If your business monitors the websites your staff visit on company devices and networks, you are carrying out workplace surveillance, and Australian law treats that as a serious matter. It is not a question of whether monitoring is allowed at all. It usually is, if the employer has a legitimate business purpose. The question is whether you have done the things the law requires first: given proper notice, documented a policy your staff actually know about, and handled the information you collect under the privacy rules that apply to you.
Get the process wrong and you face penalties under state surveillance laws, exposure to large civil penalties under the federal Privacy Act 1988 (Cth), and the real risk that a dismissal based on monitoring is challenged as unfair. This guide sets out who the obligations fall on, the specific duties you must meet before and while you monitor, and the consequences of getting it wrong.
Who the obligations apply to
Every employer that monitors employee internet use is in scope of at least one legal regime, but which regimes apply depends on where your employees work and how much your business turns over.
- State and territory surveillance laws: Apply by location of the workplace. New South Wales and the ACT have dedicated workplace surveillance legislation. The other states and territories regulate surveillance devices and the recording of communications under their own laws, so monitoring must comply with those consent and notice requirements even without a workplace-specific statute. The Office of the Australian Information Commissioner confirms that an employer who monitors staff must follow any relevant Australian, state or territory laws, including laws on monitoring and recording telephone conversations.
- The federal Privacy Act: Applies to most private sector employers with an annual turnover above $3 million. The small business exemption in s 6D of the Privacy Act 1988 (Cth) means a business whose annual turnover for the previous financial year was $3 million or less is generally not bound by the Australian Privacy Principles (APPs), unless an exception applies. The exceptions catch more businesses than many owners expect: a small business that provides a health service and holds health information, that discloses or collects personal information for a benefit, service or advantage, that is a contracted service provider for a Commonwealth contract, or that is a credit reporting body, is not exempt.
A business can be exempt from the Privacy Act but still bound by state surveillance law, and vice versa. If you employ staff in more than one state, you should assume the strictest set of rules applies to the workers in each location.
The core obligation: give written notice before you monitor
The duty that employers most often miss is the notice requirement. It is a pre-condition, not a courtesy. You must notify your employees in writing before surveillance starts, and the notice must be specific.
The 14-day written notice rule
In New South Wales, s 10 of the Workplace Surveillance Act 2005 (NSW) provides that surveillance of an employee must not commence without prior written notice, and the notice must be given at least 14 days before surveillance commences. An employee can agree to a shorter period. The notice must state the kind of surveillance (camera, computer or tracking), how it will be carried out, when it will start, whether it will be continuous or intermittent, and whether it is for a specified period or ongoing. Notice can be given by email. For a new employee who starts work after surveillance is already running, or within 14 days of it starting, the notice must be given before they start work.
The ACT has a parallel regime. Under s 13 of the Workplace Privacy Act 2011 (ACT), an employer may only conduct surveillance of a worker if it gives written notice at least 14 days before the surveillance starts (or within a shorter agreed period, or before a new worker starts), and conducts the surveillance in accordance with that notice. The notice must state the kind of surveillance device, how the surveillance will be conducted, and who will ordinarily conduct it. The ACT adds a step NSW does not: under s 14, the employer must consult with the worker in good faith during the notice period, giving them a genuine opportunity to influence how the surveillance is conducted.
The policy requirement
Notice alone is not the whole duty. In NSW, s 12 of the Workplace Surveillance Act 2005 requires that computer surveillance of an employee be carried out in accordance with a policy of the employer on computer surveillance, and that the employee has been notified of that policy in advance in a way that makes it reasonable to assume they are aware of and understand it. The practical effect: an acceptable use or internet policy that sits unread in a staff handbook does not satisfy the law if no one has actually been told about it and asked to confirm they understand it.
What you may not do, even with notice
Some conduct is prohibited outright, and a warning in a policy cannot make it lawful:
- Blocking access without a notified policy: In NSW, s 17 prohibits an employer from preventing delivery of an email or access to a website unless it is acting under a policy notified in advance, and (for email) gives the employee a prevented-delivery notice. Breach carries a maximum penalty of 50 penalty units.
- Covert surveillance: Under s 19 of the NSW Act, covert surveillance of an employee at work is prohibited unless authorised by a covert surveillance authority from a magistrate or Local Court judge. Surveillance that does not comply with the Part 2 notice requirements is treated as covert surveillance, so skipping the notice can turn an ordinary monitoring rollout into a criminal offence.
- Private areas: Surveillance in change rooms, toilet facilities, showers or bathing facilities is prohibited outright in NSW under s 15, with a maximum penalty of 50 penalty units.
- Recording communications: Intercepting the content of communications, including recording calls or capturing the content of messages, is restricted by federal telecommunications interception law and by state surveillance device laws. System logs and metadata (the domains visited, timestamps, bandwidth used) are a different category from the content of what was typed or said. If your monitoring captures content, the consent and notice requirements are stricter, and you should treat that as a separate legal exercise from log-based monitoring.
