[2022] FWC 81 [Note: a correction has been issued to this document]

Fair Work Commission|2022-01-21

Construction, Forestry, Maritime, Mining and Energy Union & Ors v BHP Coal Pty Ltd T/A BHP Billiton Mitsubishi Alliance / BMA & Ors [2022] FWC 81 (21 January 2022)

[2022] FWC 81 [Note: a correction has been issued to this document]

s.739 - Dispute resolution

Construction, Forestry, Maritime, Mining and Energy Union & Ors

BHP Coal Pty Ltd T/A BHP Billiton Mitsubishi Alliance / BMA & Ors

Applications for Commission to deal with a dispute in accordance with a dispute settlement procedure in enterprise agreements - Consultation on major workplace change - Site Access Requirement that employees are vaccinated against COVID - 19 and provide evidence of vaccination including type of vaccine and date given - Whether Site Access Requirement is a lawful and reasonable direction having regard to the Privacy Act and the right to bodily integrity - Privacy Act and Australian Privacy Principle 3.3 - Whether consent to provide sensitive information in relation to vaccine status is vitiated by coercion or duress in circumstances where non-compliance will result in termination of employment - Whether information verifying vaccination status is reasonably necessary for employer's functions and activities - Site Access Requirement not unreasonable because if violates right to bodily integrity - Site Access Requirement not unlawful because it breaches Privacy Act - Finding that site access requirement is lawful and reasonable having regard to the Privacy Act and the Right to bodily integrity.

[1] On 7 October 2021, employees at Queensland coal mines and related sites, operated by, or related to, the BHP Group of Companies, were informed of the introduction of a Site Access Requirement (SAR) by which they were directed that as a condition of entry to Queensland sites, they would be required, by 31 January 2022, to be fully vaccinated against COVID-19. The direction also requires that employees provide evidence of their compliance with the SAR by 31 January 2022 including the type of vaccination and the date it was received.

[2] Applications under s. 739 of the Fair Work Act 2009 (the FW Act) were made by the Construction, Forestry, Maritime, Mining and Energy Union - Mining and Energy Division (CFMMEU), the Communications, Electrical, Electronic, Energy, Information, Postal, Plumbing and Allied Services Union of Australia (CEPU) and the "Automotive, Food, Metals, Engineering, Printing and Kindred Industries Union" known as the Australian Manufacturing Workers' Union (AMWU) (collectively the Unions/Applicants) for the Fair Work Commission (the Commission) to deal with disputes in accordance with disputes settlement procedures under enterprise agreements applying at mine sites and related operations (the sites) of various entities including BHP Coal Pty Ltd, BHP Billiton Mitsubishi Alliance and Central Queensland Services Pty Ltd (collectively the Respondents). Details of the Respondents, the enterprise agreements under which the disputes are raised and related matter numbers, are set out in Annexure A.

[3] Disputes were also raised with other entities - OS ACPM Pty Ltd, OS MCAP Pty Ltd and BMA Rail - and are at earlier stages in the dispute resolution procedures under the instruments applying to employees of those entities.

[4] The CFMMEU and CEPU contend in the Form F10 applications, that the SAR is invalid and of no effect on various grounds, including that it is not reasonably necessary for the performance the employees' contracts of employment, it is an unreasonable invasion into the privacy of employees, it ignores the prevailing circumstances (namely the degree of risk presented at the workplaces by COVID-19) and ignores other and more effective means to control any risk presented at the workplaces by COVID-19 (for example, rapid antigen testing and other control measures currently in place or that have been in place). The CFMMEU and CEPU further contend that the SAR amounts to a unilateral variation of the employees' contracts of employment.

[5] The AMWU similarly contends in its F10 applications that the SAR is not a lawful and reasonable direction as among other things, the Respondents have failed to consult with employees and their representatives before the decision was made to implement the mandate, there is no state-wide public health order requiring mine workers to be vaccinated against COVID-19, there are already COVID-19 control measures at the various mine sites, the SAR was not introduced on the basis of the particular circumstances of employment that apply at each site and the Respondents have not complied with obligations under the Privacy Act 1988 (Cth) (Privacy Act).

[6] Conferences of the parties were held on 10, 15 and 22 December 2021 and 4 and 7 January 2022. Without departing from their positions, the Unions and the Respondents agreed to a Consultation Plan. The objective of the Consultation Plan was for employees and their representatives to provide all thoughts, ideas, suggestions and scientific, medical or safety data or other information about the site access requirement, and for the employers to consider all such matters, and what if any, measures to avert or mitigate the effect of the site access requirement should be taken, before making a final decision on its introduction.

[7] At the conclusion of the process established under the Consultation Plan, it was accepted by the Unions that all issues in dispute had been resolved except for issues relating to the rights of employees under the Privacy Act and to bodily integrity with the Unions maintaining that the SAR is invalid on grounds related to these matters. The parties agreed to seek a Recommendation from the Commission in the form of an answer to the following question: "Is the Site Access Requirement a lawful and reasonable direction or not, having regard to (1) the Privacy Act and (2) the right to bodily integrity?"

[8] The parties also agreed that the Recommendation would resolve the notified disputes (set out in Annexure A) and disputes involving OS ACPM Pty Ltd, OSMCAP Pty Ltd and BMA Rail. Further, it was agreed that any party aggrieved by the Recommendation may seek, within 24 hours of the Recommendation, that the disputes be referred to the President for re-allocation to another Commissioner or a Full Bench for arbitration.

[9] In accordance with agreed Directions, the Applicants filed and served submissions by 12.00 pm on Monday 10 January 2022 and the Respondents by 12.00 pm on Tuesday 11 January 2022. The matter was listed for oral submissions at 5.00 pm on Tuesday 11 January 2022. The parties also agreed that the proceedings would be conducted on the basis that any material on the Consultation Hub used by the Respondents for the purposes of disseminating information to employees, may be used as evidence for the purposes of answering the question posed for Recommendation.

[10] All parties were legally represented as of right under the terms of the BMA Enterprise Agreement 2018 and to the extent that it was necessary in relation to disputes notified under other industrial instruments, permission for legal representation was granted on the basis that I was satisfied that it would enable the matter to be dealt with more efficiently, taking into account its complexity.

[11] The CFMMEU and the CEPU were represented by Mr L Tiley of Hall Payne Lawyers. The AMWU was represented by Mr P Turner of Maurice Blackburn Lawyers. The RTBU was represented by Mr L Kennedy. The Respondents were represented by Mr I Neil SC, with Ms H Blattman of Counsel, instructed by Herbert Smith Freehills.

[12] For the reasons set out below, I have concluded that the answer to the question is: Yes, the Site Access Requirement is a lawful and reasonable direction having regard to the Privacy Act and the right to bodily integrity.

[13] In Construction, Forestry, Maritime, Mining and Energy Union, Mr Matthew Howard v Mt Arthur Coal Pty Ltd T/A Mt Arthur Coal[1] (Mr Arthur Coal), a Full Bench constituted by five Members of the Commission, dealt with a dispute about whether a direction to employees of Mt Arthur Coal Pty Ltd, a member of the BHP Group of Companies, in relation to a site access requirement that is in essentially the same terms as the direction in the present case, was lawful and reasonable. The Full Bench in Mt Arthur Coal answered a question for arbitration finding that the direction was not lawful and reasonable on the basis of failure to consult in accordance with obligations under the Workplace Health and Safety Act 2011 (NSW). All parties made submissions about the Mt Arthur Coal decision and the effect of the findings of the Full Bench on the matters in dispute in the present case. It is convenient to deal with those submissions at the outset.

