Employee privacy obligations for Australian businesses

Every business in Australia holds personal information about its employees: names, addresses, bank details, tax file numbers, health information and performance records. If your business is covered by the Privacy Act 1988 (Cth) (the Act), the Australian Privacy Principles (APPs) in the Act set out how you may collect, use, hold and disclose that information. If your business is not covered, most routine handling of employee records sits outside the Act's reach. But the boundaries are narrower than most employers expect, and getting them wrong can be expensive.

This article explains whether the Act applies to your business, what the employee records exemption actually covers, the specific duties that apply if you are an APP entity, the penalties for non-compliance, and the practical steps you can take now.

Is your business covered by the Privacy Act?

The Act regulates APP entities. In the private sector, an APP entity is an organisation that is not a "small business operator". Under s 6D of the Act, a business is a small business if its annual turnover for the previous financial year was $3 million or less. Turnover is measured broadly: proceeds from sales of goods and services, commission, repair and service income, rent, leasing and hiring income, interest, royalties, dividends and other operating income all count (s 6DA). A business that exceeds $3 million in the current financial year remains a small business until the previous year's turnover also passes the threshold.

An APP entity can be a sole trader, partnership, trust, company or unincorporated association. A business is not a small business operator, and is therefore an APP entity, even below $3 million in turnover if it:

Provides health services: a business that provides a health service to another individual and holds health information, other than in an employee record (s 6D(4)(b)). This is the exception that catches many employers: a physiotherapy clinic, gym or occupational health provider is covered regardless of turnover.
Discloses personal information about another individual for a benefit, service or advantage: for example, by selling or trading in personal information (s 6D(4)(c)).
Provides a benefit, service or advantage to collect personal information about another individual from someone else (s 6D(4)(d)).
Is a contracted service provider for a Commonwealth contract (s 6D(4)(e)).
Is a credit reporting body (s 6D(4)(f)).
Is related to a body corporate that carries on a business that is not a small business (s 6D(9)).

The employee records exemption: what it covers and where it stops

Even if your business is an APP entity, the APPs do not apply to most day-to-day handling of employee records. Section 7B(3) of the Act exempts an act or practice by an employer that is directly related to a current or former employment relationship and to an employee record held about the individual. An employee record is defined broadly in s 6 as a record of personal information relating to the employment of the employee, including health information about the employee and information about engagement, training, disciplining, resignation, termination, terms and conditions of employment, personal and emergency contact details, performance or conduct, hours of employment, salary or wages, leave, trade union membership, and taxation, banking or superannuation affairs.

The exemption is narrower than most employers assume. The Office of the Australian Information Commissioner (OAIC) identifies the key limits:

Job applicants: the exemption does not cover prospective employees. Information collected from unsuccessful applicants, including pre-employment screening results, is subject to the APPs.
The employment relationship only: using employee information for an unrelated purpose, such as selling a list of employees to a marketing company, falls outside the exemption and requires APP compliance.
Third parties: recruitment agencies, payroll and HR providers, and workers compensation insurers that handle employee information must comply with the APPs in their own right. The exemption does not protect them.
Volunteers: there is no employment relationship between an organisation and a volunteer, so the exemption does not apply.
Data breach notification: the exemption applies to the APPs only. The Notifiable Data Breaches (NDB) scheme in Part IIIC of the Act is separate. An APP entity that suffers an eligible data breach involving employee records must still notify the OAIC and affected individuals where a reasonable person would conclude there is a likely risk of serious harm.

Even if the Act does not otherwise apply to your business, tax file number information is protected separately. Anyone who holds tax file numbers, including employers, is a "file number recipient" under s 11 of the Act and may only record, use and disclose that information as the Act's tax file number rules permit.

The core duties if you are an APP entity

If your business is an APP entity, the APPs impose obligations that apply to applicant information generally and to any employee information handled outside the exemption.

Publish an up-to-date privacy policy (APP 1)

Under APP 1.3, an APP entity must have a clearly expressed and up-to-date privacy policy. APP 1.4 requires the policy to set out:

the kinds of personal information the entity collects and holds;
how the entity collects and holds personal information;
the purposes for which it collects, holds, uses and discloses personal information;
how individuals can access and correct their personal information;
how individuals can complain about a breach of the APPs; and
whether the entity is likely to disclose personal information to overseas recipients and, if so, the countries concerned.

Collect only what you reasonably need (APP 3)

An organisation must not collect personal information unless the information is reasonably necessary for one or more of its functions or activities (APP 3.2). Sensitive information, which includes health information, political opinions, religious beliefs and trade union membership, may only be collected with the individual's consent (APP 3.3). Because employee health information is sensitive information, collecting it for return-to-work arrangements, sick leave or injury management needs a proper basis and the employee's consent.

