Canterbury Law Review
The issue of workplace privacy is receiving much attention in academic literature throughout the world. Some have pushed reality to its limit, describing frightening scenarios in which employers will one day have the ability to monitor and control employee conduct both within and outside of the workplace. What is clear from a review of the current law affecting the privacy rights of workers in New Zealand is that, while far from unregulated, there are many occasions where the interests of employers will trump an employee's privacy rights. Concern for privacy rights suggests a need for reform of the existing law.
This paper will canvas the relevant issues surrounding workplace privacy in New Zealand. First, introductory points will be made. There will then be a discussion of how privacy is currently threatened in the workplace, followed by an analysis of whether there is in fact a right to privacy in the workplace, and, if there is such a right, when specific privacy invasive activities can be justified. Second, the laws that regulate or affect the right to privacy in the workplace will be summarised. Third, these laws will be applied to the identified workplace privacy issues and their effectiveness at protecting worker privacy will be analysed. Finally, suggestions will be made as to potential reform. This discussion will be aided by references to reform in other jurisdictions, focusing particularly on the recent proposal by the Victorian Law Reform Commission.
Before any attempt is made to analyse the ambit of privacy in the workplace, a definition of privacy itself should be given. Most authors will refer to the seminal article of Warren and Brandeis when formulating such a definition. Their definition is perhaps the most concise - privacy is said to be the 'right to be let alone'. More recently, the New Zealand Court of Appeal has dealt with this difficult area of law in the case of Hosking v Runting. Tipping J noted that the concept of privacy is potentially very broad and defined it for the purposes of the case before him as 'the right to have people leave you alone if you do not want some aspect of your private life to become public property'. He also stated that it 'is of the essence of the dignity and personal autonomy and well being of all human beings that some aspects of their lives should be able to remain private if they so wish' . Thus, privacy is accorded recognition as an important concept in New Zealand law. It is, in fact, generally recognised as a fundamental human right in academic literature. However, the right to privacy is far from being absolute. There will be occasions where the right must yield to competing interests. Such limitations are readily apparent when one considers the privacy of employees in the workplace.
This paper will focus on three specific categories of privacy invasive activities in the employment and pre-employment relationship: surveillance; monitoring; and, physical and psychological testing.
Within the workplace, surveillance of employees may be undertaken using video cameras or audio recording devices. Video surveillance can be carried out in high security areas such as those surrounding cash registers and safes. It may also be used for training purposes or to improve production processes. Surveillance can be criticised due to its inhibiting effect on employees: when one knows that every action is recorded, it causes one to 'hesitate before pausing in the course of one's work, taking a breather, yawning, or otherwise being oneself without affecting one's work'. This can lead to an increase in worker stress. It becomes particularly offensive to workers' dignity when cameras are placed in areas where employees might reasonably expect to enjoy privacy, such as in bathrooms or changing rooms. Recently nine workers at Horotiu Affco meat plant resigned after being caught on camera taking drugs while at work. Worryingly, footage of the drug taking was taken in changing rooms and while the workers were taking showers.
Audio recording devices are used to monitor employee phone conversations. Employers may listen to such conversations to ensure employees are dealing with customers appropriately and to help improve customer service. But such power can potentially be abused if employers listen to private conversations and, as a result, obtain personal information about employees. Both these forms of surveillance are particularly concerning when carried out without the knowledge of employees. Surveillance of employees may also take place outside of work through, for example, the use of private investigators. It may be undertaken to ascertain whether an employee is abusing sick leave or is engaging in 'undesirable' conduct. Such surveillance has obvious privacy issues as it occurs outside the workplace in the employee's own time. It may also involve observation of an employee in his or her own home.
The monitoring of an employee's work can take place in a number of ways. For example, 'computers can record when workers turn their [monitors] on and off, count the number of keystrokes per second, and track the number of operator errors per day' . A main focus for this paper is the monitoring of electronic mail (email) and internet use, that is, the ability of employers to read work related and personal emails and to track websites an employee visits and the information he or she downloads from such websites. By way of example, monitoring may be undertaken to prevent work email or internet facilities being used to pass on or download material of an offensive nature. Obviously the threat to privacy from such monitoring is that the employer will discover personal information about an employee from reading the employee's personal emails to friends and family or from information gathered about the type of websites the employee visits.
Psychological or personality testing will generally take place in the pre-employment stage, but may also be used during employment for making decisions on promotions and other job related decisions. At the pre-employment stage, the purpose of such tests is to help employers decide which applicant to select for the job offered. The tests are used to look for psychological traits necessary and desirable in employees. The concern for those subjected to testing is when such tests delve too deeply into a person's psyche and appear unrelated to the job description. For example, some psychological tests ask questions about a person's sexual, religious, political and social attitudes.  There is also concern as to whom the results of these tests are made available. If given to non-professionals within the employing company, there is the possibility that such individuals may misinterpret the results and act negatively towards a person on a misguided basis.
Physical testing may be divided into two sub-categories: health or fitness testing and drug or alcohol testing. Health or fitness testing usually takes place before an employment offer is made. The employer may carry out such tests simply by questioning the prospective employee, or through a medical exam. The tests may be used to determine whether the applicant has the necessary characteristics to carry out the employment tasks of the job, such as an eyesight test for a pilot. The concern for privacy is when tests are used to determine an applicant's general level of health or fitness. General medical tests may be carried out by an employer in an attempt to predict the applicant's potential use of sick leave, or absenteeism. Health checks may be required by the employer's insurer when medical insurance coverage is part of the employment package. The employer may also be concerned to minimise accident compensation levies under the Injury, Prevention, Rehabilitation and Compensation Act 2001. The employer may thus test to avoid hiring workers with 'pre-existing health conditions or susceptibilities that make them more likely to be subject to further injury or illnesses.' Such testing will obviously be a concern for applicants with conditions that they may not wish their potential employers to know about and may reasonably believe that an employer has no right to know about. Health or fitness testing also raises privacy issues when it is concerned with an applicant's use of legal substances outside of work. For example, some employers ask applicants whether they smoke cigarettes, or how much they weigh, and then discriminate accordingly. In the United States, some employers maintain 'smoke free' offices and require their employees to take tests to prove they are non-smokers. There are also signs in the US that employers may extend such policies to demand that overweight employees lose weight and undertake fitness tests to establish their commitment to a weight loss programme. Such testing affects privacy by impacting on choices an employee makes outside of work.
Drug and alcohol testing also raises a myriad of privacy issues. Such testing may take place as part of a job application process, before a promotion is offered, upon an appointment to a safety sensitive area, after an actual or near accident, where there is reasonable cause to suspect an employee is under the influence, or, randomly at any time during the employment relationship. Testing employees evidently aims to prevent impairment at work. However, it impacts on an employee's choices outside of work as tests can detect past consumption. Further, testing also impacts on the privacy of those workers who do not use drugs or alcohol. The procedure of drug testing as performed in an employment context usually takes the form of obtaining a urine sample from the subject which is then scientifically analysed. Providing such a sample is embarrassing at the best of times. At the worst, it can be highly intrusive and humiliating. Because samples can be tampered with to avoid undesirable results, the subject may have to be observed while urinating. In order to safeguard against the subject hiding 'clean' urine or adulterating substances on his or her person, this may 'require the direct observation of the subject's genitals, or for the subject to be completely naked'. Such a procedure will be odious to many. Another privacy issue is the potential for the analysis of the sample to disclose information about the subject that he or she may not wish the employer to know about. For example, a urine sample may show that the subject is pregnant or is taking medication for depression, diabetes, epilepsy, HIV, schizophrenia, or heart disease.
It is thus clear that recent advances in technology have made it possible for employers to obtain much information about their employees. While privacy is generally recognised as an important right for individuals, the above discussion suggests the opposite in the employment context. Thus, it must be considered whether employees have a right to insist on privacy in the workplace.
The 'common law tradition' has given priority to employer rights and almost no recognition to those of employees. Respect for the doctrine of freedom of contract between employer and employee leads to the conclusion that if an employee agrees to privacy intrusive acts, an employer has the right to undertake them. The rationale for this argument is that an employment contract is entirely voluntary. If a potential employee objects to the conditions of work offered by the employer, the employee can reject the offer and find work elsewhere. An employee can thus be said to have voluntarily waived his or her privacy rights upon entering the employment relationship, and cannot, therefore, try to insist on them later. Some go even further, arguing simply that privacy is not appropriate in the workplace. It has been said that there should be no enforceable right to privacy in the workplace because the workplace is a 'private sphere'. Privacy rights are linked historically with the development of legal protection of private property against state intrusions, that is, the right to keep the public sphere out of the private sphere. State intrusion into privacy is seen as particularly damaging in inhibiting development of ideas and political activity and the state has the power to facilitate widespread use of such practices. As the parties to an employment contract are private individuals, it is said that the historic justification for privacy rights that exists in the broader political context does not exist in the employment context. It can also be argued that privacy is inappropriate in the workplace because the property rights of employers trump the privacy rights of their employees. Employers normally own the property on which the work takes place or the equipment that is used in the work process; they therefore have the right to monitor what happens on their premises and how their equipment is used. With ownership comes control. The employer controls the workplace. Therefore, by entering the workplace, the worker gives up all expectations of privacy and should expect to be observed by his or her supervisors. These arguments can, however, be easily rebutted. First, the relationship of employer and employee cannot be described as completely voluntary. Employees are rarely in a position of equal bargaining power with their employers. Large groups of employees may be capable of influencing management policies through collective agreements, but the vast majority of workers are not members of unions. It may simply not be possible for a potential employee to find work elsewhere. The reality is that 'employers are more likely to have additional job applicants than prospective employees are to have additional job opportunities'. This gives employers much power to dictate the terms of employment, and how intrusive they may wish to be. Employees may reluctantly sacrifice their rights to privacy in order to obtain a much needed job. Unfortunately, reluctant consent is still a valid consent for the purposes of the law. One must be wary, therefore, of attributing too much weight to the consent of workers to the waiver of their privacy rights.