[14] The Respondents submit that the Full Bench decision in Mt Arthur Coal has two classes of findings that are significant in the present case. These findings are characterised by the Respondents as conclusions of a legal character and findings of fact in relation to medical, scientific and epidemiological justification for the site access requirement.

[15] With respect to the second category of findings, the Full Bench in Mt Arthur Coal found that the following uncontentious factual propositions (at [29]), were established on the evidence:

1. COVID-19 involves a high burden of disease, greater than influenza.

2. Any infected person is at risk of developing serious illness from the virus, which may lead to death.

3. The risks posed by COVID-19 have changed with the rapid rise of the Delta variant which is more infectious and has more severe health effects than previous variants.

4. All COVID-19 vaccines currently available in Australia are effective at preventing symptomatic infection, including from the Delta variant.

5. All COVID-19 vaccines currently available in Australia substantially reduce the risk of serious illness or death, including from the Delta variant.

6. All COVID-19 vaccines currently available in Australia are safe and any adverse effects are usually mild. There is a much higher risk of developing serious complications and dying from acquiring COVID-19.

7. An unvaccinated person is more likely to acquire COVID-19 from another unvaccinated person, rather than a vaccinated person.

8. While other measures, such as mask wearing, and social distancing, are demonstrated to reduce the transmission of COVID-19, the effectiveness of these measures depends on people applying them consistently or correctly. They do not provide a substitute for the constant protection offered by vaccines, nor do they reduce the risk of developing serious illness once somebody acquires an infection.

9. Vaccination is the most effective and efficient control available to combat the risks posed by COVID-19.

10. Even with high vaccine rates in the community, COVID-19 will remain a significant hazard in any workplace in which there is a possibility that people will interact or use the same common spaces (even at separate times). The Mine is clearly such a workplace.

[61] ...higher rates of vaccination do not remove the risk of COVID-19 infection for unvaccinated workers. That is because unvaccinated workers are at risk of catching COVID-19 from other unvaccinated workers and fully vaccinated workers, who can acquire COVID-19 and efficiently transmit the disease to others. Indeed, unvaccinated people are more likely to acquire COVID-19 compared with vaccinated people. Further, unvaccinated workers on a work site increase the risk of spreading COVID-19 to vaccinated workers and other unvaccinated workers. In turn, those persons are at risk of spreading COVID- 19 outside the workplace to their families and friends.

[62] ...the rates of infection of COVID-19...throughout Australia, are likely to increase over time as movement restrictions ease, with the result that it is inevitable that everyone who works on the Mine will come into contact with someone - probably many people - who are infected with COVID-19. Witness R5 [an expert medical witness] went on to express his opinion that 'with reopening the virus will spread through Australia, and [although] the timing in the given locations [is] not exact, but in time it will spread to all locations, and be present in all work places'. When COVID-19 does so spread, those who remain unvaccinated are at greatest risk of acquiring COVID-19, becoming seriously ill or dying from acquiring COVID-19, and infecting other people with whom they come into contact.

[85] We accept that the object and purpose of the [Mt Arthur] Site Access Requirement is to protect the health and safety at work of Mt Arthur's employees and other people at the Mine.

[252] ...The Mt Arthur Site Access Requirement] is directed at ensuring the health and safety of workers of the Mine.

[16] The Full Bench in Mt Arthur Coal found that: "Even with high vaccine rates in the community, COVID-19 will remain a significant hazard in any workplace in which there is a possibility that people will interact or use the same common spaces (even at separate times)." The Respondents submit that each site subject to the SAR is such a workplace.

[17] The Respondents point to the fact that the Applicants do not take issue with the findings made by the Full Bench in Mt Arthur Coal and submit that those findings are manifestly correct. The Respondents also submit that the content of the SAR is identical in every material respect to the site access requirement that was considered by a Full Bench in Mt Arthur Coal. Further, with one qualification, the reasons and justification for the SAR are also identical in every material respect to those that supported the Mt Arthur SAR. The qualification is that, when Mt Arthur was heard, the Omicron variant of COVID-19 had not been identified in Australia; COVID-19 infections are now at higher rates in Australia than seen throughout the pandemic and a number of positive cases have been identified at the Respondents' Queensland Mines. The Respondents submit that the subsequent arrival and rapid spread of Omicron is a further reason, in addition to those found in Mt Arthur Coal, that supports the introduction and implementation of the SAR.

[18] In these respects, there is no material distinction between the facts considered by the Full Bench in Mt Arthur Coal, with those in this case. There is also no challenge in this case to any aspect of the Health and Safety Rationale, and it should be accepted as being factually correct in every respect. The SAR is supported by the material on the Consultation Hub which is also not disputed. The SAR is supported by the findings of fact in the Mt Arthur Coal decision at [29] and those findings should be accepted as correct, and applied mutatis mutandis in the present case, on the basis that:

They were made after a full hearing by a five-member Full Bench that had been specially constituted to hear and determine challenges to the lawfulness and reasonableness of the Mt Arthur SAR. The Full Bench had the benefit of receiving evidence and submissions from each party and intervenor in those proceedings;

The CFMMEU was an applicant in Mt Arthur Coal. The AMWU participated in the hearing as an intervenor, but with the same rights as a party. It led evidence and made submissions;

• The decision in Mt Arthur Coal, including the findings of fact set out in the previous paragraph, was a focus of consultation about the SAR.[2] No question about the correctness of any of these findings of fact was raised in consultation; and

There is no challenge to their correctness in these proceedings.

[19] The basis of, and rationale for, the SAR is set out in a communication to employees issued via the Consultation Hub, updated on 6 January 2022, which states in summary that: BHP has an obligation and responsibility to keep workers safe and healthy; COVID-19 remains a significant risk to the Company's workforce and vaccination remains the most efficient and effective control available to combat the risks posed by COVID-19. Reference is also made to the removal of harder controls and isolation measures by most State and Territory Governments and that in combination with the emergence of the more transmissible Omicron variant, the likelihood of infection including in the workplace, increases.

[20] Other relevant matters set out in the communication are that: unvaccinated people have a significantly higher likelihood of serious illness and possibly death if they get COVID-19; Delta strain continues to circulate and there is evidence it causes more severe illness; the more transmissible Omicron is expected to overtake Delta as the predominant strain by early 2022; vaccinated people can still transmit the virus but at a lower rate than those who are unvaccinated; all levels of Government are transitioning away from hard controls; and many BHP workers commute and travel, including to remote and regional areas.[3]

[21] The Respondents submit that these matters are not contested by the Applicants in the present proceedings and the health and safety rationale should be accepted as being factually correct. In oral submissions the representatives of the Unions clarified that while the Unions do not take issue with the matters set out in the documents explaining the basis of and rationale for the direction in these proceedings, they reserve their rights to do so in any later proceedings. The Respondent also submits that the communication is consistent with the findings of the Full Bench in Mt Arthur Coal which should be accepted as correct. I accept that submission and the factual correctness of the health and safety rationale for the SAR.

