Breaking Down the Privacy Act Review Report #2: Modifying the employee records exemption
By Cameron Abbott, Rob Pulham and Stephanie Mayhew
The section of the Report dealing with the employee records exemption highlighted significant debate and difference of opinion. Employers expressed a strong desire to retain or even strengthen the exemption; employee representatives consider reform is needed.
In that context the Report does not conclude how the changes should take effect, but proposals 7.1(a)-7.1(d) recommend stronger protection of private sector employee information, to:
- enhance transparency over what employee information is collected and why
- ensure employers have adequate flexibility to deal with employees’ information to administer the employment relationship (and addressing whether consent should be required to collect sensitive information)
- ensure adequate security and destruction measures around employee personal information, and
- notify employees and the OAIC of data breaches involving employee personal information.
What does this mean for my organisation?
Private sector employers who don’t yet have a good grasp of the breadth of information they collect and hold about their employees will need to stocktake their collection activities and sharpen their focus on why they collect such information; prepare appropriate collection notices and employee privacy policies (if not used already); and ensure employee information is appropriately covered in their security measures and considered in their data breach response plans.
Read More