Tell employees and applicants what you are collecting (APP 5)

At or before the time of collection, an APP entity must take reasonable steps to notify individuals of the entity's identity and contact details, the purposes of collection, the main consequences of not providing the information, their access and correction rights, how to complain, and whether the information is likely to be disclosed overseas (APP 5.2). This applies to job applicants as well as employees, since the employee records exemption does not cover applicants.

Use and disclose information only for employment purposes (APP 6)

Personal information may be used or disclosed only for the purpose for which it was collected, or a related secondary purpose the individual would reasonably expect (APP 6.1). Sharing employee information with a payroll provider, superannuation fund, the Australian Taxation Office, a workers compensation insurer or a Fair Work inspector in the course of the employment relationship is generally within that purpose. Anything beyond it, such as marketing or disclosure for your own benefit, requires consent, and the exemption does not cover it.

Keep the information secure (APP 11)

An APP entity must take such steps as are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure (APP 11.1). APP 11.3 confirms that this includes technical and organisational measures: access controls, encryption, secure storage and staff training. APP 11.2 also requires an entity to destroy or de-identify personal information once it no longer needs it, subject to legal retention obligations such as workplace record-keeping and tax laws.

Let individuals access and correct their information (APPs 12 and 13)

Individuals may request access to personal information an APP entity holds about them, and may ask for it to be corrected. The entity must respond within a reasonable period. This matters most for applicant information and for any employee information handled outside the exemption, because the exemption covers routine employment record handling.

What happens if you get it wrong

The OAIC investigates complaints about APP breaches and can make determinations requiring compensation, accept enforceable undertakings, and bring civil penalty proceedings. Since the 2022 reforms, the penalties are substantial. Under s 13G of the Act, for a serious or repeated interference with privacy by a body corporate, the maximum penalty is the greatest of $50 million, three times the value of any benefit obtained from the conduct, or 30% of the entity's adjusted turnover during the breach period. An individual faces a maximum penalty of $2.5 million (s 13G(2)), and other interferences with privacy attract up to 2,000 penalty units (s 13H(3)).

An OAIC investigation is costly and time-consuming even where no penalty is imposed. For employers there is also a reputational cost: a data breach involving staff records damages trust, and mishandling employee information can surface in employment disputes and in the recruitment market.

A compliance checklist for employers

Work through these steps to put your employee privacy obligations into practice:

Confirm your status: check whether your business is an APP entity by testing turnover for the previous financial year against the $3 million threshold and working through the s 6D(4) exceptions.
Review your privacy policy: check it against the APP 1.4 contents and keep it current.
Notify at collection: update offer letters, onboarding forms and application forms so individuals know what is collected, why, and who it is shared with.
Collect only what is necessary: obtain consent before collecting health or other sensitive information.
Limit use and disclosure: to employment purposes, and obtain consent for anything else including marketing.
Secure the records: with access controls and encryption, and destroy or de-identify information you no longer need once legal retention periods end.
Prepare for breaches: have a response plan in place, and notify the OAIC and affected individuals where an eligible data breach is likely to result in serious harm.
Check your third parties: payroll, HR and recruitment providers must comply with the APPs themselves, so document and review those arrangements.
Train your managers: on what can and cannot be done with employee information, including who can access it.

Where a lawyer can help

A privacy lawyer can confirm whether the Act applies to your business, because the turnover test and the exceptions are easy to misapply, particularly for businesses that provide health services or trade in information. A lawyer can also:

draft and review your privacy policy, collection notices and privacy clauses in employment contracts;
advise on employee monitoring and surveillance, which can raise issues under the Act and under separate workplace surveillance laws;
assess data breaches and advise on whether NDB notification is required;
respond to OAIC complaints, investigations and enforceable undertakings; and
review data-sharing arrangements with payroll, superannuation and HR providers.

The exemption is narrower than most employers think

The employee records exemption is the part of this area of law that employers most often misunderstand. It is not a blanket exclusion. It covers only acts directly related to a current or former employment relationship and an employee record, and it does not extend to applicants, marketing uses, volunteers or third-party providers. The moment employee information is used for something outside the employment relationship, the full weight of the APPs applies, and a breach of employee records can still trigger notification obligations under the NDB scheme.

The first step this week is to confirm whether your business is actually an APP entity. Many businesses under the $3 million threshold, including health service providers, businesses that trade in information and businesses related to larger entities, are covered without realising it. If you are covered, check that your privacy policy and collection notices exist and are current. If you are not sure, that is the point where a lawyer's advice is worth the cost.