[22] The Respondents' submissions also detail the SAR requirements and the proposal for its implementation. The information in those submissions is not disputed. The SAR requires that employees have received two doses of approved COVID - 19 vaccinations. Employees are also required to provide information to demonstrate their vaccination status. There are four sources of information that the Respondents will accept as verification of a COVID - 19 Digital Vaccination Certificate. They are depicted as images on an information sheet issued by BHP and appended to the submissions of the CFMMEU and CEPU as Attachment "A". In the order they are set out on the information sheet issued by BHP, the first document is titled "COVID - 19 Digital Certificate". The second document is also titled "COVID - 19 Digital Certificate" but is in a in a form which is designed to be saved to a device such as a smart phone. The third document is titled "International COVID - 19 Certificate". The fourth document is titled "Immunisation History Statement".

[23] The three documents the Respondents will accept as evidence, titled as Certificates, include the employee's name, date of birth, vaccine type, both vaccine dose dates and the document number. In addition to that information, the Immunisation History Statement includes all other immunisations that the holder has received, and the type of vaccine given. The document number is unique to each Certificate and the Immunisation History Statement and is not connected to the Individual Health Identifier of the holder and does not allow that number to be discovered by reference to the document number. The Individual Health Identifier of the holder is included on the first, third and fourth document. It is not included on the Digital Certificate designed to be saved to a device. However, the Respondent states, and it is not disputed, that it neither requires nor collects the Individual Health Identifier of the document holder.

[24] There are two other forms of COVID - 19 Digital Certificate depicted on the BHP information sheet. These are also titled "COVID - 19 Digital Certificate". The first such certificate (the fifth on the information sheet) is the certificate found on a smart phone application known as the "Check in Queensland app". The second such certificate (the fifth on the information sheet) is a certificate which can be accessed via the MyGov or Medicare apps. These certificates indicate the employee's name, date of birth and date the certificate is valid from, being the date of the last vaccination. These documents are not accepted by the Respondents as evidencing vaccination status.

[25] The SAR provides for two means by which employees can provide information evidencing their vaccination status:[4]

(a) They can upload the information to BHP's Vaccination Data Capture Portal (Vaccination Portal) on its Digital Work Space (DWS), being BHP's internal intranet;

(b) Alternatively, they can visit designated stations on-site at which authorised personnel can sight and record their Vaccination Information.

[26] The Respondents state that in either case, the employee needs either their COVID-19 digital certificate issued by the Federal Government (Vaccination Certificate) or their immunisation history statement. An employee will only have a Vaccination Certificate if they have received two doses of an approved COVID-19 vaccine. If they have only received a single dose, they will instead have access to an immunisation history statement. In both cases employees are asked whether they give their express consent to the collection of the information via the following consent notice. If an employee does not consent the information is not collected.

To keep you and our workforce safe and healthy BHP wishes to collect and process information about your COVID-19 vaccination status. This will assist us to plan for the future and escalate or de-escalate our COVID-19 controls and enable us to make decisions about workplace and site access in order to protect you and other BHP workers against COVID-19 infection risk.

1. collecting and processing information about your COVID-19 vaccination status for the purposes described above; and

2. where necessary, disclosing this information to third parties (health, security, site access and travel service providers); and

3. storing this information in BHP systems in line with our Global Privacy Notice for BHP Workers.

Giving your consent is voluntary and you are free to withdraw, alter or restrict your consent at any time by notifying BHP in writing. However, it would be helpful for you to share your vaccination status with us, as it will assist BHP to identify controls to continue to keep our workers as safe and healthy as possible. Without access to this information, we may assume that you have not received the COVID-19 vaccine for the purpose of our controls, including workplace entry controls.

We will manage all of your information in accordance with privacy laws. Your information will be stored securely and only accessible by the BHP Health Team. For more about BHP privacy management practices, and about your rights in relation to information held by BHP, please see the Global Privacy Notice for BHP Workers and Our Requirements for Information Governance and Controlled Documents."

[27] To upload proof of their vaccination status employees are able to click on a link on the Vaccination Portal and download and complete a "COVID-19 Vaccination Form" (Vaccination Form). On the Vaccination Form, employees enter their name, date of birth, BHP employee number, date of their COVID-19 vaccine dose(s), the type of vaccine they had (i.e. Pfizer, AstraZeneca, or Moderna) and the document ID of either their Vaccination Certificate or immunisation history statement (together, the Vaccination Information). The document ID refers only to the Vaccination Certificate or immunisation history statement. It is not the employee's Individual Health Identifier number and does not enable that number to be identified. The employee also attaches a copy of either their Vaccination Certificate or their immunisation history statement.[5]

[28] The Vaccination Form makes clear that consent is voluntary and can be withdrawn at any time and requests employees to express their consent by ticking a box marked: "I agree".[6] If employees do not indicate agreement in this manner, they will not be able to submit through the Vaccination Portal and therefore no record is created in the Vaccination Portal or the Cority database, used by BHP to record health and safety hygiene data.

[29] As an alternative to submitting the Vaccination Form via the Vaccination Portal, employees can give their Vaccination Information in person to a BHP Health Team member at site. The process involves the Health Team member reading out the consent notice set out on the Vaccination Form,[7] including that consent is voluntary and employees are free to withdraw, alter or restrict their consent at any time by notifying BHP in writing. Employee orally confirm consent and provide the Vaccination Information by showing the Vaccination Certificate or immunisation history statement to the BHP Health Team member, who uses it to verify the Vaccination Information, but without taking a copy of the document and the Health Team member inputs only the Vaccination Information into Cority.[8]

[30] Other relevant implications of the SAR are that employees who cannot comply with a site access requirement on the date that it becomes effective will be stood down on unpaid leave. Those who cannot comply with the SAR without reasonable excuse will be asked to show cause why their employment should not be terminated."[9] Further, it is stated that if employees do not provide access to their vaccination status, BHP "may assume that you [the employee] have not received the Covid-19 vaccine for the purpose of this critical control."[10]

[31] The structure of the case advanced by the CFMMEU and the CEPU is that the primary argument is based on the Privacy Act issue and the alternative argument relies on the bodily integrity issue. In relation to the bodily integrity issue, it is not asserted by the CFMMEU and the CEPU that the effect the SAR has on bodily integrity is, of itself, sufficient to make the site access requirement unreasonable. Rather, the argument advanced on behalf of the CFMMEU and the CEPU is that taken together, the contravention of the Privacy Act and the effect that the SAR has on bodily integrity cumulatively tips the balance against the reasonableness of the SAR. The AMWU's position is that the privacy issue and the bodily integrity issue must be weighed in considering whether the SAR is lawful and reasonable.

[32] The Unions' submissions all point to the fact that there is nothing in public health orders, the industrial instruments or the express terms in the employees' contracts that would provide the legal basis for the SAR. It follows that the basis for the SAR must derive from the term implied into all contracts of employment to the effect that employees must follow the lawful and reasonable directions of their employer. Such a term is implied by law, in the absence of a contrary intention by the parties. In Mt Arthur Coal the Full Bench accepted that a direction must be lawful and reasonable for an employee to be obliged to follow it.[11]

[33] The seminal decision referred to by the Unions concerning the requirement of employees to follow lawful and reasonable directions of their employer, is R v Darling Island Stevedoring & Lighterage Co Ltd; Ex parte Halliday[12] (Darling Island Stevedoring) in which Dixon J summarised the common law position as follows:

"Naturally enough the award adopted the standard or test by which the common law determines the lawfulness of a command or direction given by a master to a servant. If a command relates to the subject matter of the employment and involves no illegality, the obligation of the servant to obey it depends at common law upon its being reasonable.

In other words, the lawful commands of an employer which an employee must obey are those which fall within the scope of the contract of service and are reasonable."

