New workplace privacy protections coming in Victoria

The Victorian Government last week responded to a report by the Legislative Assembly Economy and Infrastructure Committee on workplace surveillance, and gave an indication of which recommendations in the report it is prepared to implement in legislation.

Of the 18 recommendations by the Committee, the Victorian Government agreed ‘in principle’ to 15 of them. If the legislation is implemented, employers that wish to conduct workplace surveillance must:

justify that the proposed surveillance is reasonable, necessary and proportionate;
give 14 days’ written notice to employees of prospective surveillance;
consult with employees before introducing or changing workplace surveillance practices;
maintain a workplace surveillance policy;
have a person with delegated authority to review any automated decision made using surveillance data that could significantly affect a worker’s rights or employment status, including gig economy workers;
take all reasonable steps to prevent surveillance of employees at work by third parties without the employees’ consent;
inform employees who is collecting workplace surveillance data, how it is secured and stored, who can use it, and its retention period;
ensure any third party collecting or storing workplace surveillance data takes reasonable steps to protect the data; and
give access to employees to workplace surveillance data generated about them.

The legislation will also impose:

restrictions on covert workplace surveillance to cases of suspected unlawful activity or serious misconduct, requiring a court order and independent supervision; and
a prohibition from selling employees’ personal or surveillance data to third parties.

The Victorian Government will also consider options for appointment and resourcing of a regulator to oversee the new workplace surveillance legislation.

The Government is also considering amendments to the Privacy and Data Protection Act 2014 (Vic) to improve protections for collection and use of biometric data from employees, e.g. fingerprints and facial recognition.

In addition, the Victorian Government will review recommendations to amend the Privacy and Data Protection Act 2014 (Vic) to introduce:

a new Information Privacy Principle, modelled on Australian Privacy Principle 1.2 that places a positive obligation on organisation and employers to ensure they comply with the principles; and
a mandatory incident notification scheme requiring organisations to notify individuals and the Office of the Victorian Information Commissioner in the event of a data breach across public and private workplaces

It is expected the legislation will be developed over the next 12 months.

Workers struck by collapsing cabinet after botched install
A design and construction company has been fined $90,000 and ordered to pay costs for a Category 3 offence involving the collapse of a cabinet they had installed contrary to the manufacturer’s instructions ...