In Jeremy Lee v Superior Wood Pty Ltd [2019] FWCRB 2946, the Full Bench of the Fair Work Commission upheld Mr Lee’s appeal against a decision at first instance to dismiss his application for an unfair dismissal remedy.

The Facts

In November 2014, Mr Lee was employed as a casual general hand by the timber manufacturer and distributor Superior Wood Pty Ltd (Superior Wood), part of the Finlayson Group of companies. Mr Lee refused to register his fingerprints and use the fingerprint scanners that Superior Wood introduced in late 2017 to replace the manual time sheets (used for employees to sign on and off, with the objective of improving safety in the event of an emergency, and improving the integrity and efficiency of its payroll). During meetings held throughout November and December 2017, Mr Lee expressed his concerns about third parties’ access to, and use and control of, his biometric data once the data had been stored electronically. Mr Lee was dismissed in February 2018 for not complying with the Site Attendance Policy that was introduced in December 2017, requiring all employees to use the biometric scanners to record their attendance on site.

Decision at First Instance

Commissioner Hunt considered that Superior Wood’s Site Attendance Policy was not unjust or unreasonable, given its capacity to improve Superior Wood’s ability to deal with an emergency and to improve the integrity and efficiency of the payroll across the Finlayson Group. However, she was critical of Superior Wood’s failure to meet its obligations under the Privacy Act 1988 (Cth) (Privacy Act). It was concerning that Superior Wood had not provided to employees a privacy collection notice about the collection and use of their sensitive information, and that neither Superior Wood nor the Finlayson Group had a privacy policy in place. Under the circumstances, however, the failure to provide a privacy collection notice to employees prior to obtaining their personal and sensitive information did not render the Site Attendance Policy unlawful. In the circumstances, there was a valid reason for Mr Lee’s dismissal. Superior Wood had met the procedural requirements regarding Mr Lee’s dismissal, such as notifying him of the reasons and giving him an opportunity to respond.

The Full Bench’s Reasons for Upholding the Appeal

The Full Bench observed that the Site Attendance Policy did not form part of Mr Lee’s employment contract, which was worded to incorporate policies, procedures and work rules in place at the time the parties entered into the contract. Compliance with the Site Attendance Policy, which was implemented subsequently, was therefore not a term of his employment.

Any obligation to comply with the Site Attendance Policy therefore depended on whether his employers’ direction to comply with it was a reasonable and lawful direction. The Full Bench held that it was not a reasonable and lawful direction, because it was essentially a direction to give his consent to the collection of his sensitive information. Its reasons were as follows:

• Australian Privacy Principle (APP) 5 under the Privacy Act required Superior Wood to give employees a privacy collection notice relating to its collection of their biometric data. While Superior Wood gave employees some information about the purpose for collecting the information, it did not provide all the information required.
• APP 3.3 prohibits the collection of sensitive information about an individual unless the individual consents and the information is reasonably necessary for one or more of the organisation’s functions or activities.
• One of the exemptions contained in section 7B(3) of the Privacy Act is the employee records exemption, which means an employer does not have to comply with the Privacy Act in relation to an employee record held about an individual. The exemption does not extend to the creation of future records. The APPs apply up to the point of collection of personal information, at which point the employee records exemption would come into play.
• Superior Wood’s direction to Mr Lee to submit to the collection of his sensitive information, in circumstances where he did not give his consent, was not a lawful direction. The Full Bench stated that it was therefore not necessary to determine whether it was a reasonable direction. It did, however, give its opinion that the direction was unreasonable, as a necessary counterpart to a right to consent to something is the right to refuse it. Any consent that might have been given by an employee once they had been told they would face disciplinary action or dismissal for not consenting would not be genuine consent. The refusal to follow an unlawful direction was not a valid reason for Mr Lee’s dismissal.
• The collection of biometric data for use in the biometric scanners was also not “reasonably necessary”. Other options that had been proposed to Superior Wood included key fobs, swipe cards, computer and mobile log in systems, as well as SMS and email options. There was no evidence that Superior Wood had evaluated the costs of these alternative options. Further, manual sign in and out sheets continued to be used at the work site after Mr Lee was dismissed. While the introduction of the scanners was “administratively convenient” for Superior Wood, the evidence that it was “reasonably necessary” was not compelling. Had Superior Wood’s direction to Mr Lee been lawful, it might have been reasonable to decline to make an exception for him, as he was the only one of some 400 employees who sought the use of a method of registering attendance other than by the use of the scanners. That did not mean it was “reasonably necessary” to collect his fingerprint in the absence of considering other options.

The Full Bench therefore upheld Mr Lee’s appeal and reheard his application. It quashed the decision at first instance and determined that Mr Lee’s dismissal was unfair.

While Superior Wood had provided procedural fairness to Mr Lee, the procedural fairness factors were outweighed by the absence of a valid reason for his dismissal. The Full Bench remitted the question of determining a remedy to a single Commissioner.

Implications for Schools

Pending any appeal to the Federal Court and comment from the Office of the Australian Information Commissioner, schools would be advised to:

• have in place a compliant “privacy by design” policy and supporting program which is published and effectively implemented
• assess whether your organisational privacy policy (which is hopefully compliant with the Privacy Act) would impact on your collection, use, storage and disclosure of employee records  
• identify any gaps in internal procedures relating to employee records where it would be reasonable for privacy protections, as specified in the Privacy Act, to apply
• review employment contracts to see if they include specific provisions relating to the collection and use of reasonably necessary personal information and sensitive information (such as health, medical, biometric, as defined in the Privacy Act) and including workplace surveillance, be it electronic images, or other.