Workplace Surveillance Act 2005

The Act casts a wide net. “Employee” adopts the meaning given in the Industrial Relations Act 1996 and expressly includes Chapter 6 bailees and carriers, unpaid volunteers, and any person performing work under a labour-hire or similar contract (s 3). Because s 4 deems employees of related corporations to be employees of the principal employer, the Act reaches group structures. “Employer” is likewise extended to include the bailor or principal contractor under Chapter 6, the person for whom voluntary work is performed, and any entity that receives the benefit of labour-hire workers (s 3, note). The combined operation of ss 3, 4 and 5 therefore captures virtually every employment relationship, secondment, internship and volunteer placement performed in or from New South Wales workplaces.

Employers’ representatives—persons authorised in writing by the employer—may apply for and act under covert surveillance authorities (s 23(1), (2)(h)). Surveillance supervisors, who must be named in every authority and who bear personal statutory duties (ss 27, 29, 36), are typically senior compliance, security or legal personnel. Judges of the Local Court and, on review, judicial members of the Industrial Relations Commission, exercise the gate-keeping and supervisory functions under Part 4.

Law enforcement agencies are partially exempt. They may conduct surveillance in the exercise of functions conferred by other statutes (s 21(a)), are relieved from the out-of-hours prohibition (s 16(3)), and enjoy broader use-and-disclosure rights for both authorised and unauthorised covert material (s 37(2)–(4)). Correctional centres, courts and casinos receive targeted carve-outs for camera surveillance (s 21(b)–(d)).

Employees themselves are the primary beneficiaries of the protective rules. They possess rights to receive 14 days’ written notice (s 10), to view policies before computer surveillance begins (s 12), to be free from surveillance in intimate facilities (s 15), to receive prevented-delivery notices when emails are blocked (s 17(1)(b)), to obtain access to covert surveillance records if detrimental action is proposed (s 29(2)(d)), and to prosecute offences or seek review of authorities (ss 41, 46(1)(d)). Industrial organisations of employees may consent to surveillance on behalf of members (s 14), receive policy notifications, and institute prosecutions (s 46(1)(c)).

Finally, the Act affects related corporations (s 4), suppliers of surveillance equipment, and any person who comes into possession of surveillance records. The storage and destruction obligations in ss 29(2)(c) and 36 apply to supervisors and employers alike. The annual reporting obligation rests on the Minister (s 42).

Employer duties

• Provide 14 days’ written notice particularising all statutory matters before commencing surveillance (s 10(1)–(4)).
• Ensure cameras and signage are clearly visible (s 11).
• Maintain and notify a computer-surveillance policy (s 12).
• Affix visible tracking notices to vehicles or items (s 13).
• Refrain from surveillance in change rooms, toilets or showers (s 15).
• Refrain from out-of-hours surveillance except permitted computer monitoring (s 16).
• Comply with notified email and internet policies and give prevented-delivery notices (s 17).
• Restrict use and disclosure of notified-surveillance records to the four closed categories in s 18.
• Obtain a covert surveillance authority before any covert operation (s 19).
• Ensure applications contain all mandated particulars and are verified on oath (s 23).
• Comply with every condition placed on an authority, including limited disclosure, destruction of irrelevant records within three months, and employee-access rights (s 29).
• Furnish a post-operation report to the issuing Judge within 30 days (s 35(1)).
• Maintain reasonable security safeguards over records (s 36).
• Confine use and disclosure of covert records to relevant purposes listed in s 37.

Employee rights

• Receive advance written notice and policy documents (ss 10, 12).
• Refuse consent to shortened notice periods (s 10(2)).
• Be free from surveillance in intimate areas (s 15).
• Receive prevented-delivery notices for blocked emails (subject to exceptions in s 17(2)–(3)).
• Protection against detrimental action based on covert records unless the employee is given access to relevant portions (s 29(2)(d)).
• Apply to a Judge or judicial member to vary or cancel an authority (s 31(2), s 41).
• Institute prosecutions for breaches (s 46(1)(d)).
• Seek judicial orders for delivery up or access to records at the conclusion of an authority (s 35(5)–(6)).

Surveillance-supervisor duties

• Oversee all covert operations (s 20(2)(a), s 27).
• Restrict disclosure of records (s 29(2)(a)–(b)).
• Ensure destruction of non-evidentiary material within three months (s 29(2)(c)).
• Maintain security safeguards (s 36(1)).

Judicial duties

• Refuse an authority unless reasonable grounds are shown, privacy is weighed, and heightened expectations in non-work areas are considered (ss 25–26).
• Designate only suitably qualified supervisors (s 27).
• Record grounds for every decision (s 33).
• Make appropriate orders on records after receiving the s 35 report (s 35(5)).