Even if consent to the waiver of privacy rights is voluntarily given, it is probably not desirable, or even possible, for the need for privacy to be given up entirely during working hours. This is particularly true in today's society where hours of work are increasingly becoming longer and longer and individuals are spending more of their lives at work. Further, if privacy is viewed as a fundamental human right, it should not be possible for an employee to contract out of his or her entitlement to that right. Arguments based on the 'private sphere' of the workplace, or the employer's property rights in the workplace, can also be rebutted. They provide no real reason why privacy rights cannot be protected, merely why they have not been protected in the past. The employer's right to dictate conditions of work was exactly what was raised in argument against the passing of legislation preventing exploitation of workers, such as the provision of a minimum wage.
Oliver argues that the private sphere/public sphere argument breaks down when one considers that intrusions into private life by private individuals or organisations can be just as inhibiting as those by the state. She believes that the autonomy, dignity and emotional wellbeing of individuals are equally affected by state or private action.
There are thus good arguments in favour of the conclusion that privacy is an important human right that is appropriate in the workplace. The protection of privacy should not be left to the marketplace, as employees are in a much weaker bargaining position. Therefore, employees should be able to insist on some legal protection of their right to privacy in the workplace. This protection will of course be subject to limitations. The right to privacy is not, and cannot be, absolute. As an 'employer is entitled to ensure that the contract [of employment] is being duly performed and that employees are not acting contrary to the employer's legitimate economic interests', employers must have the right to monitor or survey work to ensure that it is being carried out to the appropriate standard.
They also must have the right to choose the best person for the job. The question is thus not whether employees have a right to privacy in the workplace, but how to balance that right against the legitimate interests of the employer.
If one accepts that employees should have some degree of protection against privacy intrusive activities in the workplace, it becomes necessary to consider the activities to which this protection should extend. This question is generally answered in academic literature by attempting to weigh employer interests against those of their employees. The concerns of employees in relation to privacy invasive activities have been discussed above. Employers will, of course, argue that their interests outweigh employee concerns. There are three main reasons why employers use surveillance, monitoring and testing programmes in the workplace: to increase productivity; to protect their property; and, to avoid liability. First, productivity can be increased when employees know that their work is being monitored because they will be less likely to waste time in activities such as surfing the internet or emailing their friends. The information obtained during surveillance of work can also be used to improve production methods or customer service. Physical and psychological testing can improve productivity by ensuring that people are placed in appropriate areas or that workers are not impaired while they are at work. Secondly, surveillance can be used as a deterrent to prevent theft of the employer's property. Finally, monitoring and/or testing programmes may be carried out to protect employers from vicarious liability for the actions or omissions of their employees. For example, drug and alcohol testing may be used to try and prevent accidents at work, and email monitoring may be carried out to try and prevent sexual harassment in the workplace. When surveillance, monitoring or testing is carried out for such legitimate reasons, it is clearly arguable that the interests of the employer outweigh those of their employees. However, such activities become more difficult to justify in certain circumstances. When an activity occurs outside of the workplace, or impacts on an employee's off-duty conduct, it is much harder to argue that an employer has a legitimate interest in the information gathered. Employees will generally have a higher expectation of privacy in such circumstances. For this reason, there should in this case be a 'higher standard of protection than the privacy protection to which workers are entitled when they are at work'.
Secondly, activities that are particularly privacy invasive must be more difficult to justify. De Beer argues that there is a hierarchy of privacy rights. Some invasions of privacy will be more serious than others. 'Privacy surrounding bodily intrusion is most significant and must be afforded the highest degree of protection'. For example, as drug and alcohol testing involves a 'bodily intrusion', an employer would, by this argument, be required to show good reason for the imposition of such a practice. And if justifiable, the process would need to be highly regulated in order to minimise its intrusiveness and the possibility of misuse of the information gathered.
It has been submitted that privacy is appropriate in the workplace and, as such, where privacy is threatened it may be desirable to protect this right. The legitimate interests of an employer will in many cases trump an employer's right to privacy, but in some cases, where an activity is particularly privacy invasive or where it affects off-duty conduct, it must be more difficult for employers to justify privacy invasions. The next area of discussion is whether the law as it currently stands provides such protection.
This section will summarise the legal framework currently applying to an employee's right to privacy in the workplace.
The Employment Relations Act 2000 (the Act) aimed to introduce a 'better framework for the conduct of employment relations' - a framework 'based on the understanding that employment is a human relationship involving issues of mutual trust, confidence and fair dealing, and is not simply a contractual, economic exchange'. The Act thus specifically 'acknowledges and addresses the inherent inequality of bargaining power in employment relationships'; an issue mentioned above as a problem in ensuring effective worker privacy. One way in which the Act attempts to address this inequality of bargaining power is with the personal grievance action, which provides protection for an employee from a range of actions that may affect his or her security in employment. It should be noted at the outset that such an action is not available to job applicants. An employer must be aware that dismissal of an employee based on the information gathered using surveillance or monitoring or testing could result in a personal grievance action. In such an event, the employer must show that his or her actions in dismissing the employee were justified. The employer must establish two elements: that the employer's substantive reasons for the action were sufficient to justify that action; and, that the procedure the employer followed in making the decision was fair. Whether or not a dismissal is justified must be determined on an objective basis and by considering how a fair and reasonable employer would have acted in the circumstances. An employer who dismisses an employee on the basis of information gathered through monitoring or surveillance or testing will probably seek to justify the dismissal on the basis of the employee's misconduct. For misconduct to justify dismissal, it must be shown that the conduct in question is capable of amounting to serious misconduct and that dismissal was warranted in the circumstances of the case. While it is not possible to state with certainty what conduct will qualify, it is possible to give some general examples of conduct that is normally regarded as sufficiently serious. Some examples that may have relevance to issues of workplace privacy are: a serious breach of work rules or of the employment agreement; harassing co-employees; dishonesty or unauthorised possession of the employer's property; and, conduct outside of work that impacts on the employee's work.
An employee may also bring a personal grievance action on the basis of discrimination at work. There is no requirement here that the action complained of be unjustified as discrimination is assumed not to be justifiable. Discrimination under the Employment Relations Act covers all the prohibited grounds of discrimination under the Human Rights Act 1993. An employee must choose which Act he or she will use to pursue a claim of discrimination. Discrimination occurs if the employer engages in any discriminatory behaviour during employment. This includes: discrimination in the terms of employment; conditions of work; fringe benefits; opportunities for training, promotion and transfer; dismissal; and, subjecting an employee to any other detriment. Potential remedies for a successful personal grievance action include reimbursement for lost remuneration, compensation, or reinstatement. It should also be noted that the Employment Relations Act provides that a grievance claim may be brought against the employer upon its failure to provide a workplace that is free from harassment.
As noted above, an employee alleging discriminatory treatment by his or her employer has the option of pursuing a claim under the Employment Relations Act or the Human Rights Act. The Employment Relations Act incorporates the prohibited grounds of discrimination listed in the Human Rights Act. Those grounds are: sex; marital status; religious belief; ethical belief; colour; race; ethnic or national origins; disability; age; political opinion; employment status; family status; and, sexual orientation. Again, it is unlawful to discriminate against an individual on the basis of any of these prohibited grounds of discrimination. Unlike the Employment Relations Act, the Human Rights Act also covers discrimination by refusal to employ. Thus, information gathered and used to discriminate against either an employee or a job applicant in a prohibited manner by one of the identified privacy invasive activities could lead to a claim against an employer under the Human Rights Act.
There are a number of exceptions to these provisions. Of particular relevance to the employment context is the power of the Human Rights Review Tribunal to declare an act that would otherwise be unlawful, not to be so if it constitutes a genuine occupational qualification. Also of relevance to later discussion is s 29 of the Act. Section 29 allows for different treatment on the grounds of disability if it is not reasonable for the employer to accommodate the disability, or, if there would be an unreasonable risk to the employee or to others if an individual with a particular disability was to carry out the duties of the job. However, this exception is qualified by s 35 which provides that if by some adjustment the employer could enable other employees to carry out those activities, different treatment will be unjustified. The adjustment must, however, not create an unreasonable disruption to the employer. If an employee or job applicant makes a complaint, the procedure set out in Part III of the Act will be followed. The complainant, a person aggrieved, or the Human Rights Commission, may bring civil proceedings before the Human Rights Tribunal. The Tribunal has the power to: grant a declaration that there has been a breach of the Act; make an order restraining a defendant from committing the breach; award damages and other forms of compensation; and, declare contracts illegal. Part IV of the Act sets out the grounds for appeal to the High Court and Court of Appeal.