[34] The CFMMEU and CEPU contend that the meaning of the word "lawful", in the context of "l_awful and reasonable_" is elusive, but point to the following definitions in the Macquarie Dictionary (3rd edition) which should be adopted for the purpose of the Recommendation:

Legal appointed, established or authorised by law; deriving authority from law.
Illegal not legal; unauthorised.
Unlawful Not lawful; contrary to law; illegal; not sanctioned by law.
Lawful allowed or permitted by law; not contrary to law.

[35] The above definitions demonstrate that there is no material difference between legal/lawful on the one hand and illegal/unlawful on the other. It is a false dichotomy to suggest that, for example, illegality is concerned with the criminal law whereas unlawfulness is concerned with the civil law. The terms lawful and legal (and their negative equivalents) can and should be used synonymously.

[36] The CFMMEU and CEPU further note that obviously enough, a direction will not be lawful if it is unlawful. The direction will be unlawful if it involves, as a constituent part, a failure to comply with applicable legislation. As the above definitions demonstrate, whether the legislative breach is one which attracts a civil penalty or some other remedy, is of no moment.

[37] The AMWU highlights that a direction must be both lawful and reasonable, and that as the Federal Court observed in McManus v Scott-Charlton[13]:

"Questions of illegality and reasonableness apart, the alternate formulations of lawfulness proposed by Dixon J are that the command "relates to the subject matter of the employment" or falls "within the scope of the contract of service". It is clear that these were intended to be synonymous in the limitation they expressed.

The need for some such limitation is patent: employment does not entail the total subordination of an employee's autonomy to the commands of the employer. As was said by the President in Australian Tramway Employees' Association v Brisbane Tramways Co Ltd [1912] CthArbRp 17; (1912) 6 CAR 35 at 42:

"A servant has to obey lawful commands, not all commands. The servant does not commit a breach of duty if he refuse to attend a particular church, or to wear a certain maker's singlets. The common law right of an employee is a right to wear what he chooses, to act as he chooses, in matters not affecting his work."

There are obvious, and powerful, considerations of civil rights and liberties and of due process which inform this. These need not be laboured here although they are of no little significance in the resolution of this case."[14]

[38] Further, the AMWU cited the principle that the reasonableness and proportionality of a direction ought be assessed on a case-by-case basis as observed by the Full Bench in Mt Arthur Coal:

"[259] The reasonableness of a direction is a question of fact having regard to all the circumstances, which may include whether or not the employer has complied with any relevant consultation obligations; the nature of the particular employment; the established usages affecting the employment; the common practices that exist; and the general provisions of any instrument governing the relationship."[15]

[39] The CFMMEU and the CEPU contend that as in the Mt Arthur Coal case, where a direction involves one aspect of unreasonableness it is rendered wholly invalid. It is also contended that the SAR is "replete with unlawfulness and unreasonableness" having regard to the Privacy Act issue and that on this basis alone, the Commission should conclude that the direction is invalid. Alternatively, the Commission should reach the conclusion that the direction is invalid having regard to the cumulative effect of the Privacy Act issue and the issue of bodily integrity.

[40] The AMWU submits that while many matters which might reasonably be said to bear on the question of lawfulness and reasonableness were canvassed in Mt Arthur Coal, and it does not cavil with matters where the Full Bench made findings, the Privacy Act issue and the bodily integrity issue were not dealt with to finality in that case. These matters are of concern to AMWU members and must be weighed in considering whether the SAR is lawful and reasonable, a matter that was not dealt with in Mt Arthur Coal.

[41] The Respondents contend that premise that the SAR is a breach of the Privacy Act is of critical importance, particularly to the case advanced by the CFMMEU and the CEPU, with the result that if the argument based on the Privacy Act fails, the case advanced by those Unions falls away. It is convenient to deal first with the bodily integrity issue.

[42] The CFMMEU and CEPU adopt and support the AMWU's position on the issue of bodily integrity. The CFMMEU and the CEPU also contend that the SAR is replete with unlawfulness and unreasonableness, having regard to the Privacy Act. On this basis alone, the Commission should conclude that the direction is invalid. Alternatively, the Commission should reach the conclusion that the direction is invalid having regard, cumulatively, to the bodily integrity issue and the Privacy Act issue. As was the case in Mt Arthur Coal, where a direction involves one aspect of unreasonableness, it will be rendered wholly invalid. The CFMMEU and CEPU submit that the same applies to unlawfulness.

[43] The AMWU's position is that the Commission should issue a recommendation concluding that the SAR is not a lawful and reasonable direction having regard to the Privacy Act and the right to bodily integrity. The AMWU submits that employees subject to the SAR have a right to bodily integrity at common law.[16] Considerations of civil rights and liberties inform the limitations on the capacity of an employer to direct its employees.[17]

[44] The AMWU contends that it ought be uncontroversial, as it was in Mt Arthur Coal, that absent medical contraindications, the choice for employees is between being vaccinated and continuing to be employed by their employer.[18] The AMWU submits that the pressure being applied to employees to give up their bodily integrity and to cede a civil right, when otherwise they would not wish to do so, is a matter that is relevant in an assessment of the reasonableness of the direction.

[45] The AMWU referred to the statement of the Full Bench in Mt Arthur Coal that:

"[223] The practical effect of the Site Access Requirement is to apply pressure to employees to surrender their bodily integrity (by undergoing medical treatment) in circumstances where they would prefer not to do so. In our view, this is plainly a relevant matter in assessing the reasonableness of the direction. However, we also accept that this factor is not determinative of the question of reasonableness; it is a consideration to be weighed in the balance with the other relevant considerations..."[19]

[46] The AMWU submits that the significant pressure exerted by the Respondents upon employees to forfeit their right to bodily integrity is a matter which weighs against a conclusion that the SAR is a reasonable direction. It is a matter which alongside the Respondents' breaches of the Privacy Act, leads to a conclusion that the direction is unreasonable.

[47] In oral submissions the AMWU clarified that it is not contended that the right to bodily integrity is violated by the SAR and thereby the direction is rendered unlawful. Rather, consistent with the decision in Mt Arthur Coal the AMWU submits that the practical effect of the SAR is that employees are forced to choose between getting vaccinated where they do not wish to do so or losing their job. This pressure goes to the reasonableness of the direction, and it is a matter to be weighed in the balance alongside what the AMWU asserts is a breach of the Privacy Act.

[48] The Respondents accept in Mt Arthur Coal that there was a common law right to bodily integrity,[20] and make the same concession in the present matters. In Mt Arthur Coal the Full Bench held that the right to bodily integrity consisted of "the right to an individual to choose what occurs with respect to his or her own person."[21]

[49] The Respondents contend that the question in these disputes is whether that right is violated by the SAR. The same question was put in issue in Mt Arthur Coal.[22] The Full Bench held that the right to bodily integrity was not violated by the Mt Arthur SAR, because:

• It did not purport to confer authority on anyone to perform a medical procedure on anyone else;[23] and

• It did not involve coercion in the legal sense, such as would vitiate an employee's consent to be vaccinated.[24]

[50] The same conclusions should be applied to the SAR in these disputes, for the following four reasons. First, as the content of the SAR is materially identical to that of the Mt Arthur SAR, there is no material basis on which to distinguish them. Second, although, as a non-judicial body, the Commission is not bound by the doctrine of precedent,[25] as a matter of policy and sound administration it and its predecessors have generally followed previous Full Bench decisions relating to the issue to be determined, in the absence of cogent reasons for not doing so.[26] Here, there are no such reasons. Third, the Respondents submitted that there are cogent reasons for the Commission as presently constituted to follow and apply the conclusions in Mt Arthur Coal in respect of bodily integrity on the basis that:

• The decision is manifestly correct;[27]

• The Full Bench cited in support of its conclusions a passage from the first instance decision of the New South Wales Supreme Court in Kassam v Hazzard.[28] That aspect of Kassam has subsequently been confirmed on appeal by the New South Wales Court of Appeal.[29]

[51] Fourth, and independently of the first three reasons, the Respondents contend that it would be an abuse of process if the Applicants were to seek to reagitate in these issues that were conclusively resolved in Mt Arthur[30] and they should not be heard to do so.