The Act creates a tiered penalty structure. The most serious offences—conducting covert surveillance without authority (s 19), breaching a condition of an authority (s 30), surveillance in change rooms or bathrooms (s 15), and out-of-hours surveillance (s 16)—each carry a maximum of 50 penalty units. Lower-tier offences such as failure to give notice (s 10), improper use or disclosure of notified records (s 18), failure to report (s 35(1)), or inadequate record security (s 36) attract 20 penalty units. Corporations face the standard multiplier under the Crimes (Sentencing Procedure) Act 1999, and directors or managers who knowingly authorise contraventions are personally liable (s 43).

Proceedings are summary only before the Local Court (s 45(1)). Prosecution is restricted: only the Minister, a prescribed officer, an industrial organisation of affected employees, or the surveilled employee may institute proceedings (s 46(1)). A consent to prosecute signed by the Minister or prescribed officer is prima-facie evidence (s 46(2)). Appeals and case-stated procedures under the Industrial Relations Act 1996 s 197 apply (s 45(2)).

Civil consequences are indirect. Section 29(2)(d) creates an enforceable access right that, if denied, could ground adverse-action claims under industrial or anti-discrimination legislation. Improperly obtained evidence may be excluded in civil or disciplinary proceedings (see s 22(2) for security-surveillance material). The Act does not itself create a private right of action for damages, leaving aggrieved employees to pursue privacy torts, breach of statutory duty arguments or industrial remedies.

The Act is expressly stated not to limit or be limited by Work Health and Safety Act 2011 duties (s 8). It sits alongside the Surveillance Devices Act 2007: the note to s 3 records that listening-device surveillance is regulated exclusively by the 2007 Act, while camera surveillance that also records private conversations will engage both statutes. Commonwealth telecommunications-interception warrants override the Act entirely (s 39).

Heavy reliance is placed on the Industrial Relations Act 1996 for the meanings of “employee” and “employer”, for the definition of “industrial matters” that cannot ground email blocking (s 17(4)), and for appeal pathways (s 45(2)). The Corporations Act 2001 supplies the “related body corporate” test imported by ss 3 and 4. The Spam Act 2003 supplies one of the exceptions to the prevented-delivery-notice obligation (s 17(2)(a)).

Privacy principles under the Privacy and Personal Information Protection Act 1998 and the Commonwealth Privacy Act 1988 remain relevant for data-handling once records are lawfully created, although the Workplace Surveillance Act supplies more specific use-and-disclosure rules that would likely prevail as specific legislation. The Fair Work Act 2009 (Cth) interaction is left to general principles; the Act does not purport to authorise surveillance that would otherwise constitute adverse action for a prohibited reason under federal law.

In criminal proceedings, s 38 protects inadvertently obtained material from automatic exclusion, while s 22(2) requires a public-interest balancing test before security-surveillance footage unrelated to workplace security can be admitted in disciplinary or legal proceedings.

The text records a series of textual amendments that illustrate incremental refinement rather than root-and-branch reform. The definition section (s 3) has been updated by the Surveillance Devices Act 2007 (which replaced the older Listening Devices Act), by the Law Enforcement Conduct Commission Act 2016, and most recently by 2025 No 61 which substituted references to “Magistrate” with “Judge” to reflect changes in the constitution of the Local Court. Section 8 was amended in 2011 to insert the present relationship-with-WHS clause following the introduction of the model Work Health and Safety Act.

Section 16 was amended in 2005 (shortly after commencement) to insert the law-enforcement exemption. Section 29 received minor drafting adjustments in 2006 to clarify “detrimental action”. The most significant procedural changes appear in 2025 amendments to Part 4 (ss 23–35, 37, 40–41) which uniformly replace “Magistrate” with “Judge”, update the review pathway to reflect the current structure of the Industrial Relations Commission (s 41, substituted in 2016 and further amended in 2023), and add procedural safeguards around applications and reporting.

These changes have two rationales visible on the face of the statute: first, to maintain currency with companion legislation (Surveillance Devices Act, WHS Act, integrity-commission statutes); second, to strengthen judicial oversight and employee-access rights in response to accumulating experience with covert surveillance. The annual-report obligation (s 42) was expanded in 2014 to deal with parliamentary recesses, ensuring continuous transparency even when the Houses are not sitting. No amendment has narrowed the core protective obligations; rather, each has tended to tighten language around privacy weighing (s 25(3), s 26) and record-destruction timelines.

The source text itself does not record specific judicial decisions; however, the structure of the Act anticipates certain recurring disputes. Section 25(2)–(3) and s 26 require a Judge to evaluate the seriousness of alleged unlawful activity against privacy intrusion, particularly in meal or recreation rooms. Judicial members on review under s 41 are required to apply the identical Part 4 criteria, creating scope for differing assessments that have, in practice, generated applications testing the threshold of “reasonable grounds” and the weight to be given to heightened privacy expectations.

Section 22’s security-of-workplace defence has proved contentious because it requires the employer to prove that surveillance of employees was “extrinsic” to the security purpose and that a real and significant likelihood of jeopardy existed. The evidentiary bar in s 22(2) (balancing desirability of admission against the manner of obtaining) has been invoked in unfair-dismissal and disciplinary proceedings where footage captured misconduct unrelated to the original security justification.