The Privacy Act regulates the collection, use, and disclosure of information relating to individuals, and the access of those individuals to such information. This is achieved by creating a number of rules, known as 'Information Privacy Principles', as to how information should be handled. Of greatest relevance to the current discussion are those Information Privacy Principles dealing with the collection of personal information: Principles 1-4. The Act also appoints a Privacy Commissioner whose functions include monitoring legislation, making statements on a range of privacy issues, issuing codes of practice and investigating complaints. Information Privacy Principles 1-4 limit or restrict the collection of personal information by 'agencies'. The definition of agency is wide enough to include an employer. Principle 1 requires information to be collected for a lawful purpose that is connected with a function or activity of the agency and that such collection is necessary for that purpose. Principle 2 requires an agency to collect personal information directly from the individual concerned. Principle 3 requires that an individual is aware of a number of things, including that such information is being collected and the purpose for which it is being collected. There are a number of exceptions to this Principle, an example being where compliance would prejudice the purposes of the collection. Finally, Principle 4 prohibits an agency from collecting information by unlawful means or by means that are unfair or intrude to an unreasonable extent upon the personal affairs of the individual concerned.
Employers should be aware that an employee or job applicant may make a complaint under this Act to the Privacy Commissioner that an action by the employer is an 'interference' with his or her privacy, that is, a breach of an Information Privacy Principle or Principles. The action must also have had some form of adverse effect on the complainant as defined in the Act. The Commissioner will investigate the complaint and try to settle the complaint by conciliation and mediation between the parties. If no settlement can be achieved, the Commissioner may, in some cases, refer the complaint to the Director of Human Rights Proceedings. The Director of Human Rights Proceedings then decides whether to take the matter to the Human Rights Review Tribunal. If the Tribunal is satisfied that the action constitutes an interference in the privacy of an individual, it may make orders prohibiting repetition of the action complained of, or, requiring the interference to be remedied. It may also require damages or compensation to be paid, or, give such other relief as it thinks fit. Information Privacy Principles 1-4 do not create any legal rights that are enforceable in a court of law. This will generally mean that a complaint to the Privacy Commissioner is the only option. However, the courts have 'indicated a willingness to consider a breach of the Privacy Act as indicative of procedural unfairness in a personal grievance claim' . The Information Privacy Principles may thus be seen as examples of appropriate behaviour for employers. It has also been argued that the issue of whether an employer's actions were fair and reasonable under s 103A of the Employment Relations Act will be guided by the standards set in the Privacy Act.
In contrast to the statutes discussed above, the Health and Safety in Employment Act appears to create a statutory limit on the right of employees to claim privacy in the workplace. The Act imposes a general duty on employers to provide a safe and healthy work environment, and also requires employers to identify and actively manage hazards in the workplace. It also imposes duties on employees, an example being a duty not to endanger themselves or others. In certain circumstances, these duties may justify privacy invasive activities to ensure safety in the workplace.
Sections 7-10 set out in detail the steps an employer must take to manage significant hazards in the workplace. An employer must take all practicable steps to eliminate, isolate, or minimise significant hazards. A hazard is any actual or potential cause of harm. It may be a situation and includes a situation where a person's behaviour may be an actual or potential cause of harm to that person or any other person. Such a situation may result from any number of temporary conditions affecting a person's behaviour, including drugs and alcohol. A significant hazard is one that may cause serious harm. The Act does not specify a particular method of hazard identification, only that the chosen method is effective. It should also be noted that it is mandatory for an employee to follow the employer's instructions and cooperate in the monitoring of workplace hazards. Thus, under this Act an employer is at liberty to decide what monitoring technique to adopt to manage behavioural hazards and an employee is under an obligation to cooperate in that monitoring.
Section 216B of the Crimes Act 1961 creates an offence where a person intentionally intercepts any private communication by means of an interception device. This section could have application to surveillance activities involving audio recording devices or video surveillance if voices are recorded. It could also have application to monitoring activities, such as email screening, as the definition of private communication includes communications in written form. However, a private communication does not include a communication occurring in circumstances in which any party ought reasonably to expect that some other person may intercept the communication. An employee must, therefore, have a reasonable expectation of privacy in the circumstances for this section to apply. Thus, employers may be able to avoid liability under this section by formulating work policies in such a way as to directly control employees' reasonable expectations of privacy.
A further limitation is that s 216B will not apply where the person intercepting the communication is a 'party' to that private communication. A person may be said to be a party to a communication if that person has the express or implied consent of the originator of the communication or of any person intended by the originator to receive it. Therefore, it appears that employers could again avoid liability under this section if they obtain express consent from their employees to monitor. If employees are informed that monitoring will occur, and they continue to make 'private communications', their consent may be implied. This section is thus unlikely to have any real effect on the privacy rights of workers.
The New Zealand Court of Appeal in Hosking v Runting has by a majority declared privacy a 'stand-alone tort' that has a valid place in New Zealand law. However, the scope of the tort is not settled and neither are the elements that a plaintiff must establish to succeed. Gault and Blanchard JJ's joint judgment makes use of United States jurisprudence. In the United States there are four types of invasion of privacy: unreasonable intrusion upon the seclusion of another; appropriation of the other's name or likeness; unreasonable publicity given to the other's private life; and, publicity that unreasonably places the other in a false light before the public. Gault and Blanchard JJ expressly affirmed that the third type, unreasonable publicity, exists in New Zealand law. A two part test establishes such a claim: 'the existence of facts in respect of which there is a reasonable expectation of privacy; and, publicity given to those private facts that would be considered highly offensive to an objective reasonable person'. Of most relevance to the employment context is, however, the first formulation of the privacy tort in the United States - unreasonable intrusion into a person's seclusion or solitude. Whether such a cause of action exists in New Zealand was specifically left open by Gault and Blanchard JJ. Geddis argues that it is likely that the action as it currently stands will 'morph' into a more general cause of action as if one formulation of the tort can be justified, it is difficult to see why another cannot.
In the United States, intrusion upon seclusion is held to occur when one intentionally intrudes, physically or otherwise, on the solitude, seclusion, private affairs, or concerns of another. The intrusion must be highly offensive to a reasonable person. An actionable intrusion could potentially occur if an employer carries out monitoring, surveillance or testing activities. However, United States case law has shown that the action is in fact of limited utility in the employment context. There appears to be a general view that workers have a reduced expectation of privacy in the workplace. Also, consent operates as an absolute defence to the action. Thus, job applicants who accept employment knowing that such activities will take place, and employees who submit to such conditions, are unlikely to succeed in bringing this claim. Further, what is reasonable in the circumstances of the case will in fact be defined by the employer. Employment contracts, employee handbooks, or company mission statements, which outline the use of privacy invasive actions will make it difficult for any employee to argue that he or she had a reasonable expectation of privacy in the circumstances of the case. It therefore appears that even if unreasonable intrusion upon seclusion is recognised as a type of invasion of privacy in New Zealand, it will add little to the law of workplace privacy. It is highly likely that the concept of reduced expectation of privacy in the workplace will be transferred to New Zealand. In Hosking this concept was employed in relation to public figures in the 'unreasonable publicity' context.
With the legal framework thus established, it becomes possible to apply the law to the identified workplace privacy issues, and to discuss whether privacy in these cases is adequately protected.
Drug and alcohol testing in the workplace has recently been challenged in New Zealand by six unions in NZ Amalgamated Engineering Printing and Manufactured Union Inc v Air New Zealand Ltd ('the Air New Zealand case'). In this case an injunction was sought restraining Air New Zealand from introducing a drug and alcohol policy that involved: testing upon appointment to a safety sensitive area; testing after accidents; testing where there was reasonable cause to suspect impairment; and, random drug and alcohol testing of all employees. The policy of pre-employment testing was not challenged by the unions. The Employment Court noted that while testing was intrusive and had a degree of humiliation, it was clear that the use of legal and illegal drugs by workers could have direct implications for workplace safety. It was also clear that drug and alcohol testing regimes have a noticeable deterrent effect. Thus, it was reasonable for an employer to undertake such testing. In fact, it was not only reasonable, but lawful and necessary to do so. The Health and Safety in Employment Act had extended the definition of 'hazard' to include a situation where drugs and alcohol may affect a person's behaviour so that the person becomes an actual or potential cause of harm. Under this Act, employers must identify such hazards and take all practicable steps to eliminate, isolate, or minimise them. In addition, the Act imposed a duty on employees to ensure that no action or inaction on their part causes harm to any other person. This strongly suggested that employees must not allow their use of drugs or alcohol to affect their work, but also must cooperate with the attempts of the employer to monitor the situation. The Court came to its decision by balancing the interests of the employer and its employees. Because of the obligations imposed on employers by the Health and Safety in Employment Act, it was reasonable for Air New
Zealand to carry out drug and alcohol testing to discharge these duties. Thus, testing could take place where there is reasonable cause to suspect an employee was impaired, where employees seek a transfer to a safety sensitive position, and, when there has been an accident. It was also said to be permissible to conduct random tests on employees who work in safety sensitive areas. In all these cases, concern for safety would override employee concern for privacy. The Court found favour with the United States approach that 'persons employed in safety sensitive areas must have a lesser expectation of privacy and personal autonomy than employees charged with less heavy responsibility' . However, safety concerns could not override other concerns where the random testing of employees engaged in non-safety sensitive roles was involved. It would be unreasonable to require the random testing of such employees.
