Law firm discusses surveillance cameras, social media accounts and policies
In honour of Privacy Week, we took the opportunity to answer four burning questions that we often get from employers about privacy-related matters in the workplace.
There are a number of reasons why an employer may wish to use surveillance cameras in the workplace - for example, for health and safety reasons or to deter theft. As expected, where an employer utilises video surveillance in the workplace it must comply with the Privacy Act 2020 (Act).
The Act contains 13 information privacy principles (IPPs), which govern the use of personal information collected by an agency. Using video surveillance touches on nearly all the IPPs, but will certainly include:
Failure to comply with any of the IPPs can result in a complaint being made to the Privacy Commissioner; or where footage obtained in breach of the Privacy Act is used to dismiss or discipline an employee, the action could be held to be unjustifiable. One way to ensure compliance is to implement a surveillance policy in the workplace. To meet their statutory good faith requirements, an employer should consult with employees prior to implementing such a policy. The policy should cover off the above IPPs – why the surveillance is being undertaken, what will be recorded, what the footage will be used for, who can access it, and how it will be stored.
If an employer has a policy regarding surveillance cameras, then employees will most likely be aware of the camera’s existence. This type of overt surveillance is generally less risky for an employer to rely on to dismiss or discipline an employee. By contrast, covert surveillance (where the employees are not aware of the surveillance cameras) contains more legal risk but there may be circumstances it is justified - for example, a thief is operating in their workplace and the employer wishes to catch the culprit red-handed.
What will 2023 bring for privacy and data protection?
It is well established that for an employer to justify taking disciplinary action against an employee’s out-of-work conduct, there must be a causal link between the conduct and the employment relationship. With ever-increasing use of social media blurring the distinction between the workplace and an employee’s private life, we are seeing social media affect the workplace and employment relationships more and more.
Sometimes there may be a clear link between the employee’s social media conduct and the employment relationship. For example, an employee posting negatively about their manager or the business, or where workplace bullying has bled into Facebook messages or Instagram DMs. But what if there are instances where social media activity is not readily linked to employment?
In the recent Australian case of Corry v. Australian Council of Trade Unions, the Fair Work Commission (FWC) upheld the summary dismissal of an employee who posted highly offensive material on his personal Facebook account supporting the 2020 Melbourne anti-vaccination and lockdown protest. The FWC found that the conduct was in breach of ACTU’s policies, which was serious misconduct and constituted a valid reason for dismissal. The FWC held that while the employee had the “right to hold and express a strongly held view, that did not however provide the Applicant with the unqualified right to publicly espouse views that were contrary to the interests and values of his employer.”
This seems to be in line with New Zealand’s position where the Employment Court has held that Facebook posts (even if protected by privacy settings) may not be regarded as protected communications “beyond the reach of employment process given that the information or posts can be shared to a near limitless audience.”
The Employment Court dismissed the claim of a hospital worker fired for collecting confidential patient records.
IPP 6 of the Act gives individuals the right to ask an agency to provide confirmation of, access to, or correction of, the personal information it holds about them. An agency must respond as soon as possible, but within 20 working days, and can provide the information, refuse to provide the information, transfer the request to the agency that they believe holds the information (this must be done within 10 working days), confirm it does not hold the information or does not hold it in a way that is easily retrievable, or neither confirm nor deny.
A request may be refused on a number of grounds. In an employment context, grounds for refusal may include:
It should be noted that each of these grounds for refusal has “fine print” that needs to be satisfied before an employer can refuse access to personal information.
Generally, an employer should not charge people to access or correct their personal information. However, there are some circumstances where it may be appropriate for an employer to charge an individual to access their information - the amount of material sought is significant or difficult to collate. Any costs must be reasonable and the applicant must be made aware of the costs before charges are imposed.
Monitoring employees must comply with the Privacy Act, the terms and conditions of employment, and good faith duties, say employment lawyers.
While not specifically required under the Act, it is a good idea for employers to adopt a privacy-related policy. Good reasons to have a policy include:
Alison Maelzer is a partner and Matthew Morrissey is a solicitor, both practicing employment law at Hesketh Henry in Auckland.
