Privacy Considerations And Social Media in the Workplace

Transcription

1 21 May 2014 Privacy Considerations And Social Media in the Workplace Andrew D H Denton Barrister Owen Dixon Chambers 205 William Street Melbourne Vic 3000 DX94 Melbourne Vic P: F: denton@vicbar.com.au By Andrew D H Denton March 2014 saw the legislation of 13 Australian Privacy Principles (APPs) into the Privacy Act 1988 (Cth) (the Act) regulating all elements of the information life cycle ; including the notification of the collection of personal information, 2 the collection itself, 3 use and disclosure of personal information, 4 secure maintenance of personal information, 5 and in allowing individual s access to and correction of their personal information At first reading, what would appear most significant for employer organisations is what the APPs don t change. The amendments to the Act do not affect the employee record exemption 7 that was introduced to the Act in 2000, whereby any use of an employee record by an organisation directly related to a current or former employment relationship is exempt from breaching the Act. 8 These changes raise an interesting question on an employer s duty when it comes to information found on an employee s social media site. 1 LLB (Hons); BA (w dist) - Barrister at the Victorian Bar specialising in Commercial and Industrial Law. 2 APP 5. 3 APPs 3 and4. 4 APP 6. 5 APP APPs 12 and This has been seen as a contentious exemption for a number of years now, with the ALRC recommending that this exemption be wholly removed in its Australian Privacy Law and Practice: ALRC Report Section 7B(3) of the Act.

2 PAGE 2 OF 9 Employee use of Social Media 3. If an organisation is seeking to rely on the employee record exemption, then there will need to be a direct link back to the individual s employment. 9 Arguments for the exemption may be made out in relation to information obtained from social media if posts are about their employer or co-workers however the issue may be contentious if posts are relating to more generic social issues or in circumstances where the employee reasonably expected their posts to be private. 4. As was established in the case of Rose v Telstra, 10 in certain circumstances an employer has a right to terminate an employee s employment even for conduct outside of work hours. On this basis, it is now well established that employees can potentially face termination as a result of what they post on social media. 5. In recent years, the Fair Work Commission has considered a number of unfair dismissal cases alleging breach of conduct through social media providing an insight as to how online profiles may impact on employment law. 6. In Fitzgerald v Dianna Smith t/as Escape Hair Design 11 an employee was dismissed for posting sarcastic remarks about the hairdressing industry after receiving an official warning and no holiday pay. Commissioner Bissett stated that posting comments about an employer on a website (Facebook) that can be seen by an uncontrollable number of people is no longer a private matter but a public comment However, as the employee did not name the salon where she worked, nor was it suggested at trial that the information was readily available on her page, 13 it was held 9 An unsettled area of law is whether the connections/followers one has on a professional social media profile are considered property of the individual or the employer. What happens to an employee s LinkedIn or Twitter database following termination is a live question and one beyond the scope of this paper. 10 [1998] AIRC Q [2010] FWA Ibid at [50]. 13 Ibid at [54].

3 PAGE 3 OF 9 that no actual damage to the employer s business could be found. 14 As a result, the dismissal of the employee was found to be harsh, unjust or unreasonable. This case can be likened to the matter of Lukazsewski v Capones Pizzeria Kyneton 15 where an employee was found to be unfairly dismissed following a Facebook post that did not identify what co-worker it was directed toward, or specifically refer to his employer. 8. A different outcome was reached in the matter of O Keefe v The Good Guys 16 where an employee had posted a colourfully worded and intimidating comment about a coworker on his Facebook page. While in this case the employee argued that he had set up his account with the maximum level of privacy settings 17, and no specific mention of the co-worker s name or his employer could be found on his profile, the post was still found to be reasonable grounds for dismissal. A key consideration for Deputy President Swan in this matter was that, although private, there were probably 11 coworkers in his select group of friends who arguably would have seen the entry posted on his Facebook page 18 and there was no attempt made to block the viewing of these colleagues In Glen Stutsel v Linfox Australia Pty Ltd, 20 an employee was dismissed following public Facebook posts that were alleged to be both racially and sexually discriminating against two of his managers. The employee argued that he had very low technological intelligence and that he had believed it had the maximum privacy settings. 21 Commissioner Roberts found that the chains of comments have very much the flavour of a group of friends letting off steam and trying to outdo one another in being outrageous. 22 Further, it was found that the social media policy of Linfox was lacking by current standards as it was made up of merely induction training and a handbook. It was held that in the current electronic age, this is not sufficient and 14 Ibid at [56]. 15 [2009] AIRC [2011] FWA Ibid at [16]. 18 Ibid. 19 Ibid at [38]. 20 [2011] FWA Ibid at [79]. 22 Ibid at [81].