No attempt was made to define the term 'safety sensitive area'. The Court specifically declined to make a case by case analysis, but gave pilots, aircraft engineers and flight planners as examples of those whose positions and tasks make them employees in safety sensitive positions. It is difficult to dispute the value of testing such people. However, jurisprudence from the United States suggests that it is easy to stretch this concept to cover employees in less obvious positions. For example, in its first case considering drug testing, a majority of the United States Supreme Court found that testing of railroad workers after accidents was justifiable. In the same year, however, the Supreme Court also upheld the testing of customs officials, easily stretching the safety rationale of drug testing to employees who enforce drug laws or who carry firearms, stating they too can be said to have a lower expectation of privacy. The concept of 'safety sensitive area' could thus be seen as a loophole for employers wishing to justify drug and alcohol testing. For example, the Restaurant Association has justified the implementation of drug testing programmes with the tenuous claim that drug abuse is a cause of workplace violence and testing can combat such abuse and so improve worker safety. A more restrictive definition is clearly needed to prevent the subversion of this decision. It is also uncertain what procedures employers should follow when carrying out such testing. The Occupational Health and Safety Division of the Department of Labour has released a paper containing advice for employers as to when drug and alcohol testing may be appropriate. However, it does not deal with issues such as methods of analysis, techniques, those who are qualified to process the tests, or, those who are entitled see test results. Drug testing at Air New Zealand is carried out in accordance with the Australian/New Zealand Standard Procedures for the collection, detection and quantitation of drugs of abuse in urine: AS/NZS 4308:2001. The Court stated that the case should be regarded as specific to Air New Zealand's own sample collection procedures and subsequent medical consideration procedures, thus confirming the validity of testing carried out in accordance with these standards. However, it made no mention of other cheaper options for testing such as: 'on site' urine tests (dip sticks, cartridges, cups); laboratories conducting 'screen only' tests (that is, a single test with no subsequent confirmation test); and, oral fluid (or saliva) tests. Such cheaper options for testing are all capable of giving incorrect results. The Court also came to its decision based on Air New Zealand's ability to have recourse to specialised in-house medical personnel. Most employers will not have such facilities and the categories of individuals qualified to see test results, in the absence of such facilities, is unclear. The Health and Safety in Employment Act is also unhelpful on this point; it does not make any specifications as to what type of monitoring is appropriate. While testing may be lawful, an employee could still bring a personal grievance action under the Employment Relations Act for a dismissal following a positive result or for refusing to undergo such a test. In such a case, the question would be whether the conduct of the employee justified dismissal, that is, did it amount to serious misconduct? As noted above, there are no firm guidelines on what amounts to misconduct. However, it is highly likely that a positive result on a drug or alcohol test would qualify. The Employment Court has stated that:
The fundamental mutual obligation of confidence, trust and fair dealing which underpins the employment relationship demands that drugs and/or alcohol intake, which may cause affected employees to comprise a potential risk to other employees and their employer in a particular workplace, plainly has no place in that working environment.
The Court also held this obligation required employees to refrain from doing anything on their own time that might cause impairment at work. In addition, if provision is made in the employment contract for dismissal as a result of a positive test, then it is likely these rules will govern the situation. In the absence of an express agreement, the existence of work rules that are 'adequately made known to employees' will strengthen the case of an employer complaining of a breach of these rules. A breach of work rules, especially after warnings, will justify dismissal. Thus, if an employer makes it known that employees are required to submit to drug and alcohol testing, and that those who return a positive result will be dismissed, then the personal grievance action is likely to be of no help to an employee so dismissed, provided that the employer has acted fairly and reasonably. It should be noted, however, that an employer cannot physically compel an employee to undergo testing, and can only take disciplinary action for a refusal to submit to testing if the refusal is unreasonable in the circumstances of the case. It will be particularly difficult for an employer to establish this if there was no reasonable cause for conducting the test on a particular employee. In such a case, an employer may be found to have acted unjustifiably. Of course, an innocent employee may not be willing to take this chance.
As the Air New Zealand case did not consider the issue of the testing of job applicants, the law is uncertain in this area. It seems likely that applicants for safety sensitive positions would fall within the scope of the decision. Job applicants will not, however, have the benefit of the procedural protection of the Employment Relations Act. Under the Human Rights Act or Employment Relations Act, it may be possible for an employee or job applicant to claim that he or she has been discriminated against by an employer if a positive result to a drug or alcohol test results in some form of unfavourable treatment in his or her employment or pre-employment. To establish such discrimination, an employee would have to show that his or her use of drugs or alcohol constituted a disability. The question must therefore be, when can drug or alcohol use can be described as a disability?
In Ontario, drug or alcohol abuse has been held to constitute a 'handicap' as each is 'an illness or disease creating physical disability or mental impairment and interfering with physical, psychological and social functioning'. The Ontario Court of Appeal has held that even casual or recreational users may qualify for protection against discrimination under the Ontario Human Rights Code if an employer's drug and alcohol policy treats all employees testing positive as substance abusers. That is, if all such employees are subject to sanctions regardless of whether they can actually be said to be substance abusers rather than recreational users, then they are all being discriminated against on the basis of a disability they are believed to have. This is because the Code offers protection to both actual and perceived substance abusers in its definition of handicap. Canada's Federal Court of Appeal has also held that drug testing is arguably discriminatory as it has the effect of depriving drug dependent persons of employment opportunities. However, it should be noted that the Canadian Human Rights Act expressly includes drug dependency as a prohibited ground of discrimination.
New Zealand's Human Rights Act makes no mention of drug or alcohol dependency in its definition of disability. It can, however, be argued that the definition of disability, which includes physical disability and intellectual or psychological disability, may be wide enough to accommodate drug dependency. But even if this is so, s 29 of the Act, which provides for an exception where the person is a risk of harm to others, could be relied upon to excuse an employer from a claim of discrimination on these grounds. A further limitation on such a claim was recognised in the Air New Zealand case where the Court accepted that alcoholism and drug dependency were disabilities, but noted that only a small proportion of those who return positive results to testing would be subject to such disabilities. The rest would be 'suffering from a temporary condition due to the after-effects of taking alcohol or drugs' and such a 'temporary impairment or functional decrement falls short of disablement'. It could, however, be argued that as the Act covers discrimination on the basis of disabilities that people are believed to have, that it will, like the Ontario Human Rights Code, offer protection to both actual and perceived substance abusers, if they are treated in the same manner by the drug testing policy. However, while such an argument may rebut this limitation, it will not overcome the obstacle of s 29 of the Human Rights Act. Thus, it appears that employees subject to drug and alcohol testing will have very little success bringing a claim under the Human Rights Act.
It is clear that the Privacy Act will protect workers from drug and alcohol testing that can be said to be unreasonably intrusive under Information Privacy Principle 4, or, that is unnecessary, or not for a lawful purpose, under Information Privacy Principle 1. However, the Privacy Act will not prevent employers from carrying out drug and alcohol testing. While not qualified to decide the issue, the Employment Court in the Air New Zealand case held that it was unlikely that a 'responsible application of the [drug and alcohol] policy would cause the Privacy Commissioner to form an opinion that the appropriate threshold has been crossed warranting action', although it did cast doubt on the necessity of random drug testing in non-safety sensitive areas. Also, even if the testing seems intrusive, if the form of testing is common practice, Roth argues it may be viewed as reasonable simply because it is widespread. Thus, this protection will also be limited.
Whether an employer's decision to implement drug and alcohol testing in a workplace can be challenged by its employees will depend very much on the particular facts of the case. Of most significance in this assessment, it is suggested, will be the relevance of the testing to safety and the actual procedure that the employer follows in carrying out the testing and analysis. There is limited guidance as to the proper procedure to follow, such as the method of analysis, or, the individuals qualified to process the tests and see the results. The Employment Court noted this problem, stating that it was unsatisfactory there was no legislation that 'specifies any limitations upon this power [to drug test] or any safeguards as to the use to which the evidence obtained with the co-operation of employees may be put'.
The type of questions an employer may ask a job applicant regarding his or her health or medical conditions are clearly restricted by the Human Rights Act. An employer should not ask for general medical information as this may indicate an intention on the part of the employer to potentially discriminate against an applicant on the basis that he or she suffers from a disability.
The Human Rights Commission has released guidelines as to the types of questions an employer may ask prior to employment. An employer can ask questions that are directly relevant to the applicant's ability to perform the job, that is, a genuine occupational requirement. The Commission recommends that employers make the applicant aware of the requirements of the job, and then ask whether they have any disabilities or medical conditions that would prevent them from performing the job to the required standard. The Commission also recommends that where medical examinations are required to assess particular job related abilities, they should be restricted to short-listed candidates or made as a condition of employment.
There is a potential conflict between this prohibition on the collection of general medical information and the duty under the Health and Safety in Employment Act to identify workplace hazards. An employer can, however, ensure compliance with both Acts by asking questions such as, 'have you ever had an injury or medical condition ... which the tasks of this job might aggravate or contribute to?'
The Privacy Act also places limitations on the right of employers to ask job applicants for information on their medical history. Under Information Privacy Principle 1, such questions must be for a lawful purpose and be necessary for that purpose. Thus, the Privacy Act will also require that the question be linked to the requirements of the job and the ability of the applicant to carry out the tasks of the job. When medical exams are conducted, the medical practitioner undertaking the exam must have a clear indication of the medical requirements of the job and should be asked to report on the applicant's fitness on the basis of those criteria. Where health checks are required for medical insurance, it will generally not be necessary for the employer to receive the results of the health checks. Medical exams that collect information in a manner that is unreasonably intrusive, will, of course, be prohibited by Information Privacy Principle 4. When such questions are lawfully asked, applicants must not misrepresent their health status to their employers. The Employment Relations Act imposes a specific duty on parties in employment relationships not to mislead or deceive each other or to do anything likely to mislead or deceive. Misrepresentation of facts when obtaining employment will justify dismissal of an employee.