The interaction between s 29(2)(d) (employee access to records before detrimental action) and industrial protections against unfair dismissal has produced disputes about timing: what constitutes a “reasonable period” after an employee’s request, and whether an employer may rely on other evidence if access is granted but the employee disputes the characterisation of the record. Section 17(4)’s prohibition on blocking union communications has been tested in proceedings alleging that an employer’s internet policy was applied selectively to suppress protected industrial activity.

Because prosecution is restricted (s 46), many controversies surface instead as industrial disputes or privacy complaints before the Industrial Relations Commission or the Privacy Commissioner rather than as criminal prosecutions. The requirement in s 35(6)–(7) that a Judge must ordinarily order notification to the surveilled employee unless “good reason” exists (with explicit consideration of justification and privacy interference) has generated contested hearings at the conclusion of authorities, particularly where ongoing investigations or informant safety are asserted.

Most practitioners assume that installing a visible CCTV system satisfies all obligations; they overlook s 10(4)’s requirement that the notice must state whether surveillance will be continuous or intermittent and whether it is for a limited period or ongoing. A generic “we use CCTV” sign therefore fails to comply.

The labour-hire extension in s 3 (note) and s 4 means that a host employer who directs a labour-hire worker to use a tracked vehicle can become the “employer” for the purposes of the Act even though the worker remains employed by the agency. Dual-employer obligations are easily missed.

Section 29(2)(c) requires destruction of irrelevant covert-surveillance records within three months of expiry of the authority. Many organisations retain “everything for six years in case of litigation” and thereby commit a continuing offence. The three-month clock starts from expiry, not from the making of the record.

The s 14 agreement exemption is narrower than it appears: the agreement must be to surveillance “for a purpose other than surveillance of employees”. An agreement that simply says “we may monitor for security” will not qualify.

Judges increasingly scrutinise applications that rely on “anonymous tip-offs” without corroboration; s 23(2)(b) requires disclosure of what other managerial or investigative procedures have been tried and their outcome. Failure to document genuine prior steps can render the authority vulnerable on review under s 41.

The prevented-delivery-notice obligation in s 17(1)(b) contains subtle carve-outs in s 17(2) and (3). Many IT departments apply blanket spam filters and assume no notice is required; however, if the filter catches a legitimate union email that is not “menacing, harassing or offensive”, a prevented-delivery notice must still be given.

Finally, the annual-report obligation in s 42 is on the Minister, yet the data must come from the Judges’ records (s 33(2)). Compliance professionals who assume their internal records are sufficient are surprised when a parliamentary committee or union requests the detailed breakdown of authority types that the Minister is required to publish.

A compliant surveillance program begins with an up-to-date register of all devices and software capable of capturing employee data. For each device a written notice meeting s 10(4) must be prepared and individually provided (email is sufficient) at least 14 days before activation, or before the employee’s start date if later. Camera installations must be audited to confirm visibility of equipment and entrance signage. Computer-surveillance policies must be separate, readable documents; mere inclusion in an IT acceptable-use policy is insufficient if the employee cannot reasonably be taken to have understood the surveillance aspects.

Organisations should maintain a surveillance policy matrix that distinguishes overt from covert pathways. Overt surveillance should be limited to purposes listed in s 18 and all records should be tagged with the enabling notice. Covert surveillance should be treated as exceptional. A standard operating procedure should require:

1. Completion of a s 23 checklist confirming all particulars, prior investigative steps, and privacy-impact considerations.
2. Internal legal or compliance sign-off before the affidavit is sworn.
3. Nomination of a qualified surveillance supervisor who receives training on the exact conditions in s 29.
4. Real-time logging of all footage or data captured so that irrelevant material can be isolated and destroyed within the three-month window.
5. Immediate segregation of any material that might found detrimental action so that the s 29(2)(d) access obligation can be met promptly.

Records must be stored in encrypted, access-controlled repositories with audit trails. Destruction certificates should be retained. Where an authority expires, the s 35 report must be prepared within 30 days even if the investigation yielded nothing; the report must address each of the nine subparagraphs.

Contracts with labour-hire providers should allocate surveillance-compliance responsibilities and require the provider to flow through notices to its employees. Group companies should identify the “principal employer” for each workplace so that related-corporation obligations are not duplicated or overlooked.

Annual refresher training for managers, IT staff and security personnel should emphasise the absolute prohibition on intimate-area surveillance and the narrowness of the s 22 security defence. Internal audit should sample a percentage of surveillance notices and authorities each year to confirm that the 14-day period was observed, that signage was current, and that destruction deadlines were met.

When in doubt, obtain counsel’s advice before any covert application; the verification-on-oath requirement (s 23(5)) and the possibility of judicial-member review under s 41 mean that inaccurate or incomplete applications carry both criminal and reputational risk. A disciplined, documented approach that treats the Act as a procedural code rather than a set of high-level principles is the only reliable path to compliance.