[52] According to the Respondents, once the conclusions of the Full Bench in Mt Arthur Coal are applied in the present case, it necessarily follows that the SAR is not unlawful because of its effect on bodily integrity. The same process of reasoning was applied in Mt Arthur Coal where the Full Bench held that the Mt Arthur SAR was prima facie lawful.[31] It did so notwithstanding that it recognised that "[t]he practical effect of the [Mt Arthur] Site Access Requirement is to apply pressure to employees to surrender their bodily integrity (by undergoing medical treatment) in circumstances where they would prefer not to do so."[32] Plainly, the Full Bench did not consider that this rendered the Mt Arthur SAR unlawful. The Respondents' position is that the same conclusion should be applied to the Queensland SAR.

[53] In Mt Arthur Coal the Full Bench held that the practical effect of the Mt Arthur SAR was a relevant matter in assessing the reasonableness of the direction. However, the Respondents also accept that this factor is not determinative of the question of reasonableness; it is a consideration to be weighed in the balance with the other relevant considerations.'[33] The Respondents' view is that the same conclusions should be applied to the SAR. The Respondents submit that the following considerations are relevant, and together substantially outweigh the fact that the practical effect of the SAR is to apply pressure to employees to surrender their bodily integrity by being vaccinated in circumstances where some of them may prefer not to do so.

[54] First, the Respondents referred to Mt Arthur Coal where the Full Bench made the following finding:

"We note that there are a range of considerations which otherwise weighed in favour of a finding that the Site Access Requirement was reasonable, including that:

1. It is directed at ensuring the health and safety of workers of the Mine.

3. It is a reasonably proportionate response to the risk created by COVID- 19.

4. It was developed having regard to the circumstances at the Mine, including the fact that Mine workers cannot work from home and come into contact with other workers whilst at work.

5. The timing for its commencement was determined by reference to circumstances pertaining to NSW and the local area at the relevant time.

6. It was only implemented after Mt Arthur spent a considerable amount of time encouraging vaccination and setting up a vaccination hub for workers at the Mine."[34]

[55] Consistent with the Respondents' submissions that the factual findings in Mt Arthur Coal regarding the COVID-19 disease should be accepted in these disputes, these findings should be applied, mutatis mutandis, to the SAR.

[56] Second, the Respondents submit that the Full Bench's reference in the passage quoted in the previous paragraph to the "health and safety of workers" was no doubt intended to take up the findings of fact set out in paragraph [29] of the Mt Arthur Coal decision in relation to COVID - 19, which are a powerful factor supporting the reasonableness of the SAR, just as they were for the Mt Arthur SAR.

[57] Third, all the Respondents are subject to statutory obligations to manage health and safety at their workplaces, and employees are subject to correlative duties to protect their own health and safety and that of other workers. For example, section 39(1)(c) of the Coal Mining Safety and Health Act 1999 (Qld) (CMSH Act) requires a coal mine worker to take any "reasonable and necessary course of action to ensure anyone is not exposed to an unacceptable level of risk". That requirement in section 39(1)(c) of the CMSH Act encompasses, as held in Grant v BHP Coal Pty Ltd,[35] the imposition of conditions that may constitute an intrusion on the person. The facts and matters set out in the Health and Safety Rationale, the documents supporting that rationale, and the findings of fact made by the Full Bench in Mt Arthur Coal, all demonstrate that the SAR is directed to compliance with the Respondents' statutory and common law obligations to protect health and safety at the workplace. The Respondents submitted that the obligations, and the correlative rights that they create, are another powerful factor supporting the reasonableness of the SAR.

[58] Fourth, the most important consideration supporting the conclusion in Mt Arthur Coal that the Mt Arthur SAR was unreasonable was deficiencies in consultation.[36] This consideration has no application to these disputes. There has been fulsome consultation. Employees who have views regarding vaccination as a SAR have been heard, they have been consulted, and their views have been taken into account.[37] It follows that the balancing exercise identified in M_t Arthur_ weighs conclusively in favour of the reasonableness of the SAR.

The Privacy Act issue

Relevant provisions of the Privacy Act

[59] The provisions of the Privacy Act which were the focus of submissions and are relevant to the matters in dispute, are set out below. The objects of the Privacy Act set out in s. 2A are as follows:

(a) to promote the protection of the privacy of individuals; and

(b) to recognise that the protection of the privacy of individuals is balanced with the interests of entities in carrying out their functions or activities; and

(c) to provide the basis for nationally consistent regulation of privacy and the handling of personal information; and

(d) to promote responsible and transparent handling of personal information by entities; and

(e) to facilitate an efficient credit reporting system while ensuring that the privacy of individuals is respected; and

(f) to facilitate the free flow of information across national borders while ensuring that the privacy of individuals is respected; and

(g) to provide a means for individuals to complain about an alleged interference with their privacy; and

(h) to implement Australia's international obligation in relation to privacy."

[60] Section 6 Interpretation, contains the following definitions:

"consent" means express consent or implied consent.

[61] Section 14 explains that the Australian Privacy Principles (APP) are set out in the clauses of Schedule 1 to the Privacy Act. Section 15 provides that APP entities, which by virtue of the definition in s. 6C are organisations including bodies corporate, must not do an act or engage in a practice that breaches an Australian Privacy Principle. Principles 3.3 and 3.4 relevantly provide:

"3 Australian Privacy Principle 3 - collection of solicited personal information

3.3 An APP entity must not collect sensitive information about an individual unless:

(a) the individual consents to the collection of the information and:

(i) if the entity is an agency - the information is reasonably necessary for, or directly related to, one or more of the entity's functions or activities; or

(ii) if the entity is an organisation - the information is reasonably necessary for one or more of the entity's functions or activities; or

(b) subclause 3.4 applies in relation to the information.

3.4 This subclause applies in relation to sensitive information about an individual if:

(a) the collection of the information is required or authorised by or under an Australian law or a court/tribunal order; or

(b) a permitted general situation exists in relation to the collection of the information by the APP entity; or ...

Note: For permitted general situation, see section 16A. For permitted health situation, see section 16B."

[62] Section 16A of the Privacy Act concerns permitted general situations in relation to the collection, use or disclosure of personal information. The provision is set out in tabular form and the present dispute relates to item 1 in the table as follows:

"16A - Permitted general situations in relation to the collection, use or disclosure of personal information

(1) A permitted general situation exists in relation to the collection, use or disclosure by an APP entity of personal information about an individual, or of a government related identifier of an individual, if:

(a) the entity is an entity of a kind specified in an item in column 1 of the table; and

(b) the item in column 2 of the table applies to the information or identifier; and

(c) such conditions as are specified in the item in column 3 of the table are satisfied."