The combined effect of the Human Rights Act and the Privacy Act will alleviate much concern felt by applicants about conditions that they may not wish their potential employers to know about and which have no impact on their ability to perform the job. However, as noted earlier, health or fitness testing also raises privacy issues when it is concerned with an applicant's use of legal substances outside of work. Testing may be used to screen out job applicants with unhealthy habits, such as smoking or overeating, that may cause them to become ill in the future or increase costs for the employer in some way. This testing will clearly impact on a worker's privacy outside of the workplace, and so can be seen as a serious privacy invasion, but protection against such activities appears to be limited. If the testing is confined to specific questions rather than a request for general medical information, such as asking subjects whether they smoke or how much they weigh, it is unlikely that the Human Rights Act will apply. Like drug or alcohol addiction, addiction to smoking or overeating could be seen as an intellectual or psychological disorder. However, without other medical complications, it is unlikely that addiction to smoking or overeating will amount to a 'disability' within the definition of the Act. There must be some 'disabling or impairing effect' on an individual for a condition to become a disability. For example, a claim for discrimination based on obesity was rejected by the Victorian Board in Cox v Public Transport Corporation. The complainant was in all other respects fit and healthy and therefore was not considered to suffer from an impairment. Mazengarb has stated that the New Zealand Human Rights Commission is likely to adopt a similar view, as the Human Rights Act focuses on the effect of a disability and not its cause. One can think of cases where overeating or smoking has an impairing effect but this is only likely to be so in extreme cases. Thus, asking for such specific information will probably not amount to an intention to discriminate on prohibited grounds.
If an employer can tell from sight if a person is overweight, it cannot be said information is 'collected' from the individual, thus the Privacy Act will not apply. This will be the case unless the information is collected, for example, by a question about weight, or, a cholesterol test. Where information is collected, it is uncertain whether people who smoke or who are overweight will be protected from having to disclose such information by Information Privacy Principle 1. As it will most likely not breach the Human Rights Act to ask for such information, an employer could argue that it is not 'unlawful' to collect such information. Further, the collection could arguably be necessary in certain circumstances; an example being where a job requires a high level of fitness. Further, in the United States, information on smoking is often requested for insurance purposes. In such cases the applicant would have to rely on Information Privacy Principle 4, that is, that the information is collected in a manner that intrudes to an unreasonable extent upon that individual's personal affairs. Establishing a breach of this Principle may be difficult. The Supreme Court of Florida has held that it is not unreasonable to ask a job applicant if he or she smokes. The Court decided that there is no legitimate expectation of privacy for smokers on the ground that as smokers must reveal their smoking in a variety of situations in today's society, asking them to reveal it on a job application would not be invasive. Of course, it would be open to the Privacy Commissioner to find otherwise. If, however, an action was brought on the basis of an invasion of privacy, it may be that a court would find there was no reasonable expectation of privacy in such a case. The Court of Appeal's decision that a celebrity has no reasonable expectation of privacy over something that any member of the public could observe would point to such an approach. It therefore appears that the protection for workers who smoke or are overweight is limited.
The Human Rights Act will prohibit the use of psychological tests that include questions that will result in discrimination on the specified grounds. Tests that, by virtue of a particular definition of normality, discriminate against individuals on the basis of their cultural and social experience may also be prohibited if they can be shown to have a disparate impact on a racial or ethnic group. But such protection will not extend to persons discriminated against on the basis of 'different' or 'unusual' personality traits where there is no link to a prohibited ground of discrimination. The Privacy Act does not appear to prohibit the use of such tests. The Privacy Commissioner considers that the collection of some information about a prospective employee's personality and attitudes appears to be for a 'lawful' purpose and thus does not breach Information Privacy Principle 1. The Commissioner also considered that it was not for him to decide whether the number of questions in a test were excessive or overly personal. Under Information Privacy Principle 4, testing can probably not be seen as an unreasonable intrusion as it is a widespread practice. Although an employer may obtain information from a subject without his or her knowledge, which is a breach of Principle 3, an employer could argue that the collection comes within an exception to this Principle, that is, that making the subject aware of the information sought would prejudice the collection of the information. Thus, apart from the grounds in the Human Rights Act, there does not seem to be any real limits.
The use of video surveillance in the workplace is an acceptable practice, provided that the employer does not breach the Privacy Act. Surveillance is unlikely to breach Information Privacy Principle 1 if an employer can show that he or she had a lawful purpose for installing a video camera and that the collection of information by the camera was necessary for that purpose. For example, a lawful purpose may be to identify a thief among employees when past warnings to staff were unsuccessful in preventing further thefts. While Information Privacy Principle 3 requires that a person is aware that information is being obtained from him or her, it is likely that an employer carrying out surveillance can argue that one of the exceptions to this Principle will apply. For example, the Privacy Commissioner considers that an employer is not obliged to inform a subject he or she is being filmed when: it is not reasonably practicable because the surveillance is intended to film covert and unlawful behaviour; it would prejudice the purpose of collection; or, it is necessary to gain sufficient evidence of theft. Principle 4 may have application if the surveillance is unreasonably intrusive. However, the Privacy Commissioner considers that surveillance in a locker room where workers change their clothes does not constitute an unreasonable intrusion. The Commissioner, in reaching this conclusion, took into account the fact that the surveillance did not capture activities in the shower or toilet area. Thus, the filming of workers taking showers at the Affco meat plant could be considered to be an unreasonable intrusion. However, the Commissioner has said that 'extraordinary reasons' may justify covert surveillance of such private areas and so the legality of such surveillance cannot be ruled out.
Roth has argued that there is no 'collection of personal information' taking place where video cameras are used and, therefore, Information Privacy Principles 1-4 have no application. This, he states, is because the images received through the surveillance are not solicited from the subject and so are not within the Act's definition of 'collection'. However, the case notes of the Privacy Commissioner on this subject all treat information obtained from such surveillance as being 'collected' for the purposes of the Privacy Act. But even with this interpretation, it still appears there is little control on the use of surveillance cameras in the workplace.
If an employer wishes to dismiss an employee on the basis of the information discovered using such surveillance, he or she must ensure that the dismissal is procedurally fair in order to avoid a personal grievance claim. This offers employees some additional protection. There are two potential procedural defects that may render such a dismissal unjustified in these circumstances: relying on insufficient evidence and/or a failure to give a proper opportunity to comment. Firstly, an employer must realise that evidence from a video tape will only be compelling if it is clear and that he or she should take into account the quality of the video evidence when making the decision to dismiss. Secondly, even when the evidence from the tape is clear, an employer should in good faith give the employee a chance to explain or comment on the footage. It should also be noted that it may be possible for the relevant body to take into account the standards set by the Privacy Act when assessing the justifiability of the employer's actions. The Employment Relations Act's procedural protection will not, however, be available to a job applicant who is filmed as part of a trial employment period.
Many of the issues discussed in relation to video surveillance will also be of relevance to audio surveillance. However, in relation to audio surveillance, the Privacy Commissioner does consider that surreptitious tape recording of an interview with an employee can amount to a breach of Information Privacy Principles 3 and 4. This is because recording rather than merely listening to a conversation collects more information and opens up additional purposes for which the information could be used. A subject may answer differently, or with more care, if he or she knows the conversation is being recorded; thus it is unfair not to inform the subject that a conversation is being recorded.
The Court of Appeal has held that the conduct of employees outside of work will be a legitimate concern to employers where such conduct may impact on that employer's business. This impact may occur
because the business may be damaged in some way; because the conduct is incompatible with the proper discharge of the employee's duties; because it impacts upon the employer's obligations to other employees or for any reason it undermines the trust and confidence necessary between employer and employee.
If the employer can establish such a relationship between the conduct and the employment, then the employee may justifiably be dismissed. An employer may be concerned about the conduct of an employee outside of work and may wish to ascertain whether misconduct is occurring. For example, the employer may suspect the employee is abusing his or her sick leave. Any surveillance undertaken to confirm this suspicion will be subject to the requirements of the Privacy Act. Arguably, surveillance will be for a lawful purpose in terms of Information Privacy Principle 1 when the employer is trying to ascertain whether misconduct outside of the workplace is occurring. Abuse of sick leave could clearly undermine the relationship of trust and confidence between employer and employee. Thus, an employer could be said to have a legitimate interest in such conduct and surveillance to ascertain suspicions as to whether the conduct is occurring could be said to be for a lawful purpose. If it would prejudice the collection of the information to inform the employee of the surveillance, the employee would not have to be informed under Principle 3. Such surveillance will, however, also be subject to Information Privacy Principle 4, that is, the information must not be collected in a manner that is unreasonably intrusive. But, it is clearly arguable that surveillance of the employee in public places would not be unreasonably intrusive. Any dismissal based on information obtained through surveillance of an employee while he or she is off-duty must be fair and reasonable. For example, in the case of Excell Corporation Ltd v Stephens, an employee planned in advance to take a day off as sick leave to extend his holiday. The employer discovered this plan but, instead of raising it with the employee, waited until that day and photographed him leaving the airport. When the employee was asked about this conduct, he was not informed that the employer had prior knowledge of his intention to take the day off or that he had been photographed at the airport. This was held to amount to an entrapment, and was one of the reasons why the dismissal was held to be unjustified. However, the surveillance alone is unlikely to have been sufficient grounds for this finding.
