Can You Require Employees To Use Fingerprint Scanners Or Facial Recognition At Work?

Most of us are familiar with using our fingerprint or facial recognition to unlock our phones. It's become a normal part of everyday life, but that doesn't necessarily mean employees will feel as comfortable using the same technology at work.

For employers, biometric systems can offer a convenient way to record staff attendance, manage access to certain areas and improve workplace security. Instead of using a key card or entering a PIN, employees might be asked to scan their fingerprint or face when arriving for a shift.

But what happens when an employee doesn't want to use one?

Perhaps you're introducing fingerprint clock-ins to replace traditional timesheets, only for a staff member to raise concerns about how their personal information will be collected and stored.

Can you require them to use the system? Does an employee have the right to refuse? And what should you consider before introducing the technology?

While biometric systems aren't inherently unlawful in Australian workplaces, employers need to consider their privacy and employment law obligations before making their use mandatory.

Are Employers Allowed To Use Biometric Systems At Work?

Biometric systems use a person's physical or behavioural characteristics to identify or verify who they are. In a workplace, this might involve fingerprint scanners to clock employees in and out, facial recognition systems to control building access or other technology used to confirm an employee's identity.

Unlike a traditional access card or password, these systems can involve collecting and processing information linked to an individual's physical characteristics.

Australian employers can use biometric technology for legitimate workplace purposes, but that doesn't automatically mean they can require every employee to use it.

Whether a system can be made mandatory depends on what information it collects, how it operates, whether relevant privacy laws apply and whether the employer's direction is lawful and reasonable.

For example, a fingerprint scanner used to record attendance may raise different considerations from a facial recognition system used to restrict access to a high-security area.

Our guide to biometric data and privacy obligations explains the broader privacy requirements businesses should consider.

Do Employers Need Employee Consent To Collect Biometric Information?

If you're planning to introduce fingerprint scanning or facial recognition at work, one of the first things you'll need to consider is employee consent.

Under the Privacy Act 1988, biometric information used for automated identification or verification, as well as biometric templates, is classified as sensitive information.

For employers covered by the Australian Privacy Principles, collecting this type of information generally requires the employee's consent unless a legal exception applies. The collection must also be reasonably necessary for the business's functions or activities.

This means consent alone doesn't necessarily make the collection lawful. Even where an employee agrees, the employer must still consider whether the collection meets the requirements of the Privacy Act.

But consent needs to be meaningful. It's not simply a matter of mentioning a new fingerprint scanner in passing and assuming everyone is happy to use it.

Employees should understand what information is being collected, why it's needed, how it will be used and who will have access to it. Consent should be informed, specific and voluntary.

This is particularly important in a workplace, where employees may feel pressured to agree because the request is coming from their employer.

It's also worth considering what happens if an employee later withdraws their consent or the business wants to use the information for a different purpose. An employer shouldn't assume that an employee's original agreement automatically authorises every future use of their biometric information.

Depending on the system being introduced, employers may also need to review how their existing employee privacy policies address the collection and handling of staff information.

What About The Employee Records Exemption?

Some private sector employers have an exemption under the Privacy Act for certain handling of employee records directly related to a current or former employment relationship.

However, employers shouldn't assume this exemption covers collecting new biometric information from staff before it becomes part of an employee record.

Not every business is covered by the Privacy Act in the same way, either. Certain small businesses may be exempt, although exceptions apply, and other state or territory laws may still be relevant.

The Office of the Australian Information Commissioner's guidance on employee records explains how this exemption operates.

Can An Employee Refuse To Use A Fingerprint Scanner?

An employee's refusal to use a biometric system doesn't necessarily mean they're failing to follow a lawful workplace direction.

This issue was considered by the Fair Work Commission in Lee v Superior Wood Pty Ltd [2019] FWCFB 2946.

In that case, an employer introduced fingerprint scanners to record employees' attendance at work.

One employee refused to register his fingerprint, raising concerns about the collection and security of his biometric information. He continued recording his attendance through the workplace's existing sign-in book.