(a) it is unreasonable or impracticable to obtain the individual's consent to the collection, use or disclosure; and

(b) the entity reasonably believes that the collection, use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.

[63] In relation to breach of an Australian Privacy Principle, s. 6A(1) provides:

(1) For the purposes of this Act, an act or practice breaches an Australian Privacy Principle if, and only if, it is contrary to, or inconsistent with, that principle.

[64] It is not disputed that the Respondents have responsibilities under the Privacy Act. The Respondents are organisations as defined in s.6C of the Privacy Act and therefore each is an "APP entity",[38] and is required to comply with the Australian Privacy Principles (APPs) in relation to collection of personal information from the Employees.[39] It is also not disputed that the direction provides for the Respondents to collect personal information of employees for inclusion in a record, and that the information is sensitive information as defined in the Privacy Act.[40]

[65] The Full Bench in Mt Arthur Coal set out the following summary of the relevant Privacy Act provisions which I adopt.

[207] ... An APP entity 'collects' personal information 'only if the entity collects the personal information for inclusion in a record or generally available publication'. A 'record' includes a document or an electronic or other device. An APP entity must collect personal information only by fair and lawful means.

[208] APP 3.3 provides that an APP entity that is an organisation must not collect 'sensitive information' about an individual unless the individual consents and the information is reasonably necessary for one or more of the organisation's functions or activities. 'Sensitive information' includes health information about an individual, which would include information about a person's vaccination status. The requirement to have consent to the collection of sensitive information in APP 3.3. is subject to the exceptions in APP 3.4, which include:

where the collection of the information is required or authorised by an Australian law. This could include where required under public health orders or directions, and

where the APP entity is an organisation, and a permitted general situation exists in relation to the collection of information by the APP entity. This includes where the APP entity reasonably believes that the collection is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.

[209] 'Consent' in APP 3.3. means 'express or implied consent'. The Australian Privacy Principles Guidelines issued by the Australian Information Commissioner under s.28(1) of the Privacy Act explain:

• the individual is adequately informed before giving consent

• the individual has the capacity to understand and communicate their consent.'

[66] The Full Bench in Mt Arthur Coal also set out the following guidance issued by the Office of the Australian Information Commissioner on COVID-19 vaccinations and privacy obligations explains:

"Consent to collecting vaccination status information must be freely given and constitute valid consent. You must make sure that your employees understand why you need to collect this information, what you will use it for, and give them a genuine opportunity to provide or withhold consent. You should exercise caution in seeking consent in these circumstances given the imbalance of power in the employment relationship that may cause employees to feel pressured or obligated to provide their consent.

Public health advice will be useful to inform what information, including vaccination status information, is reasonably necessary to prevent or manage COVID-19. Applicable workplace laws and contractual obligations will also influence whether the collection of vaccination status information would be considered reasonably necessary for your activities or functions.

Where you have provided a lawful and reasonable direction to your employee to be vaccinated, you can also ask your employee to provide evidence of their vaccination if you are satisfied that this is reasonably necessary and you have obtained the employee's consent."

[67] The Respondents have said they are not content to simply sight, but not collect, employees' vaccination status. The CFMMEU and the CEPU submit that the document published by the Respondents on 6 January 2021 entitled "COVID-19 Digital Vaccination Certificate Verification" (Vaccination Verification Document), ostensibly directed at the second method of verification, makes apparent that the material sought to be collected by the Respondents travels beyond whether the employee is vaccinated. The Respondents also seek vaccine type, both vaccine dose dates and document number.

[68] Both methods available to employees to verify vaccination status require the collection by the employer of sensitive information. Both methods purportedly require employees to consent to the collection of their sensitive information. Putting to one side the question of reasonable necessity, the CFMMEU and CEPU contend that the direction falls at the first hurdle and that any consent an employee may supply is vitiated by the threat that, if they do not consent, they may be disciplined or have their employment terminated.[41] Reference is made to the decision of a Full Bench of the Commission in Lee v Superior Wood[42] where a Full Bench of the Commission found that a direction in relation to the provision of sensitive information was unlawful and unreasonable because it was contrary to the Privacy Act and stated that any consent by the employee in that case would likely have been vitiated by the threat of termination of his employment.

[69] Applying this conclusion to the present case, the CFMMEU and the CEPU contend that it can hardly be described as valid consent in circumstances where an employee (who wishes to convey vaccination status) has no alternative available to verify vaccination status that does not involve the collection of sensitive information.

[70] The CFMMEU and CEPU pose the rhetorical question as to why the "show the green tick" method of establishing vaccination status is good enough for the State of Queensland when a coal miner enters the Blackwater Hotel, but not good enough for BHP when a coal miner enters the Blackwater Mine? The CFMMEU and CEPU submit that these curious methods of verifying vaccination status invite consideration of whether the test of "reasonable necessity" in APP 3.3 is met. Importantly, APP 3.3 is not concerned with whether the vaccination requirement is reasonably necessary, but rather, whether the collection of sensitive information is reasonably necessary.

[71] The CFMMEU and CEPU submissions set out various forms of Vaccination Verification Document which may be utilised and assert that there are suitable alternatives that are open to the Respondents and which would comply with the Privacy Act. These include, at least, the "C_heck in Queensland_" app and the presentation of an employee's COVID - 19 Digital Certificate which does not contain sensitive information. According to the CFMMEU and the CEPU, the mere availability of these alternative methods demonstrates that the methods nominated by the Respondents are not reasonably necessary.

[72] Insofar as the Respondents assert that they need to collect the sensitive information in order to interrogate its accuracy, that argument fails for three reasons. Firstly, one should not presume that employees will engage in vaccine certificate fraud, which would be serious misconduct if not a criminal offence. Secondly, given the nature of the information, it is not as if the provision of the additional sensitive information (which is presumably no less susceptible to fraud) would in practical terms enable the Respondents to take any real steps to interrogate its accuracy: an employer can hardly ask an employee's doctor whether they gave a particular patient a particular vaccine on a particular date. Thirdly, most importantly, there are other and more effective means of addressing this concern: an employer with a proper basis to doubt the information provided could direct an employee to provide better evidence of their vaccination status (without directing the collection of sensitive information), for example, by the employee obtaining an appropriately worded medical certificate.

[73] The CFMMEU and CEPU's position is that the two methods of verifying vaccination status that are embedded within the direction are not fit for purpose. The concerns go to the information sought (more than whether vaccinated) and the way in which it must be provided (collected not sighted). The CFMMEU and CEPU submit that these methods do not comply with the Privacy Act in respect of consent nor in respect of reasonable necessity. They are in that sense unlawful which means the direction cannot be a lawful one. It is therefore also unreasonable.

[74] Further, the CFMMEU and CEPU submit that a vaccinated employee who wishes to demonstrate their vaccination status to their employer, but who does not consent to the employer collecting their sensitive information, is left in an invidious position. They are unable to comply with the direction as articulated. This unfair and absurd situation is another reason why the direction is unreasonable. Similarly, the direction is unreasonable for such an employee because it involves "substantial danger"[43] to the employee, namely the risk of their sensitive information being misused after it is collected, for example identity fraud.

[75] In oral submissions the CFMMEU and the CEPU confirmed that for the purpose of the hearing and the Recommendation sought, the health and safety rationale that goes behind the SAR and the direction is not disputed but reserve their position in relation to whether those matters may be disputed in other proceedings. Notwithstanding this concession, it was contended that the Respondents had not established any cogent reason why the collection and storage of information would enable them to manage their COVID - 19 situation. The SAR is about site access and not the collection of information to service the requirement.

