Privacy and employee records: what every employer should know


Privacy and employee records: what every employer should know

The new federal Privacy legislation which commenced this month raises a number of questions regarding acts and practices of employers in relation to employee records.


Get unlimited access to all of our content.


The new federal Privacy legislation which commenced this month raises a number of questions regarding acts and practices of employers in relation to employee records.  WorkplaceInfo answers your questions.

Employee Privacy

Question: Under the new privacy legislation I understand that we are able to collect information on employees through the recruitment process but it must be

destroyed if an employment relationship has not been made.


As part of every organisation's recruitment process we collect details of


referees from the candidate in order to conduct reference checks at the final stage of the recruitment process. Very often we will call a referee to discuss the applicant's past performance and unfortunately the referee is not aware that they have been put down as a reference. So, under the new law do we have to ask permission from the candidate to call a referee and check that they have informed the referee first?


Further, common practice has it that the candidate will put down a referee


that is a good friend and will not put down a referee who will give an honest opinion. If we know of someone who they have worked with and who is not put down as their referee - are we able to contact them?


Also, as we all know, an applicant will provide us with the contact details of their referees (name, work address, phone number) on their resume when they send it in to us as a reply to an advertisement or on spec. and before we have even made a decision as to whether we would like to interview them. If the referee has not given the applicant their permission to provide their personal details are we in breach of the Privacy Act just by having their personal details?

Commentary: The new privacy law which commenced on 21 December 2001 is directed at businesses that collect personal information about individuals. The law does not apply to business to business communications re business entities.

Another important aspect of the legislation is that businesses are encouraged to be open with individuals about what individual information they collect, how they collect it and what they do with it. Open access to the company's privacy policy reflects this attitude.

A third important point is that businesses can seek permission from individuals to collect personal information and to use personal information in specified ways and so not breach the legislation by acting within the permission granted by individuals.

In relation to the questions you pose:

  • if you are open with candidates as to your recruitment procedures and ask their permission for your company to act in the way you describe (in relation to their applications) you can then proceed to act with permission (if granted). So if you state that 'referees not nominated may be contacted etc ... and does the candidate agree to allow this to happen etc' then permission granted by signing the form would allow you to proceed.
  • you would be entitled to ask a referee whether they would be willing to provide a reference - noting that you are unclear as to whether the referee has been informed by the candidate - and then terminate the conversation if the referee declines.

Note that any information collected about unsuccessful candidates should be destroyed when the position is filled unless the specific permission of the failed candidates is obtained to hold their information on record.

Employee records

Question: By law, does a company have to give access to employees to their personnel files?

Commentary: The new privacy law exempts employee records from coverage by the legislation. This means that the requirement to provide access to employee records is not part of the new law.

The difficult to predict aspect of the legislation is whether all information held by employers qualifies as employee records. The borderline cases would be medical information that may at best only have marginal relevance to the employment situation.

There may be other reasons that employers believe justify access to at least the non-confidential aspects of employee records. Such an issue as maintaining accuracy of the data would be an example.

See also the article on Privacy Act and Employee Records on WorkplaceInfo.

Candidates' right of access to files

Question: My question concerns candidates' right of access to their file when they have applied for a position and whether they have the right to view reference checks that may have been recorded from a confidential discussion between the employer and referee/s, particularly if they have missed out on the position and wish to know why. Also are they entitled to view the results of any psychological appraisal or profile?

Commentary: There is an 'employee records' exemption under the new Privacy law, however, this would not extend to candidates for a position. To avoid having to debate referees' opinions etc an employer could indicate to candidates that their permission is required for referees to be approached and in providing such permission the candidate agrees that any opinion or information provided is confidential between the employer and the referee.

This permission should be confirmed in writing - eg candidate signing a document to this effect.

A similar permission to keep confidential any psychological testing could be sought. Note, however, there is some debate about psychological testing and when it becomes health information (and therefore is not exempt from the employee records exemption). It may be beneficial to contact the Office of the Privacy Commissioner as they will have a view on such testing. The web site is at: 

Additional information on 'privacy' on WorkplaceInfo.

The above selection of questions and responses are taken from WorkplaceInfo's 'Ask an Expert' service.





Post details