It appears that the Privacy Act will not generally apply to the monitoring of employee email and internet services. Firstly, as the employee is using the employer's equipment to access email and internet services, the employer already holds the information and Information Privacy Principles 1-4, which relate to the 'collection' of personal information, probably do not apply. Secondly, the definition of 'collection' expressly excludes the receipt of unsolicited information. Thus, personal information cannot be said to be collected if it is put on an employer's network by employees voluntarily and is therefore not solicited. Further, if an email does not contain information about an 'identifiable individual', it will not qualify as 'personal information' under the Act.
An employer is entitled to issue instructions as to how the equipment it owns is to be used, and this includes email and internet services. If an employee agrees to a monitoring policy, it is unlikely that the employee will be able to argue that he or she had any expectation of privacy in information divulged through the use of such services. Thus, even if the Privacy Act applies, an employee will probably not be able to argue that monitoring was an unreasonable intrusion into his or her privacy if the employee has agreed to such a policy.
It will be in the employer's interests to monitor email and internet services to avoid criminal and civil liability for the wrongdoing of his or her employees. The Employment Court has stated that an employer is required to operate a personnel policy that will protect female employees from abuse. This suggests that a policy that sets out acceptable internet and email use, and monitoring to ensure compliance with such a policy, may be necessary as opposed to being merely desirable. Monitoring would also probably be seen to be for a 'lawful purpose' under the Privacy Act to avoid potential liability.
An employee may be justifiably dismissed if monitoring uncovers material of an offensive nature. This is, of course, provided that the dismissal is procedurally fair. If the breach of internet or email policy is merely 'trivial', dismissal may not be justified.
There is clearly very little restriction on the monitoring of employee email and internet use by employers.
This survey of the application of the current legal framework to identified privacy issues appears to support Roth's argument that 'employment law in New Zealand is presently structured so that it favours - and in some instances actually promotes - intrusions into the privacy interests of employees'. Some areas of particular concern are as follows: the lack of real guidance from the Air New Zealand case as to the best practice for drug and alcohol testing for employers; the failure of the Privacy Act to adequately protect worker privacy in terms of monitoring and surveillance activities of employers; and, the lack of restriction on the ability of employers to question employees, or to uncover information for themselves, about their conduct outside of work.
The law as it currently stands appears to favour the interests of employers over the privacy rights of their employees. It was shown earlier that employees are not able to adequately protect themselves against such invasions of privacy, due to an inequality of bargaining power in the employment relationship. Thus, if one accepts that privacy is an important right owed to all members of society that is not surrendered once an individual enters the workplace, reform of the law would seem to be necessary. In particular, reform should include guidelines as to appropriate monitoring and surveillance of workers and appropriate procedures for drug and alcohol testing. As drug and alcohol testing represents a 'bodily intrusion', it is a serious privacy invasion and thus should be subject to regulations that reflect this. The procedure for drug and alcohol testing is crucial to ensure as far as possible that no 'false positives' are produced and also to ensure that only properly qualified individuals carry out the testing in order to avoid sensitive information getting into the wrong hands. Guidelines as to appropriate monitoring and surveillance also seem necessary due to the apparent limitations of the Privacy Act in this area. The monitoring and surveillance of workers can be justified for many reasons and should not be prohibited. The problem is that the potential for abuse or misuse of such activities will always exist. For example, the use of video surveillance in the Horotiu Affco meat plant to obtain evidence about employees using drugs at work may be justifiable. But, it is submitted, the use of videos surveillance in changing rooms and showers is not justifiable. Nor should it be, as the Privacy Commissioner suggests, in extraordinary circumstances. Even if one accepts the view of the employer in this example that one should not be 'sympathetic' to the privacy rights of employees using drugs at work, this provides no justification for the unavoidable intrusion on the privacy rights of the employees not involved in the drug taking. To reiterate, even in extraordinary circumstances, the potential for the misuse of such surveillance should negate its use in this context.
There should also be restrictions on activities that impact on an employee's off-duty conduct. For example, it should not be possible for an employer to take a moral stand against an employee's use of legal substances outside of work. Such restrictions should extend to the monitoring and surveillance of workers outside of work. The laws that govern such activities should reflect the reasonable expectation of a higher degree of privacy outside the workplace.
Finally, it is clear that many of the current problems in relation to workplace privacy have been caused by the failure of the law to keep pace with developments in technology. For example, the difficulty Roth has in applying the Privacy Act to video cameras is due to the fact that the Act was simply not drafted with surveillance activities specifically in mind. Any reform should therefore provide the flexibility to be able to accommodate future developments in technology. It is always helpful to look to other jurisdictions to see how they have attempted to resolve legal problems. A brief survey of some examples of workplace privacy legislation in the United States, the United Kingdom and Australia now follows.
An interesting example of workplace privacy legislation in the United States are the so-called 'lifestyle protection laws'. Thirty states have enacted statutes that offer varying degrees of protection to off-duty conduct, ranging from 'merely protecting the rights of smokers to protecting all off-duty conduct that does not affect an employer's business'. Legislation that prohibited an employer from punishing an employee for using lawful products off-duty would clearly add to the current protection of smokers and overweight workers. However, such legislation is unlikely to eventuate in New Zealand. The pressure for discrimination against smokers in the United States grew out of increasing health care costs for those employees who smoked. The national movement that lobbied for protection of such workers was instigated by American tobacco companies. Neither of these factors is likely to lead to widespread pressure in New Zealand to put in place such measures.
The United Kingdom's Data Protection Act 1998 deals with the processing of personal data by data controllers. Processing is defined as 'obtaining, recording, or holding ... or carrying out any operation or set of operations on the information or data'. Thus, employee monitoring will be subject to the Act, and the main obligation on employers will be to process personal data obtained from monitoring 'lawfully and fairly'. In 2003 the Information Commissioner released an Employment Code of Practice setting out standards to be adopted by employers in order to make sure that they comply with the Data Protection Act 1998. The code is not legally binding but the Commissioner is likely to treat failure to comply as an indication the Act itself has been breached. The main thrust of the Code is that workers have a right to privacy in the workplace and that monitoring of workers by employers must only be undertaken in limited circumstances and under strict controls. Employers must carry out an 'impact assessment' of the proposed monitoring, which involves considering the alternatives to monitoring, or to that form of monitoring, as well as how intrusive the chosen monitoring is. Monitoring must be justified in that the benefit the employer receives from it outweighs the adverse impact on the workers. However, the obligations of an employer to employees in relation to workplace privacy in the United Kingdom are 'confusing and contradictory' due to the fact that a number of other statutes also have application.
In New South Wales the issue of surveillance of employees is addressed by the Workplace Surveillance Act 2005. This Act applies to camera and computer tracking and video surveillance. Under this Act, surveillance of an employee must not commence without prior notice to the employee. Such notice must contain information as to the form of the surveillance and where and when the surveillance will take place. Any covert surveillance must be authorised by the relevant authority unless it is necessary to ensure the security of the workplace or persons in it. Surveillance of employees in any change room, toilet facility, or bathing facility at a workplace, or any surveillance outside of work, except computer surveillance, is prohibited. While such legislation goes some way to deal with concerns regarding the surveillance of employees, it obviously does not address concerns relating to other privacy invasive activities.
In October 2005 the Victorian Law Reform Commission's final report on Workplace Privacy was tabled in the Victorian Parliament. The Commission has recommended that a comprehensive Act dealing with workplace privacy be introduced due to inadequacies in current Victorian law. The Commission supports 'light-touch regulation' to deal with most aspects of workplace privacy. Where, however, the activities sought to be regulated deal with serious privacy invasions, it recommends stricter controls. In this way, the Commission applies the 'hierarchy of privacy intrusions' concept, as discussed earlier. This light-touch regulation will apply to work related activities and will impose an obligation on employers not to unreasonably breach the privacy of workers while they are working. An appropriate regulator will be appointed to produce advisory guides or approved codes of practice. The stricter controls will apply when employees are not at work or where they are particularly invasive because they affect 'the bodily integrity of workers or impinge on their human dignity'. Some of these types of activities will be subject to an outright prohibition, an example being the surveillance of workers in private areas of the workplace. Other activities, such as out of hours surveillance of workers, will require prior authorisation from the regulator. The regulator will be required to produce mandatory codes of practice to govern privacy invasive activities, an example being procedures to be followed for drug and alcohol testing. A further job of the regulator will be to ensure compliance with the Act through investigations of complaints or through the initiation of independent inquiries.
Many of the features of the Victorian proposal seem similar to those of New Zealand's currently existing Privacy Act. For example, the establishment of a regulator to oversee the Act, the creation of codes of practice, and the concept of 'unreasonableness' as a standard for employer practices, all have their counterparts in the Privacy Act. However, the proposed legislation improves on these features. The Victorian Act will apply to all privacy invasive practices in the workplace and will not be limited to those situations where information is 'collected'. Further, while the Privacy Commissioner 'may' issue codes of practice, no code has of yet has been issued in relation to any matters of workplace privacy. In contrast, the Victorian regulator will be required to issue codes of practice in relation to activities that are particularly privacy invasive. Finally, although the concept of 'unreasonableness' for less serious privacy invasions under the Victorian proposal does not appear to be significantly different to the concept of 'unreasonable intrusion' under the Privacy Act, and it will probably be just as easy to justify privacy invasive activities on the grounds of managerial privilege under it, the hierarchy of privacy rights approach should ensure an appropriate level of protection for workers against serious privacy invasions, either by outright prohibition or by the creation of mandatory codes of practice. Thus, a proper balance should be struck between the rights of employers and employees. If reform of existing New Zealand law is attempted, the Victorian proposal could provide useful guidance as to its direction. The development of codes of practice could resolve many of the issues in relation to testing, monitoring and surveillance. Application to the regulator for prior authorisation for serious privacy invasions could prevent some forms of unjustifiable invasions from ever taking place. In addition to the improvements mentioned above, legislation dealing specifically with workplace privacy would avoid the contradiction and confusion that piecemeal legislation brings with it. Further, as the proposed Victorian regulations will only affect employers who engage in privacy invasive activities, they will not necessarily increase costs or create more 'red tape' for employers.