[76] The Respondents have also not established how alternative methods of implementing the SAR would cause unjustifiable hardship. The Respondents are well resourced organisations. There is no suggestion that gates to the sites are unmanned and the CFMMEU's proposal for checking vaccination status visually, only applies to those employees who do not consent to the collection of sensitive information in relation to their vaccination status. Further, the impost on the Respondents of the methods proposed as an alternative to the SAR, is not outweighed by the primacy of the employees' statutory right to privacy, including their right to withhold consent to the provision of their sensitive information.

[77] In relation to the Respondents' assertion that the information is necessary to prevent fraud, the CFMMEU and the CEPU submit that justification on this basis is premature, and the Respondents have ample means to deal with this issue if fraud is suspected and does not require to pre-emptively collect information before fraud arises. The Respondents' submission that the information will assist checking the vaccination register, proceeds on a false premise as it is the understanding of the CFMMEU and CEPU that an employer or third party cannot search the Australian Immunisation Register. If there is a sound, defensible or well-grounded suspicion that an employee's certificate is fraudulent, the employee can substantiate vaccination by taking steps including providing a certificate from the medical practitioner who administered the vaccination. In response to a question from me, Mr Tiley agreed that the issue the CFMMEU and the CEPU raise is that the information could be sighted by the Respondents but not recorded and that there should be no collection of any vaccination data, other than by consent.

[78] In response to the assertion that the concerns raised in the CFMMEU and CEPU submissions are hypothetical, it is stated that there are three categories of employees whose views are relevant to the privacy issue: those who are vaccinated and willing to consent to the collection of their data; employees who are vaccinated and have consented under protest to their data being collected and employees who are vaccinated and do not consent to their data being collected. The two latter categories are real people with a real problem and their circumstances are far from hypothetical.

[79] It was also contended that the argument is not that consent is vitiated by duress because of threat of termination, but rather that there is no consent in such circumstances. While there is no express threat of termination if consent is not provided, if employees want to access the workplace and work, and if they do not want to be treated as unvaccinated, they must waive their rights to privacy. On any view, employees in such circumstances cannot be described as making a choice. In this regard, reliance is placed on the decision of a Full Bench of the Commission in Lee v Superior Wood[44] and the Respondent's assertion that the passage cited by the CFMMEU and the CEPU is obiter should not be accepted.

[80] It was also submitted that if the Commission is against the CFMMEU and the CEPU on the requirements in s. 16A(1)(a) of the Privacy Act about obtaining consent of employees being unreasonable or impracticable, the Respondents have not made out the requirement in (b) that the entity reasonably believes that the collection, use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety. This requires more than a threat of fraud or that it would be convenient for employees to provide the requested information.

[81] The CFMMEU and the CEPU maintain that the Full Bench in Mt Arthur Coal did not decide the privacy issue, and half-hearted attempts by the Respondents to suggest otherwise, should not be accepted. Finally, in relation to the consequences of failure to comply with the Privacy Act, it is submitted that the availability of a cause of action for a breach is not required before there would be a breach in the requisite sense and whether a provision of an Act is enforceable by way of a civil penalty or not, makes no difference in relation to unlawfulness. The question is whether there is a legal obligation that is not being met. The CFMMEU and CEPU further submit that in Mt Arthur Coal the Full Bench found that a failure to comply with a statutory obligation to consult about the direction made it unreasonable. In the present case, the direction is both unlawful and unreasonable, but even if unlawfulness is unable to be made out in the way contended for by the Respondents, the direction is still unreasonable, and this is sufficient to render it invalid.

[82] In relation to the Respondents' obligations under the CMSH Act, the CFMMEU and the CEPU submit that while that CMSH Act may have much to say about the necessity or otherwise of certain measures to address the risk presented by disease, and one of them may be vaccination, this does not address how it is necessary to collect sensitive information to manage that risk.

[83] The AMWU submits that in Mt Arthur Coal the Full Bench was unable to reach a concluded view about whether the Respondent had breached its privacy obligations. After setting out the relevant provisions of the Privacy Act and APPs, the AMWU referred to information provided by the OAIC as set out by the Full Bench in Mt Arthur Coal[45] and additional advice from that source that:

Employers can only collect information about employee's vaccination status in particular circumstances where the employee consents and the collection is reasonably necessary for your workplaces' functions and activities.
You must have clear and justifiable reasons for collecting employee vaccination status information for it to be reasonably necessary. If you do not have clear and justifiable reasons, you should not collect vaccination status information.
You can collect vaccination status information without consent only in circumstances where the collection is required or authorised by law (including a state or territory public health order or direction).
Only the minimum amount of personal information reasonably necessary to maintain a safe workplace should be collected, used or disclosed.
Vaccination status information should only be used or disclosed on a 'need-to-know' basis.
You must inform employees about how their vaccination status information will be handled.

• Ensure you take reasonable steps to keep employee vaccination status and related health information secure.[46]

[84] The AMWU also submits that to be voluntary, an individual must have a genuine opportunity to provide or withhold consent and consent will not be voluntary where there is duress, coercion or pressure that could overpower the person's will.[47] The following factors are relevant to deciding whether consent is voluntary:

the alternatives open to the individual, if they choose not to consent
the seriousness of any consequences if an individual refuses to consent
any adverse consequences for family members or associates of the individual if the individual refuses to consent."

[85] The AMWU also referred to the decision in Lee v Superior Wood Pty Ltd[48] (Lee), where the Full Bench found that any "consent" given for the purposes of APP 3.3, where an individual is faced with the prospect of discipline or dismissal, would likely have been vitiated by the threat of discipline or dismissal and would not have been genuine,[49] and submitted that this approach should be applied in the present case.

[86] The AMWU contends that the practical effect of the SAR, is that employees must consent to the collection of sensitive information about their vaccination status or face the threat of dismissal or disciplinary action. The consequences of the refusal of consent and the attendant loss of employment for these workers are serious and may include loss of income, dignity and self-worth. The AMWU's position is that any "consent" for the purposes of the statutory scheme of the Privacy Act and APP 3.3, having regard to the APP Guidelines and Lee, cannot therefore be voluntary.

[87] In relation to whether the collection of sensitive information is "reasonably necessary" the AMWU refers to the APP Guidelines which relevantly provide:

"B.114 The 'reasonably necessary' test is an objective test: whether a reasonable person who is properly informed would agree that the collection, use or disclosure is necessary. It is the responsibility of an APP entity to be able to justify that the particular collection, use or disclosure is reasonably necessary.

B.115 The test must be applied in a practical sense. For example, under APP 3 if an entity cannot in practice effectively pursue a function or activity without collecting personal information, the collection would usually be considered reasonably necessary for that function or activity. However, a collection, use or disclosure of personal information will not usually be considered reasonably necessary if there are reasonable alternatives available, for example, if de-identified information would be sufficient for the function or activity.

B.116 An APP entity cannot rely solely on normal business practice in assessing whether a collection, use or disclosure is reasonably necessary. The primary issue is whether, in the circumstances of a particular entity, a collection, use or disclosure is reasonably necessary for a particular function or activity."[50]

[88] The AMWU submits that the Respondents have not justified how it is reasonably necessary for one or more of their functions or activities to collect the sensitive information that is employees' vaccination status. The AMWU further submits that no statute, public health order or direction requires the vaccination of these employees or the collection of their vaccination status.