Privacy obligations for the information you collect
If the Privacy Act applies to your business, the monitoring data you collect is personal information, and the Australian Privacy Principles govern what you may do with it. The OAIC takes the view that the APPs may apply to monitoring records, such as computer records of emails or internet use, that do not directly relate to a person's employment.
- Collect only what is reasonably necessary: APP 3 permits an organisation to collect personal information only where it is reasonably necessary for its functions or activities. If your purpose is security and productivity, collecting full browsing content when domain-level logs would do is hard to justify.
- Notify at the point of collection: APP 5 requires you to notify individuals of the collection, its purposes and how the information will be handled, at or before the time you collect it. This overlaps with, but does not replace, the state notice requirements.
- Secure it and restrict access: APP 11 requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Monitoring logs are attractive to attackers, so access should be limited to named people on a genuine need-to-know basis.
- Watch for sensitive information: Browsing logs can reveal health information, religious beliefs or union membership, which the Privacy Act treats as sensitive information with stricter collection rules.
- Report serious breaches: Under Part IIIC of the Privacy Act 1988 (Cth), an entity that becomes aware of an eligible data breach must notify affected individuals and the OAIC. If monitoring logs are lost or accessed without authorisation and are likely to result in serious harm, the notification obligation is triggered.
The employee records exemption is narrow
The Privacy Act exempts acts directly related to a current or former employment relationship and an employee record held by the employer, under s 7B(3). The exemption has real limits. It does not extend to job applicants, contractors or former employees, and a general browsing log is not automatically an employee record just because it was generated on a work device. The OAIC's guidance on the employee records exemption is worth reading before you assume a category of monitoring data is outside the APPs. The safe approach is to treat most monitoring data as personal information and apply the APPs to it.
The consequences of getting it wrong
The penalties are concrete, and they operate at both state and federal level.
- State offences: In NSW, breaches such as covert surveillance without authority, surveillance of change rooms, and blocking internet access without a notified policy each carry a maximum penalty of 50 penalty units, and misuse of surveillance records carries 20 penalty units. In the ACT, using a surveillance record to take adverse action against a worker carries a maximum penalty of 50 penalty units.
- Federal civil penalties: A serious interference with privacy by a body corporate attracts a maximum civil penalty of the greater of $50 million, three times the value of any benefit obtained from the conduct, or 30% of adjusted turnover during the breach period, under s 13G of the Privacy Act 1988 (Cth). For an individual, the maximum is $2.5 million. The OAIC can investigate complaints, issue determinations, and seek civil penalties in court.
- Unfair dismissal exposure: If monitoring leads to a dismissal, the dismissal can be challenged. A dismissal will be assessed against the criteria in the Fair Work Act 2009 (Cth) of whether it was harsh, unjust or unreasonable, and a dismissal built on surveillance that was not properly notified, or on conduct outside the scope of what staff were told was monitored, is far harder to defend. The Fair Work Ombudsman's workplace privacy best practice guide recommends telling employees what information you collect and why.
Compliance checklist
Work through this checklist before monitoring starts, and again whenever you review your arrangements:
- [ ] Identify which state or territory surveillance laws apply to each workplace, not just your head office state.
- [ ] Confirm whether the Privacy Act applies to you: is annual turnover above $3 million, or does a small business exception apply?
- [ ] Document the business purpose of monitoring in writing before you switch anything on.
- [ ] Serve written notice at least 14 days before monitoring starts (NSW and ACT), stating the kind of surveillance, how it will run, when it starts, and whether it is continuous or intermittent.
- [ ] In the ACT, consult with workers in good faith during the notice period.
- [ ] Maintain a computer surveillance or acceptable use policy and ensure staff are notified of it in a way that demonstrates awareness, with written acknowledgement for new and existing staff.
- [ ] Keep collection proportionate: prefer domain-level logs and metadata over content capture, and exclude private or out-of-hours activity where possible.
- [ ] Limit access to monitoring data to named personnel, protect it, and set a retention period with deletion.
- [ ] If monitoring data is breached, assess whether the notifiable data breach obligation is triggered.
- [ ] Review the position for contractors and BYOD users before giving them system access.
Where a lawyer helps
The obligations sit across state, territory and federal law, and the practical traps are in the detail. A lawyer can review your monitoring notice and acceptable use policy against the requirements in each state where you employ staff, advise on whether your monitoring design collects more than the law permits, help you apply for covert surveillance authority if that is genuinely required, and guide an investigation or regulator inquiry if monitoring has produced a disciplinary issue. If you are relying on the employee records exemption or the small business exemption, it is worth having that analysis checked, because both are narrower than they sound.
The notice is the obligation employers miss
If you take one action this week, it should be to check whether your current monitoring tools are running with a 14-day written notice in place and a policy staff have actually acknowledged. In NSW and the ACT that notice is a legal precondition, not a courtesy, and monitoring that starts without it is treated as covert surveillance, which is an offence in its own right. The cost of the notice is a few pages and a staff meeting. The cost of skipping it can be a penalty, a regulator investigation, and an unfair dismissal claim that turns on the fact that nobody told anyone what was being watched.