Employee records: privacy and security

An employee record is a record of personal information relating to the employee’s employment. The Act’s examples include health information, engagement, training, discipline, resignation and termination, terms and conditions, emergency contacts, performance, hours, pay, union membership, leave, and tax, banking and super details.

Both limbs must be met. Using an employee’s record to run payroll is exempt; selling a staff list for marketing is not, because it isn’t directly related to the employment relationship. The OAIC’s guidance on the exemption gives that example.

What records you must keep, and for how long, is a separate Fair Work question. See employer record-keeping obligations.

• Job applicants: the exemption covers current and former employment, not future employment, so information about unsuccessful candidates is covered by the APPs.
• Contractors and volunteers: neither is an employee, so their information isn’t in an employee record.
• Service providers: an outsourced payroll or recruitment provider handling your employees’ information can’t rely on your exemption.
• Tax file numbers: anyone holding TFN information is a file number recipient bound by the Privacy (Tax File Number) Rule 2015 (Privacy Act ss 11 and 18). It requires reasonable security and secure destruction or de-identification once the TFN is no longer needed.
• State health records laws: Victoria’s Health Records Act 2001 applies its Health Privacy Principles to health information held by private sector organisations in Victoria. NSW’s Health Records and Information Privacy Act 2002 applies to private sector bodies that hold health information, but not to small business operators.

A business that has ever had turnover above $3 million in a financial year is not a small business operator. The OAIC’s small business page lists businesses covered regardless of turnover, including:

• businesses that provide a health service and hold health information other than in an employee record
• businesses that trade in personal information
• contracted service providers under a Commonwealth contract
• reporting entities under the anti-money laundering laws
• businesses related to a covered business, and businesses that have opted in.

Even an exempt small business is still bound by the TFN Rule, and a breach of TFN information can still be notifiable.

APP 11.3 states that reasonable steps include technical and organisational measures: access controls, encryption and patching sit alongside policies, training and supervision. This applies to job applicant and contractor records even where your employee records are exempt.

Destruction is the step most often missed. Keep time and wages records for the 7 years the Fair Work Act requires, then destroy them on a schedule. Unsuccessful applicants’ CVs, identity documents and old bank details should not be kept indefinitely.

An eligible data breach is unauthorised access to, disclosure of, or loss of personal information that a reasonable person would conclude is likely to result in serious harm (Privacy Act s 26WE). The scheme covers entities bound by APP 11 and anyone holding TFN information under the TFN Rule.

1. Contain the breach: revoke access, reset credentials, recall misdirected emails.
2. Assess it quickly. You must take all reasonable steps to finish within 30 days of suspecting it (s 26WH).
3. If it is eligible, prepare a statement describing the breach, the kinds of information involved and the steps people should take, and give it to the Commissioner (s 26WK). The OAIC’s NDB page has the online form.
4. Notify affected individuals, or publish the statement if direct notice isn’t practicable (s 26WL).

The tort, in Schedule 2 of the Privacy Act, lets an individual sue for an intrusion on seclusion or misuse of information that was intentional or reckless and serious, where they had a reasonable expectation of privacy. No proof of damage is needed. Its exemptions cover journalists, some government bodies and people under 18, but there is no employee records exemption, so a deliberate leak of a worker’s medical or personal details is a real risk.

The transparency rules require privacy policies to explain decisions made or substantially assisted by computer programs. See automated decisions and privacy disclosure.

1. Limit payroll, TFN and medical records to the staff who need them, and review access when people change roles or leave.
2. Require multi-factor authentication for payroll, HR and email systems, and for any outsourced provider’s portal.
3. Verify any request to change an employee’s bank account by calling them on a number already on file, never one in the request. See Essential Eight for HR data.
4. Keep medical certificates and workers’ compensation documents apart from general personnel files.
5. Set a retention and destruction schedule: 7 years for time and wages records, shorter for applicant records you no longer need.
6. Don’t email TFN declarations or payslips as unprotected attachments, and don’t paste staff details into public AI tools. See using AI assistants with HR data.
7. Write a one-page breach response plan naming who assesses, who notifies and how to reach the OAIC.