Public Sector Informant: Biometric data and a worker's right to refuse to hand it over

Surely there is no better way to accurately identify someone, increase accountability and lower the risk of data breaches? Why wouldn't employers want access to the one permanent password that never changes and is hard to replicate? And why wouldn't employees be happy to give employers this peace of mind? Besides, most of us use our fingerprints to unlock our phones on a daily basis.

But the permanence of biometric data (scans of unchanging body parts, such as fingerprints or eyes) is both the strength and weakness of this technology. Once digitised, this sensitive, personal data remains in cyberspace forever. Unlike traditional passwords, you cannot easily change your biometric identifiers if they compromised. If cybercriminals steal them, who knows what they may do with them?

So, what are your rights over your biometric information? If your employer instructs you to digitise your fingerprint, can you refuse? Can you be sacked for refusing?

In the recent case of Jeremy Lee v Superior Wood, a Queensland sawmill employee was dismissed after he refused to comply with a new workplace attendance policy, which required that he scan his fingerprint to record his presence on the worksite for safety and payroll purposes. Lee refused to comply, expressing "concern about the control of his biometric data and the inability of Superior Wood to guarantee no third-party access or use of that data once stored electronically". In response to his concerns, Superior Wood advised Lee that "he had a decision to make". Lee's continued refusal to comply with the incoming policy led to his sacking.

Lee made an unfair-dismissal application to the Fair Work Commission to try to get his job back. Initially, he lost. However, on appeal, the commission's full bench found his employment had been unfairly terminated.

Lee was worried about the level of control Superior Wood would have over his biometric data and its inability to guarantee no third-party access or use of that data once it was stored. The full bench agreed that his concerns were not "devoid of merit", and that the biometrics that the employer was trying to collect was "data unique to the individual", which the employee was "entitled to seek to protect".

Employees must comply with their employers' lawful and reasonable directions - if they refuse, their employment can be lawfully terminated. The question in this case was whether Superior Wood's direction to Lee to consent to the collection of his biometric information was lawful and reasonable. The full bench determined it was both unlawful and unreasonable.

Importantly, under privacy laws, Superior Wood was required to have a privacy policy, detailing how it would manage its staff's personal information, provide a privacy-collection notice notifying its employees of the purpose of collecting their information, and only collect biometric information if an employee consented. Superior Wood had not complied with its obligations under the Privacy Act and, therefore, the commission found that the direction to comply with the policy was unlawful.

The commission also found Superior Wood's direction that Lee consent was unreasonable, pointing out that a necessary component of a right to consent is the right to refuse. It stands to reason that when you direct a person to consent, the individual cannot meaningfully do so (having been stripped of their right to refuse).

So what does this mean? Your employer must seek your consent before collecting your biometric information - and refusal is not a reason for dismissal.

However, this might not apply to all Australian Public Service employees. In some circumstances, the Privacy Act allows biometrics to be collected without consent, where it is in the public interest to do so. Certain enforcement bodies (including the federal police, the Director of Public Prosecutions, and the Australian Securities and Investments Commission) have the right to collect biometrics without consent when they believe it is reasonably necessary for, or directly related to, the entity's functions or activities.

Justifiably, we want some government enforcement bodies to not be unduly limited by privacy laws. However, a by-product of this exception may have significant mitigating effects on whether agencies directing staff to sign in to work via their fingerprint is considered a "lawful" direction.

Remember, however, employer directions must be both "lawful" and "reasonable". The reasonableness of any direction depends on the circumstances. It may well be reasonable to direct a public servant, working for an intelligence or security agency, to provide their fingerprints for biometric-security measures where the nature of their work demands a high level of secrecy and security. However, it seems unreasonable to require staff to provide their fingerprints where secrecy is not paramount to their job and fingerprinting processes are brought in solely to increase efficiency. For example, it might not be reasonable to require a receptionist at the Director of Public Prosecutions to comply with biometric-security measures.

As the collection of biometric information becomes commonplace, we can expect more case law and regulation. Privacy, consent, national security, surveillance, accountability, the public interest and sensitive personal information will all be issues of debate on this issue. It will be increasingly important for APS employees to understand their rights and responsibilities when it comes to giving the finger(print).