The Privacy Commissioner has investigated an employer after a complaint from an employee after it unnecessarily collected personal information about her, without her consent.

The employee applied for a job. As part of the application process she consented to the employer carrying out a police background check. She also indicated she had previous convictions, but not of the sort that would disqualify her from the job. No background check was carried out and she was hired.

Over a year later, the employer investigated the employee’s record following an employment dispute. During the investigation the employer gave the employee a print out of a police vetting report it had recently obtained. The employee was dismissed for a failure to disclose previous convictions, as well as inappropriate conduct in relation to the employment dispute.

The employee complained to the Privacy Commissioner under principles 1 and 2 of the Privacy Act. Principle 1 only allows organisations to collect personal information if it is for lawful purposes connected with the organisation’s functions or activities, and the information is necessary for that purpose.

Principle 2 only allows organisations to collect personal information directly from the individual unless it believes on reasonable grounds that an exception applies, like if the individual gives permission for an organisation to get information about them from other sources.

The Commissioner held that it was not necessary for the employer to collect information about the employee from the police in relation to the employment dispute. Additionally, if the employer were to collect information about the employee from the police, they must have made the vetting request within three months of the employee giving her consent. This meant that the employer did not have permission from the employee to collect the information from the police, so there was a breach of both privacy principles 1 and 2.

The Commissioner held that the employee suffered anxiety and humiliation as a result of the employer’s actions, and that there was an interference with her privacy. The Commissioner attempted to resolve the matter with mediation, but no settlement was reached. The employee was given a certificate that allows her to take her claim to the Human Rights Review Tribunal.

It is important that employers understand in what circumstances they are allowed to collect and use the personal information of their employees. Failure to do so may result in investigations, negative publicity, and expensive legal action.

Leading law firms committed to helping clients cost-effectively will have a range of fixed-price Initial Consultations to suit most people’s needs in quickly learning what their options are.  At Rainey Collins we have an experienced team who can answer your questions and put you on the right track.