The Privacy Act's employee record exemption tested in ALI and ALJ

A recent decision from the Office of the Australian Information Commissioner (OAIC) clarifies the operation of the employee records exemption under the Privacy Act and brings into focus the privacy obligations of employers in regard to their employees.

Background

In ALI and ALJ (Privacy) [2024] AICmr 131, an employer was found to have breached its obligations under the Privacy Act 1988 (Cth) (Privacy Act) concerning personal information of an employee. The employee suffered a medical emergency in the employer's carpark and was taken by ambulance to hospital. Several employees observed the incident, some of whom attempted CPR.

A colleague subsequently contacted the employee's husband, requesting an update on her condition. In response, the husband provided a short update. Using the information received, the manager emailed all staff, informing them of the injured employee's condition, naming the hospital and providing an update on her health.