[89] The AMWU's position is that there are reasonable alternatives to the collection of sensitive information available, in use in many other contexts currently, which would not involve the collection of sensitive information - for example, displaying a vaccine certificate at entry, but no collection or record being created, as is presently required in Queensland to access a bar or café. The AMWU submits that mere apprehensions about potential fraud[51], do not render the collection of sensitive information reasonably necessary.

[90] In relation to subclause 3.4 of the APP Principles, the AMWU submits that no exception has been invoked by the Respondents, nor does one apply. No "Australian law" (which excludes contracts) requires or authorises the collection of the sensitive information. The AMWU also submits that the circumstance is not otherwise one where is it unreasonable or impracticable to obtain consent (as evinced by the Respondents purporting to seek consent) from workers. In light of the obvious alternatives to the collection proposed, merely that it is convenient to the Respondents to collect sensitive information, is not an adequate basis for a reasonable belief that the collection is necessary.[52]

[91] In relation to the lawfulness of the SAR, the AMWU submits that if the Respondents have not acted in accordance with the Privacy Act, consistent with the decision in Lee, the direction is not a lawful one.[53] It is a direction which involves illegality. Further, the AMWU contends that this plainly weighs significantly against the reasonableness of the direction.

[92] In oral submissions, Mr Turner for the AMWU also confirmed that it did not seek to contest other matters in the present proceedings but reserved its rights to do so in other proceedings. In relation to the issue of consent, the AMWU submits that the Respondents' submissions conflate the issue of vitiation of consent for the purposes of establishing the tort of battery and violation of the person's bodily integrity, with the content of what is a statutory requirement that consent be obtained from a person before their sensitive information is collected for the purposes of APP 3.3 in Schedule 1 of the Privacy Act. The passages in Mt Arthur Coal referred to by the Respondents deal with these issues and not the issue of consent for the purposes of the Privacy Act.

[93] It is clear that a person who does not consent to have their sensitive information collected by the Respondents will face termination. The AMWU contends that in the workplace there is little greater pressure that could be exerted on a person and in that context, it cannot be concluded that a person is given a genuine opportunity to agree or disagree. Whether or not it is concluded that consent is vitiated, it is certainly not voluntary.

[94] The AMWU urges that the Commission follow the Full Bench decision in Lee and submits that nothing can be inferred about the correctness of that decision from the decision in Mt Arthur Coal. Further, the AMWU submits that the Respondents have rejected the reasonable suggestion that they simply sight a certificate on entry rather than collect sensitive information of workers and that this is now a practice which is a feature of public life in Queensland. In relation to the Respondents' claim that this would be onerous, the AMWU contends that it is difficult to see how this could be so given that it is used in other facets of public life. In relation to the Respondents' claim that the collection of sensitive information is necessary to prevent fraud, it is difficult to conceive of fraud that could not be identified by sighting a certificate on entry. If the document did not appear real, the person tendering it could easily be pulled aside and dealt with, by commencing an investigation.

[95] In response to the Respondent's assertion that it would not be practical to sight a certificate on each occasion an employee enters a mine site or other workplace, the AMWU contends that employees enter through a limited number of gates, and such alternative arrangements would only need to be implemented for those who did not provide consent to the collection of their sensitive information. The Respondents have not considered a third option for such employees and their options are provide the information or get the sack. The AMWU also submits that convenience for the Respondents does not make it reasonably necessary for employees to be required to provide sensitive information.

[96] In response to the assertion that expectations concerning health and safety in the workplace entail that there will be some intrusion into the privacy of employees, and the Respondents' reliance on Briggs v AWH Pty Ltd[54] and Grant v BHP Coal Pty Ltd[55], the AMWU submits that neither decision considered or touched upon APP 3.3 or dealt with the provisions of the Privacy Act more generally. Both decisions were also decided before the Full Bench decision in Lee and neither is authority for the proposition that APP 3.3 is somehow overridden by broader workplace health and safety duties that do not directly override the provisions of the Privacy Act more generally.

[97] The AMWU also submits that the collection of sensitive information is not reasonably necessary for the operation or management of a system to manage risk for the purposes of meeting the Respondents' obligations under the CMSH Act and there are other reasonable alternatives to the collection of that information that are sufficient to address the safety risk. Further, the AMWU submits that the Full Bench in Mt Arthur Coal was not ruling out that a breach of the Privacy Act might render a direction unlawful. Further, whether or not it is concluded in the present case that the direction is unlawful because it breaches the Privacy Act, it is certainly unreasonable on that basis.

[98] The Respondents submit that the Commission should conclude that the SAR does not contravene APP 3.3. The Respondents' primary position is that collection of the information in question - being information by which the Respondents verify employees' vaccination status - is permitted by APP 3.3(a), because:

The Respondents only receive the information from employees who expressly consent to its provision, and who take positive steps to provide the information to the Respondents through one of two specified processes; and

The information is reasonably necessary for the implementation of the SAR.

[99] The Respondents also submit that they do not collect the information in question without employees' express consent. However, if it is held (contrary to the Respondents' submissions) that employees' express consent is vitiated, then APP3.3(b) applies, and a 'permitted general situation'[56] would then exist, permitting the Respondents' collection of information relevant to the SAR under APP 3.4(b) and section 16A of the Privacy Act, because:

It is unreasonable or impracticable to obtain employees' consent (this assumes that the Commission considers "consent" to require something different to that which is presently being provided by employees) to the collection, use or disclosure; and

The Respondents reasonably believe that the collection is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.

[100] Further, the Respondents submit that the Commission should conclude that, even if the Applicants establish a breach of APP 3.3, any such breach does not render the SAR unlawful. As to the requirements of the Privacy Act, the Respondents contend that the only way that they can effectively apply and enforce the SAR is by requiring employees to disclose information by which their vaccination status can reliably be verified. Analogously, the requirement to provide proof of vaccination is also a feature of the various public health orders that State governments have imposed.[57]

[101] With respect to the two means by which employees can provide information demonstrating their vaccination status, in either case, the employee needs either their COVID-19 digital certificate issued by the Federal Government (Vaccination Certificate) or their immunisation history statement. An employee will only have a Vaccination Certificate if they have received two doses of an approved COVID-19 vaccine. If they have only received a single dose, they will instead have access to an immunisation history statement. In both cases employees are asked whether they give their express consent to the collection of the information via a consent notice. The document ID is not the employee's Individual Health Identifier number and does not enable that number to be identified. Where the employee elects to upload the information via the portal, the employee also attaches a copy of either their Vaccination Certificate or their immunisation history statement. All information is provided by employees voluntarily and without indicating agreement by ticking the box on the Vaccination Form, the employee will not be able to submit through the Vaccination Portal and therefore no record is created in the Vaccination Portal or Cority.

Construction, Forestry, Maritime, Mining and Energy Union & Ors v BHP Coal Pty Ltd T/A BHP Billiton Mitsubishi Alliance / BMA & Ors [2022] FWC 81

At a glance

Court

Decision date

Source

Judgment (457 paragraphs)

Construction, Forestry, Maritime, Mining and Energy Union & Ors v BHP Coal Pty Ltd T/A BHP Billiton Mitsubishi Alliance / BMA & Ors [2022] FWC 81 (21 January 2022)

Parties

Legislation Cited (3)

Cases Cited (7)