The NSW Workplace Surveillance Act 2005 (the Act) was passed by Parliament on 22 June 2005 and will commence on 7 October 2005.

The Act repeals and replaces the Workplace Video Surveillance Act 1998 and extends the provisions under that former Act regarding video surveillance to:

• surveillance also using computer and tracking technologies (e.g.GPS); and
• wherever people are "at work" (as opposed to simply a workplace).

The Act sets out the requirements for an employer conducting authorised surveillance (camera, computer or tracking) of staff "at work" and restricting an employee's email and internet access. Essentially, the Act requires employers to notify employees of any surveillance policy (including email and internet access policy) in such a way that it is reasonable to assume that employees are aware of and understand the policy.

Importantly for agencies, the Act regulates surveillance of emails and internet access. In complying with the best practice standards that already apply in the public sector, agencies will already meet many of the Act's requirements (refer Premier's Department Circular 1999-09 Policy and Guidelines on the Use of Employer Communication Devices and the related Protocol for Acceptable Use of the Internet and Electronic Mail, and Premier's Memorandum 2002-04 Acceptable Use of Internet and Email).

Attached at Schedule A (Workplace Surveillance Act 2005) is advice to assist agencies in reviewing existing policy and operations to ensure total compliance with the Act.

Also in reviewing policies, agencies should ensure their definition of "employer communication device" (or similar) is wide enough to encompass all employer provided electronic devices and communication channels (including 3G mobile phones, PDA's, Flash Devices and Blackberries).

C Gellatly
Director-General

Issued : Employee Relations and Workforce Planning Services (Public Employment Office)
File no: PSM/06074 Pt 1
Date: 29 September 2005
This Circular has not superseded any other Memorandum/Circular but relates to C1999-09 and Premier's Memorandum M2002-04
____________________________________________________________
 
SCHEDULE A - WORKPLACE SURVEILLANCE ACT 2005

Notification of surveillance
Surveillance may only occur where written notice of the intended surveillance has been given to the employee at least 14 days (less with agreement from the employee) before the surveillance commences. Surveillance which is not notified in accordance with the Act is considered "covert surveillance" and is an offence unless authority is obtained from a Magistrate.

Section 10 of the Act requires such notification to indicate:

• the type of surveillance to be carried out (camera, computer or tracking);
• how the surveillance will be carried out;
• when the surveillance will commence;
• whether the surveillance will be continuous or intermittent; and
• whether the surveillance will be for a specified limited period or ongoing.

Notice by email constitutes notice in writing for the purposes of this section.

Agencies should also ensure that contactors and labour hire staff are also made aware of surveillance policies.

Prohibition of surveillance when employee is not "at work"
An employee is considered to be "at work" when they are at a workplace of the employer or if they are anywhere else while performing work for the employer. Employers are prohibited from carrying out surveillance when the employee is not at work except computer surveillance of the employee's use of equipment or resources provided by or at the expense of the agency.

Computer Surveillance
The provisions which will have the most relevance for agencies relate to computer surveillance. "Computer surveillance" is surveillance by means of software or other equipment that monitors or records the information input or output, or other use, of a computer. It includes the sending and receipt of emails and the accessing of Internet websites.

These provisions are not intended to regulate legitimate business activities such as centralised data backups, network monitoring, use of anti-virus and anti-spam software, only activities that involve surveillance of staff.

Public sector agencies should already be following the requirements of Premier's Department Circular C1999-09 Policy and Guidelines on the Use of Employer Communication Devices and the related Protocol for Acceptable Use of the Internet and Electronic Mail, and Premier's Memorandum 2002-04 Acceptable Use of Internet and Email.

These documents already oblige public sector agencies to provide employees with a clear statement of their responsibilities when using the internet and email. Employees must be notified that the agency will monitor internet usage and email activity to ensure compliance with agency policies, to investigate conduct that may be illegal or adversely affect an agency or its employees, and to prevent inappropriate or excessive personal use of agency property.

All employees provided with access to the internet are already required to confirm in writing that they have read and understood the employer's policies and guidelines on internet and email use. Agencies are also currently required to display an Acceptable Usage Policy when staff login to their computers each day.

To comply with the Act agencies should now review their policies to ensure that:

• in accordance with Section 10 (as set out above) relevant policies clearly outline the nature of computer surveillance that will be undertaken;
• it is reasonable to assume that all staff are aware of and understand the policy on computer surveillance (for example through semi-regular email reminders of the policy, induction courses, the employee confirming in writing that they have read and understand the agency's policy or through a log-in notifier and acceptance);
• that any new policy or amendment is given 14 days written notice;
• new staff are notified of the agency's policy on computer surveillance prior to starting work (for example by including with the offer of employment an agency's email (and other) surveillance policy and the new employee being required to acknowledge in writing that they have read and understood the policy).

Notice only has to be given of the policy on computer surveillance and not notice of every individual act of computer surveillance.

Agencies should re-communicate their policies to staff (reviewed or otherwise) before the Act commences.

Restrictions on blocking emails or internet access
An employer must not prevent the delivery of emails or block access to internet websites unless in accordance with a policy that has been notified in advance to an employee in such a way that it is reasonable to assume that the employee is aware of and understands the policy. Agencies' policies should already outline the circumstances in which emails or access to websites will be blocked (for example transmitting, communicating or accessing pornographic or sexually explicit material, images, text or other offensive material).

Employees must also be notified of any blocked emails, unless an exemption applies. The exemptions extend to emails that are believed to be spam (as defined by the Spam Act 2003 of the Commonwealth), or believed to contain viruses, trojan horses, or offensive and harassing material. Most agencies would already provide employees with a "prevented delivery notice".

The blocking of emails simply because they are sent from or on behalf of an industrial organisation or officer; or access to a website because it contains information relating to industrial matters, is prohibited.

Camera surveillance
"Camera surveillance" is surveillance by camera or other device that monitors or records visual images. In addition to the policy notification requirements per Section 10, agencies should ensure cameras are clearly visible with signs notifying staff that they may be under surveillance. An exemption applies in the case of camera surveillance of an employee working somewhere that is not their usual workplace.

Tracking surveillance
"Tracking surveillance" is surveillance by electronic device the primary purpose of which is to monitor or record geographical location or movement (e.g.GPS). Mobile phone or credit card records that may incidentally show an employee's location are not captured. In addition to the policy notification requirements per Section 10, agencies should ensure there is a notice clearly visible on that which is being tracked, indicating that it is the subject of tracking surveillance.

Use of notified surveillance
Use of notified surveillance is limited to:

• any legitimate purpose related to the employment of staff or the employer's legitimate business activities or functions;
• certain disclosures to law enforcement officials;
• for purposes related to the taking of civil or criminal proceedings; or
• avert imminent threats of serious violence or substantial damage to property.

Failure to comply
The Act provides for offences punishable by penalties of up to 50 penalty units and restricts the use and disclosure of surveillance records.

If a corporation contravenes any provision a director or any other person concerned in the management of the corporation may also be taken to have contravened the provision if they knowingly authorised or permitted the contravention.

Proceedings under the Act may be instituted by the relevant secretary of a union, by the employee concerned or with the written consent of the Attorney-General.