This survey of the law of workplace privacy in New Zealand finds the balance of power for most purposes firmly in the hands of employers. The legislation currently in place does not deal adequately with the issues identified in this paper. As individual employees are ill equipped to protect their right to privacy due to an inherent inequality in bargaining power in the employment relationship, reform of the law appears necessary. The best-case scenario would involve the adoption of some comprehensive legislation dealing with workplace privacy as a whole. As new technology continues to be developed with the potential to further invade employee privacy, this need for reform will intensify.
[*] LLB(Hons) and BA. The author is currently a law clerk at Buddle Findlay, Auckland.
 Warren & Brandeis, 'The Right to Privacy' (1890) 4 Harvard Law Review 196.
 Ibid 195.
  NZCA 34;  1 NZLR 1.
 Ibid 57.
 Ibid 58.
 J Craig, Privacy and Employment Law (1999) 11.
 J de Beer, 'Employee Privacy: The Need for Comprehensive Protection' (2003) 66 Saskatchewan Law Review 383, 384.
 Re Electronics Instrument Company and International Union of Electrical Workers (1965) LA 563.
 P Susser, 'Electronic Monitoring in the Private Sector: How Closely Should Employees Supervise Their Workers?' (1988) 13 Employee Relations Law Journal 575, 578.
 'Drugs a No-No - Union', The Press, 8 June 2005, A12.
 Note, 'Addressing the New Hazards of the High Technology Workplace' (1991) 104 Harvard Law Review 1898, 1904.
 M Pagnattaro, 'What Do You Do When You Are Not At Work?: Limiting the use of off-duty conduct as the basis for adverse employment decisions' (2004) 6 University of Pennsylvania Journal of Labor and Employment Law 625, 637.
 Susser, above n 9, 576.
 K Black, 'Personality Screening in Employment' (1994) 32 American Business Law Journal 69, 124.
 For example, the Minnesota Multiphasic Personality Inventory provides information on family functioning: see Black, ibid 124.
 Ibid 124.
 K Beck & K Toogood, 'Employment Law For Non-Specialists' (New Zealand Law Society Seminar Paper, 2005) 21.
 CCH New Zealand Ltd, Employment Law Library (2005) 61-030.
 Butterworths, Mazengarb's Employment Law (1999) [H/728].
 'Hospital Favours Smoke-Free Staff’, The New Zealand Herald, 26 March 2005, A5.
 'Quit Smoking or Quit Your Job, Says Company Owner', The New Zealand Herald, 27 January 2005.
 See, eg, the drug testing policy of Air New Zealand Ltd in NZ Amalgamated Engineering Printing and Manufacturing Union Inc v Air New Zealand Ltd  NZEmpC 32;  1 ERNZ 614.
 Rice & Thomas, 'Drug Testing in the Workplace' (1997) 147 New Law Journal 484, 484.
 C Morris, 'Drugs, the Law, and Technology: Posing some problems in the workplace' (2002) New Zealand Universities Law Review 1, 13.
 Ibid 28.
 M Ford, 'Two Conceptions of Worker Privacy' (2002) 31 Industrial Law Journal 135, 148.
 D Isbister, 'Justifying Employee Drug Testing: Privacy Rights Versus Business Interests' (1996) 5 Dalhousie Journal of Legal Studies 255, 259.
 H Oliver, 'Email and Internet Monitoring in the Workplace: Information Privacy and Contracting Out' (2002) 31 Industrial Law Journal 321, 324.
 Ford, above n 26, 137.
 Oliver, above n 28, 324.
 Isbister, above n 27, 259.
 Ford, above n 26, 138.
 Ibid 137.
 A Westin, 'Privacy in the Workplace: How well does American law reflect American values?' (1996) 72 Chicago-Kent Law Review 271, 276.
 De Beer, above n 7, 391.
 P Boyd, 'Tipping the Balance of Power: Employer Intrusions on Employee Privacy Through Technological Innovation' (2000) 14 St John's Journal of Legal Commentary 181, 186.
 Ibid 186.
 P Roth, 'Privacy in the Workplace - Getting the Balance Right?' (Paper presented at the Privacy Issues Forum, 1996) 2.
 Oliver, above n 28, 326.
 Ibid 330.
 J Bosch, 'None of Your Business (Interests): The argument for protecting all employee behaviour with no business impact' (2003) 76 Southern California Law Review 639, 647.
 Oliver, above n 28, 326.
 P Roth, 'The Privacy Act 1993 - Workplace Testing, Monitoring and Surveillance' (1997) 3 Human Rights Law and Practice 113, 114.
 See, eg, Pagnattaro, above n 12, 677; T McGovern, 'Employee Drug-Testing Legislation: Redrawing the battlelines in the war on drugs' (1987) 39 Stanford Law Review 1453.
 De Beer, above n 7, 389.
 Ibid 389.
 Craig, above n 6, 26.
 De Beer, above n 7, 389.
 A Drake, 'Monitoring and Control ofEmployee Use ofEmail and the Internet'  Employment Law Bulletin 62, 63.
 Victorian Law Reform Commission, Workplace Privacy: Final Report, Report No 159 (2005) 41.
 De Beer, above n 7, 386.
 Ibid 386.
 See the introductory paragraphs of the Explanatory Note to the Employment Relations Bill 2000.
 Employment Relations Act 2000, s 103.
 G Anderson, Lexis Nexis Employment Law Guide, (7th ed, 2005) 690.
 Ibid 696.
 Employment Relations Act 2000, s 103A.
 Auckland Provincial District Local Authorities Officers IUW v Northland Area Health Board  2 ERNZ 215.
 Anderson, above n 56, 698.
 Employment Relations Act 2000, ss 105, 106.
 Employment Relations Act 2000, s 112.
 Employment Relations Act 2000, s 104(1).
 Employment Relations Act 2000, s 123.
 Employment Relations Act 2000, ss 117, 118.
 Human Rights Act 1993, s 21.
 Human Rights Act 1993, s 22.
 Human Rights Act 1993, s 97(2)(a).
 Human Rights Act 1993, s 92B.
 Human Rights Act 1993, s 92I.
 Privacy Act 1993, Long Title.
 Privacy Act 1993, s 6.
 Privacy Act 1993, ss 13, 46, 69.
 Privacy Act 1993, s 6.
 Privacy Act 1993, s 66(1)(a).
 Privacy Act 1993, s 66(1)(b).
 Privacy Act 1993, s 82.
 Privacy Act 1993, ss 85, 88.
 Privacy Act 1993, s 11. The Employment Court has recently reaffirmed this proposition, noting that neither the Employment Relations Authority nor the Court itself is able to determine whether an action of an employer breaches the Privacy Act. This is a matter for the Privacy Commissioner only: NZ Public Service Association Inc v Southland Regional Council (Unreported, Employment Court, Christchurch, Colgan J, CC 15/05, 28 October 2005), noted in Recent Case Comment  Employment Law Bulletin 158.
 J Edwards, 'Workplace Drug Testing' (1995) 1 Human Rights Law and Practice 43, 47.
 See, eg, Imperial Enterprises Ltd vAttwood (2003) 7 NZELC, where it was held that the lack of a lawful purpose for the request of information from an employee made such a question inappropriate and established no obligation on the employee to fully disclose the information requested.
 Department of Labour: Employment Institutions Information Centre, 'Big Brother Goes to Work: Video Surveillance in the Workplace' (2005) Employment Cases Summary 16, 21.
 Health and Safety in Employment Act 1992, s 6.
 Health and Safety in Employment Act 1992, s 19.
 Department of Labour: Occupational Safety and Health Service, 'A Guide to the Health and Safety in Employment Act 1992' (2003), 29.
 Ibid 55.
 Crimes Act 1961, s 126 A.
 De Beer, above n 7, 395.
 Crimes Act 1961, s 216B.
 De Beer, above n 7, 395 - with regard to an identical section in Canada's Criminal Code RSC. 1985, c. C-46, s 184.
  NZCA 34;  1 NZLR 1.
 K Evans, 'Was Privacy the Winner on the Day?'  New Zealand Law Journal 181,181.
 Ibid 181.
 Hosking v Runting  NZCA 34;  1 NZLR 1, 32.
 Ibid 32.
 L Pincus & C Trotter, 'The Disparity Between Public and Private Sector Employee Privacy Protections: A call for legitimate privacy rights for private sector workers' (1995) 33 American Business Law Journal 51, 89.
 Hosking v Runting  NZCA 34;  1 NZLR 1, 32.
 A Geddis, 'Hosking v Runting: A Privacy Tort for New Zealand' (2005) 13 Tort Law Review 5,12.
