From location to keystrokes, Australian workers’ data is being gathered by employers – with little privacy protection | Industrial relations

To get into the office at the Commonwealth Bank, Chris* needs to use an app on his phone. It collects information on his location.

“Instead of having a key card that you use to tap on to get in, it’s an app installed on your phone you’ve got to verify on a regular basis,” the CBA employee says.

“Part of the installation is giving the permissions for the app to access certain features of your phone, one of which is your location.”

Chris, whose name has been changed, says the location information can be accessed by the bank – and not only when using the app.

“We ask the bank: why is it doing this? And they say: ‘Oh, when we designed the software, it’s basically a thing that we have to do.’ But we don’t generally have any guarantee of how they’re using it or when.”

A spokesperson for CBA said the app, Navigate, was not used to track staff.

“We use a CBA-dedicated mobile phone app that provides access to our corporate offices,” they said. “Navigate also shows where someone’s laptop is connected to the network in that building, to better able our people to connect and collaborate with each other in the office.”

Chris is not convinced by CBA’s reassurances that the data collected by the app won’t be used for purposes other than those outlined by the bank. While the information collected by the company is purportedly for work purposes, he says employees don’t know exactly what data is being gathered.

_{Sign up: AU Breaking News email}

“We’re also not sure what’s covered in privacy laws, because there’s that carve-out, which says employee data [collected] in the process of their work isn’t covered by privacy laws,” he says.

A new paper from the University of Melbourne law professor Alysia Blackham, to be published in the Australian Journal of Labour Law, found employers are increasingly gathering large amounts of personal data about workers – including monitoring their locations, emails and keystrokes – but there is little in the way of privacy protection.

“We have a federal Privacy Act, but it has some fairly dramatic exceptions for the workplace,” Blackham says.

Small businesses – the vast majority of businesses in Australia – are exempt from privacy law and there is also an employee records exemption, Blackham says.

“What the case law has illustrated is that while employers may have to disclose certain things before they collect employee data, when data is collected, all the protections disappear due to that exception,” she says. “So it means employee data, when it’s hacked, doesn’t necessarily have any recourse or protection … [it] could be sent to other companies, offshored, sold, and there’s no real protection provided by federal privacy law.”

In 2023, an insurance policy worker lost her job after the company reviewed her keystrokes and found “very low” average activity. The Fair Work Commission rejected her application for unfair dismissal.

Kate*, another worker in the same…