Employee Records
Part of Time and attendance technology
Reviewing employee privacy implications before deployment
Map attendance data, assess monitoring and biometric features, and test access and retention settings before rollout.
Before rollout, review the configured time and attendance workflow—not just the product. Trace each field from collection through reports, notifications and vendor support, and record its purpose, recipients and retention period.
Use the review to decide which data is necessary, whether monitoring or biometric features are justified, who can view, change or export records, and when each type of data will be deleted.
Identify the data, not just the product
Basic time entries identify an employee and show when they worked. Mobile features may also collect location or device data, while a photo or biometric option adds further information.
Ask for the exact fields collected, whether collection is continuous or triggered by an event, and whether each feature can be disabled without losing the required time record. Do not assume a feature is necessary because it is included in the licence.
Separate attendance from other uses. If the purpose is to calculate hours for payroll, decide whether the system also needs precise location data, a photograph or a biometric template.
For an APP entity, APP 3 permits collection of personal information only where it is reasonably necessary for the organisation’s functions or activities. Sensitive information must also meet that test, and generally requires the individual’s consent unless an exception applies; collection must be by lawful and fair means. See the OAIC’s Chapter 3: APP 3 Collection of solicited personal information.
Check the legal and organisational boundary
Check the employee records exemption before deciding which APP requirements apply to attendance data. The OAIC’s Employee records exemption guidance is the reference point for assessing whether the exemption affects the records created by the system.
The OAIC’s Workplace monitoring and surveillance guidance says the Privacy Act 1988 does not specifically cover workplace surveillance. Employers conducting surveillance must follow relevant Australian, state or territory laws; if an employer keeps a record of monitoring, the APPs may apply.
Biometric information is sensitive information under the Privacy Act where that Act applies. The OAIC’s Biometric scanning guidance says scanning may be used to identify someone or as part of automated biometric verification only where the law authorises or requires it, or it is necessary to prevent a serious threat to life, health or safety; consent is generally required unless an exception applies.
Before enabling monitoring or biometric features, explain to employees what the system collects and why. Assess the locations and methods involved against relevant state or territory requirements before deployment.
Pros and cons of enabling biometric scanning in attendance systems
- ProsReduces time theft and improves accuracy in remote or shift-based work environments
- ConsClassified as sensitive information under the Privacy Act 1988; requires explicit consent and strict security controls
- Legal risk if misusedOnly permitted where law authorises it or to prevent serious threat to life, health or safety
Inspect access and retention in practice
Make an access matrix for employees, direct managers, payroll, HR administrators and vendor support. State what each role may view, edit and export, then test a manager who changes teams and an administrator who has left. Check downloaded reports and automatic emails as well as the main screen.
Ask where data is stored and sent, which subprocessors can access it, what logs are available and how access is removed. Give employees a way to question an attendance record and identify who can correct it.
APP 11 requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. When information is no longer needed, reasonable steps must be taken to destroy or de-identify it unless it is a Commonwealth record or an Australian law or court or tribunal order requires retention. See the OAIC’s Chapter 11: APP 11 Security of personal information and Guide to Securing Personal Information.
For required employment records, check the Fair Work Act 2009 and Fair Work Regulations record-keeping obligations. Employment records must be retained for at least seven years after employment ends; do not automatically apply that period to location events, images or diagnostic logs. Set separate periods for those extra data types and delete or de-identify them when no longer needed.
Retention periods for different attendance data types
- Photos or biometric templatesDestroy or de-identify as soon as no longer necessary; sensitive data under Privacy Act 1988
- Diagnostic logs or system eventsDelete after 12 months unless required for compliance or audit
Make the deployment decision reviewable
Record the purpose, chosen settings, alternatives considered, access tests and unresolved risks. Give employees clear information about what the system collects and how they can question an attendance record.
If a high-impact feature is not essential to produce accurate attendance and payroll records, leave it disabled while the organisation completes its assessment. Revisit the review when a vendor adds a feature, changes a data flow or expands access.