The employer introduced a policy requiring staff to use the scanners and issued warnings when the employee continued to refuse. Eventually, his employment was terminated.

The Fair Work Commission Full Bench found that, in the circumstances, requiring the employee to provide his fingerprint information without consent was not a lawful direction. His refusal was therefore not a valid reason for dismissal.

The decision also highlights why employers need to consider their privacy obligations before introducing a mandatory system, rather than relying on a workplace policy to justify its use.

However, this doesn't mean employees have an unrestricted right to refuse every biometric system. The position depends on the particular technology, the employer's legal obligations and the circumstances in which employees are being asked to use it.

What If An Employee Doesn't Agree?

If an employee objects to a proposed biometric system, it's worth understanding their concerns before deciding how to respond.

For example, an employee might be comfortable recording their hours but uncomfortable providing fingerprint information to a third-party software provider.

Employers should consider whether an alternative, such as a PIN, access card or manual sign-in process, could achieve the same purpose. Whether an alternative must be offered will depend on the circumstances and applicable legal requirements.

Where the Privacy Act applies, it's also important to consider whether collecting biometric information is reasonably necessary, rather than simply more convenient than another method.

Taking disciplinary action against an employee for refusing to use a biometric system can create employment law risks, particularly if the direction isn't lawful and reasonable.

What Should Employers Check Before Introducing A Biometric System?

Even where employees are comfortable using biometric technology, introducing it requires more than choosing a software provider.

Before implementing a new system, employers should consider how it will operate alongside their existing employment arrangements.

Start With Why The System Is Needed

A business introducing fingerprint scanners to record attendance may have different operational needs from one using facial recognition to protect restricted premises.

Understanding the purpose helps establish whether biometric collection is appropriate and whether a less intrusive alternative could achieve the same result.

Consult Employees And Review Workplace Policies

Employers should explain how the proposed system will operate, what information will be collected and how staff concerns will be addressed.

Depending on the circumstances, an applicable award, enterprise agreement or other workplace requirement may also create consultation obligations.

Existing workplace policies may need to be updated to reflect the new technology. However, a policy alone doesn't replace any consent or other legal requirements.

Understand What The Technology Provider Does With The Data

Many businesses rely on external providers to manage attendance or access systems.

Before introducing one, it's worth understanding whether the provider stores fingerprint images, facial images or biometric templates, where that information is held, who can access it and when it will be deleted.

Biometric information can be particularly sensitive because, unlike a password or access card, a person's physical characteristics cannot easily be changed if the information is compromised.

Employers should also understand what happens when an employee leaves, including how their system access will be removed and whether their biometric information will continue to be stored.

Even where a provider manages the system, the employer may still have privacy obligations concerning the information collected. The provider may also have separate obligations of its own, so it's important to understand how responsibilities for protecting, accessing and deleting the information are addressed in the provider agreement.

Check Workplace Surveillance And Payroll Requirements

Depending on where employees work and how the technology operates, state or territory workplace surveillance laws may also be relevant. Employers should check any applicable notice, monitoring or other requirements before implementation.

If the system records working hours, its information should also support accurate payroll and employment records.

Under the Fair Work system, employers generally need to retain prescribed time and wage records for seven years. Introducing a biometric time clock doesn't remove those obligations.

However, this doesn't mean employers must keep employees' biometric templates for seven years. The retention of biometric information should be considered separately, including whether it is still needed and what deletion obligations apply.

Getting Your Workplace Policies Right

Fingerprint scanners and facial recognition systems can make certain workplace processes more convenient, but introducing them isn't always as straightforward as installing the technology and asking employees to use it.

Before making a system mandatory, it's important to understand which privacy obligations apply, whether employee consent is required and how your workplace policies address the proposed changes.

If you're considering introducing biometric technology or reviewing your existing arrangements, Sprintlaw can help you prepare or review your workplace policies and employee privacy documentation to suit your business.

You can contact us on 1800 730 617 or at team@sprintlaw.com.au for a free, no-obligation chat.