4 PAGE 4 OF 9 many large companies have published detailed social media policies and taken pains to acquaint their employees with those policies. Linfox did not The fact that no other employee that was involved in the chain of comments were sanctioned, the employee s extremely good record over 22 years (social media training certainly was not part of his induction), his age and future employment prospects were all factors 24 leading to the dismissal being found to be harsh, unjust or unreasonable From these decisions it can be seen that non-exhaustive considerations the Fair Work Commission will take into account when deciding unfair dismissal claims involving social media posts include: how tech-savvy the employee is; 26 whether the posts have a direct correlation with the person s employment; 27 and whether there was a reasonable expectation that their posts were private (especially from their colleagues.) 28 Further, the employer seeking to uphold a dismissal will need to show actual or at least threatened damage to its business In such circumstances where an employer does solicit information from social media profiles of its employees without giving the required notifications under the new APPs, it is questionable as to whether it would be directly linked to their employment and therefore unlikely to be exempt under the Act. 13. This raises an interesting question as to how a dismissal may be classified as just if the posts found to be in breach of conduct could only be obtained through unlawful means. Employer s collection notification statements should be drafted to include the collection of this type of information accordingly. 23 Ibid at [87]. 24 Ibid at [93-94]. 25 Linfox unsuccessfully appealed this matter to the Full Bench of the Fair Work Commission (see Linfox Australia Pty Ltd v Glen Stutsel [2012] FWAFB 7097) and to the Full Bench of the Federal Court of Australia (see Linfox Australia Pty Ltd v Fair Work Commission [2013] FCAFC 157). 26 See Stutsel v Linfox 27 See O Keefe v The Good Guys 28 See Stustel v Linfox; also see O Keefe v The Good Guys; also see Fitzgerald v Escape Hair Design. 29 See Fitzgerald v Dianna Smith t/as Escape Hair Design; also see Ms Lee Mayberry v Kijani Investmnets Pty Ltd ATF The Dawe Investments Trust Subway Wallsend T/A Subway [2011] FWA 3496.

5 PAGE 5 OF 9 Breach of Confidence 14. The High Court is soon to hand down its decision in the case of CBA v Barker 30 regarding whether the implied term of mutual trust and confidence is a necessary element in all employment contracts. While this case involved the alleged failure of an employer to take proper steps in assisting in the redeployment of a redundant employee, the finding of whether the implied term exists will provide the potential framework for arguments on trust and confidence when it comes to an employee s privacy. 15. The tort of breach of confidence is already established at common law. In the High Court decision of Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd, 31 Gleeson CJ adopted the 3-part test needed to bring a claim as established in Coco v A N Clark. 32 It was identified that, to satisfy the test, a plaintiff is required to establish that: The subject information is confidential; The information is imparted in circumstances of confidence; and The breach of this confidence has caused detriment to the individual This approach was followed in the Victorian Supreme Court of Appeal case of Giller v Procopets. 34 The Court in this matter went one step further, following the line of authorities in the UK 35 in awarding compensatory damages as equitable relief for breach of confidence. Finding that if a breach of confidence is shown to have occurred, damages (or more correctly an order for equitable compensation or 30 An appeal from Commonwealth Bank of Australia v Barker [2013] FCAFC (2001) 208 CLR (1968) 1 A IPR Lenah Game Meats at [30]. 34 (2009) 24 VR See Campbell v MGN Ltd ( Campbell ) [2004] 2 AC 457; also see Douglas v Hello! [2005] 3 WLR 881.

