ACT Workplace Privacy Act 2011

Where s 13 notice is required, the employer consults the worker in good faith about how the surveillance will be run, for no less than the s 13(3) notice period. Good faith means the worker has a real chance to shape how the surveillance is carried out.

Workplace surveillance of a worker is lawful only after the employer has given that worker written notice under s 13, and only as the notice describes. Timing: no later than 14 days before the start date; or within a shorter period the worker accepts; or, where a new worker joins while surveillance is already running or due to begin inside 14 days, before their first day. Content: the type of surveillance device; the method; the people usually or routinely watched; the start date; continuous or intermittent operation; a fixed period or open-ended; what the employer may use and disclose the records for; and the worker's right under s 14 to consult the employer about how it is run. An employer policy can serve as the notice. Optical surveillance at a site the worker does not usually work at needs no notice. Failure to comply is an offence (s 18(1), 20 penalty units).

An employer uses an optical surveillance device to conduct surveillance of a worker only if the device (camera housings and similar fittings that normally reveal one count as the device) can be plainly seen in the monitored workplace, and a plainly visible sign at every way into that workplace tells people they may be under surveillance there. Failure is an offence (s 18(2), 20 penalty units).

An employer conducts surveillance of a worker that tracks a vehicle or other thing with a tracking device only if a plainly visible notice on the vehicle or item says it is tracked. Where fixing a notice to the item is not reasonably practicable, the employer instead takes reasonable steps to tell workers the item is tracked. Failure is an offence (s 18(4), 20 penalty units).

An employer uses a data surveillance device to conduct surveillance of a worker only in line with an employer policy on data surveillance of workers, notified to the worker before the surveillance so that the worker can reasonably be assumed to know and understand it. The policy states how the employer's computer resources (including internet access and electronic communication applications) may and must not be used, which usage information is recorded in logs and who can see those logs, and the way the employer checks and audits compliance with the policy. Failure is an offence (s 18(3), 20 penalty units).

An employer runs no covert surveillance of workers at a workplace unless it is done under a covert surveillance authority from the Magistrates Court. Other exclusions: law enforcement officers acting under a law; optical surveillance in a correctional centre or place of lawful custody; optical surveillance of casino operations under the Casino Control Act 2006; optical surveillance of legal proceedings or proceedings before a law enforcement agency by a person exercising a statutory function. The employer bears an evidential burden on these. Offence: 50 penalty units.

No employer surveils a worker in any prohibited non-work area of a workplace, namely a toilet facility; a change room; a shower or other bathing facility; a parent or nursing room; a prayer room; a sick bay; a first-aid room; or any other area prescribed by regulation. Offence: 50 penalty units.

No employer surveils a worker who is outside any workplace. Exceptions (the employer carries an evidential burden): data surveillance of how the worker uses equipment or resources the employer supplied or paid for; tracking through a device whose tracking cannot be switched off; and an employer that is a law enforcement agency. Offence: 50 penalty units.

Once a surveillance record has no remaining use or disclosure purpose that the Act permits, the employer takes reasonable steps to destroy it or permanently de-identify it. Offence: 20 penalty units.