For their eyes only? When can an employer access and use information on an employee's Facebook page?

Supreme Court confirms public sector employer has privacy obligations with respect to personal information on an employee's Facebook page but may use that information where there's a legitimate reason to do so (such as reasonably conducting a legitimate employment misconduct investigation).

A recent decision of the Supreme Court of Victoria (Jurecek v Director, Transport Safety Victoria [2016] VSC 285) provides guidance about when a public sector employer may access an employee's social media publications without breaching privacy laws.
The proceeding was brought under the Information Privacy Act 2000 (the Act), but the Court's findings are relevant to the Privacy and Data Protection Act 2014  because the Information Privacy Principles (IPPs) under both Acts remain the same in all material respects.

The Facts

The employee engaged in various Facebook activity, including posts and messages that were abusive and critical of her employer and other employees.  The employee operated her Facebook page under a pseudonym with privacy settings, although these did not fully restrict access to the Facebook page.
The employer was made aware of the activity and initiated a disciplinary investigation.  For the purposes of that investigation the employer accessed the employee's Facebook page, initially without her knowledge, and took screenshots of the content.

The employee was disciplined following findings of misconduct.

The employee lodged a complaint with the Privacy Commissioner, alleging that the employer had breached the IPPs by accessing her Facebook page.  The Privacy Commissioner dismissed the complaint and the matter was referred to the Victorian Civil and Administrative Tribunal (VCAT).  VCAT also dismissed the complaint and the employee appealed VCAT's decision to the Supreme Court.

Social media posts may be 'personal information' for the IPPs

The employer contended that, because the employee’s Facebook posts were accessible by anyone, they possessed the character of a 'generally available publication' and were therefore exempt from the operation of the IPPs under the Act.

The Court disagreed, taking the view that the mere publication of information on Facebook or the Internet does not necessarily make it a ‘generally available publication’.
Whether such information is a 'generally available publication' will depend on the facts and circumstances as a whole, the nature of the information, the prominence of the site, the likelihood of the access and the steps needed to access the site.

In this case, the Court found that the employee's Facebook posts were not 'generally available' and, because the posts expressed her opinion, they satisfied the definition of ‘personal information’ for the purposes of the Act.  Accordingly, the IPPs applied and the Court needed to determine whether they had been breached.

Employers may access an employee's social media posts if reasonably necessary for an investigation

The employee claimed that the employer was not lawfully entitled to access and collect her personal information (ie her Facebook posts) because such collection was not 'necessary for one or more of the organisation's functions or activities'.

The Court agreed that the employer could only access and collect the employee's personal information if it was necessary for the organisation's functions or activities.  However, the Court found that the disciplinary investigation was a function of the employer’s organisation and that accessing the employee’s Facebook account for that purpose was legitimate and necessary and not unlawful, unfair or unnecessarily intrusive.

Employers need to inform employees when they collect personal information from social media, but not necessarily immediately

The employer delayed notifying the employee about its collection of her personal information.  The employee claimed that this delay constituted a breach of the IPP notification obligations.
The Court rejected that claim.  It held that the IPPs do not impose an obligation of immediate notification but rather an obligation to take such steps as early as practically possible.  In this case, it was reasonable for the employer not to notify the employee earlier because it could have jeopardised the integrity of the disciplinary investigation.

Key implications

• Public sector employers may collect personal information from an employee’s social media page, but only when it is necessary for one or more of the organisation’s functions.
• If access to an employee's social media page is reasonably necessary for a disciplinary investigation, accessing that page and collecting relevant information is unlikely to breach the IPPs.
• If an employee's personal information is collected, employers must take steps to notify the employee as early as is reasonable in the circumstances.  Employers do not need to notify an employee immediately if doing so would jeopardise a disciplinary investigation or other legitimate purpose.

As the Court noted, 'matters of fact and degree are involved' and it is necessary to balance, 'in a reasonably proportionate way', 'what is at stake for the individual' with the 'nature and importance of any legitimate purpose' and 'the extent of the interference'.  This means that each situation needs to be considered on its merits.

To discuss workplace relations further contact:

Rosemary Robins
Solicitor
Workplace Relations & Occupational Safety
9032 3036

Jacqueline Parker
Assistant Victorian Government Solicitor,
Workplace Relations & Occupational Safety

9032 3011