costs that do not appear in the legislation: the trust destroyed when staff discover they were monitored in secret, the practical difficulty of relying on evidence obtained unlawfully, and the reputational damage if monitoring data is leaked.

A compliance checklist for rolling out monitoring

Before you switch anything on, work through this list:

• Identify the regimes that apply: the state of each workplace, the states where employees work remotely, the states where any recordings happen, and whether your turnover brings you within the Privacy Act 1988 (Cth).
• Give written notice: at least 14 days before monitoring starts, stating what will be monitored, how, when, and whether it will be continuous or intermittent.
• Give new starters notice: before they begin work if monitoring is already in place.
• Keep surveillance out of private areas: bathrooms, change rooms, showers and similar spaces are off limits.
• Treat covert surveillance as unavailable: unless you have a court authority, which in practice means getting advice first.
• Build a consent and notification model for call recording: based on the strictest state in which recordings occur.
• Secure the data: restrict access, store securely, set retention periods and keep an audit trail.
• Document the program: in a monitoring policy and an IT acceptable use policy, and make sure employees acknowledge them.
• Use monitoring data only for the purposes you told employees about: and follow a fair process when it feeds into performance or disciplinary decisions.
• Review the program annually: and ask whether each element is still justified.

Where a lawyer helps

Most monitoring problems are preventable, and the main job of a lawyer here is to stop them before they start.

A practitioner can identify which state and territory laws apply to your particular mix of workplaces and remote workers, and draft the notice, monitoring policy and acceptable use policy so they match your contracts and your actual practices. A lawyer can also work out the consent model your call recording needs, and advise on an authority application where covert surveillance is genuinely justified. If monitoring data has already been gathered without notice, or a dispute has started, a lawyer can assess how the data can be used and how to run the employment process defensibly.

The 14-day notice is the step most employers skip

Most monitoring disputes have a moment where they could have been prevented. That moment is usually before the monitoring started, when a written notice and a clear policy would have cost an hour and avoided months of argument.

If you are planning monitoring, the first action is to give each affected employee written notice at least 14 days before you switch anything on, with the detail the NSW and ACT laws require. If you are already monitoring without notice, stop, and get advice before you use anything you have collected. The data gathered in secret is usually the evidence you cannot rely on, and the notice you never gave is the reason why.