6 PAGE 6 OF 9 damages in lieu of an injunction) can be awarded for distress falling short of psychiatric injury caused by that breach of confidence The key element of this cause of action is that the personal information was actually imparted in a situation of confidence that is where the nature of the information would reasonably be assumed to be private. 18. In the employment context this may be a difficult square to circle. As can be seen from the cases noted above and taking into account the principle in Rose v Telstra 37 an argument that certain information of an employee is reasonably expected to be private will be met with stiff opposition. 19. On the other hand, it is logical to think that if some piece of personal information is not directly linked to the employment relationship and therefore not exempt as an employee record an employee would reasonably have an expectation to privacy and confidence. Proposed Statutory Cause of Action 20. A final consideration to keep in mind is the recent ALRC recommendation to introduce a new piece of legislation to establish a statutory cause of action for invasion of privacy. The debate around this proposal has largely revolved around the competing human rights of freedom of speech and right to privacy when it comes to media publications. 21. A recent case of Malcolm Pearson v Linfox Australia Pty Ltd 38 had the conflict between freedom of speech and employment rights raised. This matter again involved Linfox, though as a result of the previously adverse outcomes the company had implemented a detailed social media policy and required all employees to understand it. 36 (2009) 24 VR 1 at [418] per Neave JA. 37 [1998] AIRC Q [2014] FWC 446.

7 PAGE 7 OF As a result, the outcome was predictably more favourable to Linfox when the employee was dismissed for among other reasons refusing to sign the social media policy that Linfox had put in place. In his decision, Commissioner Gregory stated that in an employment context the establishment of a social media policy is clearly a legitimate exercise in acting to protect the reputation and security of a business. It also serves a useful purpose by making clear to employees what is expected of them. Gone is the time (if it ever existed) where an employee might claim posts on social media are intended to be for private consumption only Commissioner Gregory went further to say I accept that there are many situations in which an employer has no right to seek to restrict or regulate an employee s activities away from work. However, in the context of the use of social media, and a policy intended to protect the reputation and security of a business, it is difficult to see how such a policy could operate in this constrained way The employee appealed against this decision raising the ground among others that the social media policy infringed on his right to free speech. The Full Bench ultimately found however that the decision at first instance contained no significant error and therefore there was no need to make a finding on this issue Under the ALRC s proposed cause of action, the following five elements must be satisfied to establish a breach: There must be an intrusion into the individual s private affairs (including unlawful surveillance), or the misuse or disclosure of private information (whether true or not); 39 Ibid at [46]. 40 Ibid at [47]. 41 Malcolm Pearson v Linfox Australia Pty Ltd [2014] FWCFB 1870.

8 PAGE 8 OF The intrusion must be intentional or reckless (will not apply to negligent intrusions and will not attract strict liability); There must be a reasonable expectation of privacy in all of the circumstances; The invasion of privacy must be serious (likely to be highly offensive, distressing or harmful to a person of ordinary sensibilities in the position of the plaintiff; and The court must be satisfied that the individual s privacy interests outweigh the defendant s freedom of expression rights and any broader public interest including the economic wellbeing of the country Again, the main hurdle for an individual to overcome in an employment context is the expectation of privacy (element 3) as discussed above If satisfied however, the hurdle that would prove most problematic for employers is element 5 that the use of an employee s personal information is required for the economic wellbeing of the country. In the ordinary course of employment it is difficult to see how use of such information could go this far. Conclusion 28. Employers need to be proactive in conducting internal reviews and ensuring privacy policies and compliance procedures with the new APPs remain up to date. Organisations need to be aware of the greater obligation they have in relation to what personal information will be collected and how it will be used and eventually destroyed. If anything collected is not directly linked to the employment relationship, the employer will have an obligation to conduct collection of this information in an open and transparent way in accordance with the Act. 42 DP 80 March 2014; Proposals 5-8 inclusive 43 See pp

9 PAGE 9 OF Regardless of the outcome in CBA v Barker, the High Court in Lenah Game Meats has already shown a willingness to imply a duty of trust and confidence between parties in circumstances where it would otherwise not exist if the nature of the private information requires it. 44 With this in mind, employers should be mindful of balancing the company s business interests with the reasonable expectation of the employee to expect that information to be private. Employees should be live to what personal information their employers are collecting and why. 30. Employees should be aware of what is expected of them in terms of and social media use. It is now clearly established that their conduct outside of work hours can result in dismissal if there is some link back to their employment. While each case will turn on the facts, if an employee wishes to take to the Internet with their thoughts on the workplace, they should at least ensure that no colleagues would be able to readily access the post. 31. Time will tell whether a statutory cause of action against breach of privacy will be legislated, but as with all new policies and regulatory regimes, a true understanding of the impact of the new APPs as well as the potential action for breach of confidence in the workplace won t be reached until ample time has elapsed. 44 Lenah Game Meats at [34] per Gleeson CJ.