 Pincus & Trotter, above n 96, 89.
 See, eg, Craig, above n 6, 74; Note, above n 11, 1907; K Conlon, 'Privacy in the Workplace' (1996) 72 Chicago-Kent Law Review 285, 290.
 Pincus & Trotter, above n 96, 89.
 Conlon, above n 100, 290.
 Pincus & Trotter, above n 96, 51-89.
 Hosking v Runting  NZCA 34;  1 NZLR 1, 41.
  NZEmpC 32;  1 ERNZ 614.
 Ibid 632.
 Ibid 653.
 Ibid 674.
 Ibid 676.
 Ibid 675.
 Skinner v Railway Labor Executives 'Assn USSC 48; , 109 S Ct 1402, 103 L Ed 2d (1989) 639.
 National Treasury Employees Union v Von Raab,  USSC 49; 109 S Ct 1384, 103 L Ed 2d (1989) 685, 706.
 Lexis Nexis NZ Ltd, Privacy Law and Practice (2005) [0/309F].
 The Occupational Safety and Health Division of the Department of Labour released guidelines in November 1998 in a position paper entitled 'Workplace Alcohol and Drug Testing'.
 Environmental Science & Research, Drug and Alcohol Free Workplace Programmes <http://www.esr.cri.nz/competencies/workplacedrugtesting/> at 7 December 2005.
 NZ Amalgamated Engineering Printing and Manufacturing Union Inc v Air New Zealand Ltd  NZEmpC 32;  1 ERNZ 614, 677.
 Jones v Wiremakers Ltd  NZEmpC 215;  3 ERNZ 711,727.
 Ibid 728.
 NZ Woollen Mills Union v Woolrest International  ACJ 643.
 P Agnew (ed), Lexis Nexis Employment Law Guide (6th ed, 2002) 612.
 Lexis Nexis NZ Ltd, above n 113, [0/309D].
 Section 5 of the Ontario Human Rights Code RSO 1990 c H 19 refers to 'handicap' as a prohibited ground of discrimination rather than 'disability' as under New Zealand's Human Rights Act 1993.
 Entrop v Imperial Oil Ltd (2000) 189 DLR (4th) 14, 47.
 Ibid 48.
 Toronto Dominion Bank v Canadian Human Rights Commission (1998) 163 DLR (4th) 193, 232.
 Human Rights Act (RS 1985, c H-6) s 25.
 1J Edwards, 'Workplace Drug Testing' (1995) 1 Human Rights Law and Practice 43, 47.
 M Webb, 'Workplace Drug Testing: Another Perspective' (1995) 1 Human Rights Law and Practice 131, 135.
 NZ Amalgamated Engineering Printing and Manufacturing Union Inc v Air New Zealand Ltd  NZEmpC 32;  1 ERNZ 614, 667.
 Human Rights Act 1993, s 22(2)(b)(ii).
 NZ Amalgamated Engineering Printing and Manufacturing Union Inc v Air New Zealand Ltd  1 ERNZ614, 671.
 P Roth, 'The Demise of Private Life' (2003) 5 Employment Law Bulletin 57, 58.
 NZ Amalgamated Engineering Printing and Manufacturing Union Inc v Air New Zealand Ltd  NZEmpC 32;  1 ERNZ 614, 674.
 Imperial Enterprises LtdvAttwood  NZEmpC 206; (2003) 7 NZELC 97,009.
 M Roche, 'Human Rights Commission - Pre-employment Guidelines' (1996) 2 Human Rights Law and Practice 3.
 Ibid 10.
 Butterworths, above n 19, [4000.7].
 Roche, above n 138, 10.
 Imperial Enterprises Ltd v Attwood  NZEmpC 206; (2003) 7 NZELC 97,009.
 CCH New Zealand Ltd, above n 18, 61-030.
 Employment Relations Act 2000, s 4(1)(b).
 Agnew, above n 120, 612.
 I Adzoxornu, 'Discrimination Against Fat People, Part I: It is not over until the fat person sings' (1996) 2 Human Rights Law and Practice 139, 161.
 (1992) EOC 92-401.
 Butterworths, above n 19, [4021.9F].
 Bosch, above n 41, 654.
 City of North Miami v Kurtz, 653 So 2d 1025 (1995).
 Hosking v Runting  NZCA 34;  1 NZLR 1, 41 - where it was argued that since any member of the public could have observed the plaintiffs' children in the street, the plaintiffs had no reasonable expectation of privacy of photographs of the children taken in the street.
 D Hermann, 'Privacy, The Prospective Employee, and Employment Testing: The need to restrict polygraph and personality testing' (1971-72) 47 Washington Law Review 73, 112.
 Case Note 2418  NZ PrivCmr 6 (1 August 1999).
 Roth, above n 135, 58.
 Logan v Hagal Co Ltd (Unreported, V Campbell, 13 July 2005, AA 267/05). For a useful summary of the relevant case law in relation to video surveillance see Department of Labour: Employment Institutions Information Centre, 'Big Brother Goes to Work: Video Surveillance in the Workplace' (2005) Employment Cases Summary 16.
 Case Note 32277  NZ PrivCmr 25 (September 2003).
 Case No 0632 of the Privacy Commissioner's Casenotes (August 1994).
 Case Note 32277  NZ PrivCmr 25 (September 2003).
 'Extract from a letter by the Privacy Commissioner concerning video surveillance', Office of the Privacy Commissioner, Privacy: New Zealand. A Compilation of Materials on the Privacy Act 1993 and the Office of the Privacy Commissioner (February 1994 - December 1994) 252-253.
 P Roth, 'Surveillance Cameras in the Workplace' (2002) 4 Employment Law Bulletin 54, 55.
 Privacy Act 1993, s 2.
 Van der Sluys v Taylor's Bar Ltd (Unreported, H Doyle, 19 January 2004, CA 4/04).
 Department of Labour: Employment Institutions Information Centre, 'Big Brother Goes to Work: Video Surveillance in the Workplace' (2005) Employment Cases Summary 16, 17.
 Puts v Foodstuffs (Wellington) Cooperative Society Ltd (Unreported, G Wood, 23 August 2002, WA 73/02).
 Department of Labour, above n 165, 16, 18.
 Ibid 21.
 Case Note 16479  NZ PrivCmr 6 (1 June 2001).
 Smith v Christchurch Press Co  NZCA 341;  1 ERNZ 624, 631.
 Ibid 631.
  NZEmpC 119;  1 ERNZ 568.
 Ibid, 578. However, this was not the main reason for the decision. On an application to appeal the judgment, the Court of Appeal decided that the central reason for the decision of the Employment Court was that the employee had not been given the opportunity to present fully his explanation for his conduct. The Court of Appeal declined to review this finding as it was an assessment of fact. (Excell Corporation Ltd v Stephens (Unreported, Court of Appeal, CA161-03, Gault P, Panckhurst & William Young JJ, 16 October 2003) 4.
 Roth, above n 135, 58.
 Privacy Act 1993, s 2.
 Drake, above n 49, 64. This article contains a useful summary of relevant cases involving the monitoring of email and internet services.
 Ibid 64.
 ANZ Banking Group (New Zealand) Ltd v Bingham  NZEmpC 150;  1 ERNZ 703, .
 J Edwards, 'The Potential Impact of the Internet on Privacy Rights' (1996) 2 Human Rights Law and Practice 15, 18.
 Drake, above n 49, 62.
 Clarke v Attorney-General  NZEmpC 119;  ERNZ 600, 612.
 Ibid 612.
 ANZ Banking Group (New Zealand) Ltd v Bingham  NZEmpC 150;  1 ERNZ 703. Dismissal was unjustified due to the employer's failure to follow due process, refusal to allow the employee to argue his case, and offer of a form of amnesty to all other employees.
 Wilmott v Bank of Western Australia Ltd (2001, WAIRC, 03013).
 Roth, above n 38, 1.
 Conlon, above n 100, 293.
 'Extract from a letter by the Privacy Commissioner concerning video surveillance', Office of the Privacy Commissioner, Privacy: New Zealand. A Compilation of Materials on the Privacy Act 1993 and the Office of the Privacy Commissioner, (February 1994 - December 1994) 252-253.
 'Drugs a No-No - Union', The Press, 8 June 2005, A12.
 Waikato Hospital has introduced a 'non-smoker' policy when hiring employees. The Waikato District Health Board justified this policy by saying the 'organisation had a legislative and moral responsibility to take a public stand to protect staff’ - 'Hospital Favours Smoke-Free Staff', The New Zealand Herald, 26 March 2005, A5.
 Pagnattaro, above n 12, 626.
 Victorian Law Reform Commission, above n 50, 18.
 Roth, above n 162, 56.
 T Dworkin, 'It's My Life - Leave Me Alone: Off-the-job employee associational privacy rights' (1997) 35 American Business Law Journal 47, 103.
 Pagnattaro, above n 12, 629.
 Bosch, above n 41, 654.
 Ibid 654.
 Data Protection Act 1998, s1(1).
 D Flint & D Mallon, 'RIPA (sub2K) + DPA (sub98) + HRA (sub98) = Confusion (sub03)' (2003) 19 Computer Law and Security Report 30, 35.
 C Pallot & G Mackay, 'Monitoring in the Workplace' (2003) 153 New Law Journal 1054, 1054.
 Ibid 1055.
 Oliver, above n 28, 350. Other relevant legislation includes the Regulation of Investigatory Powers Act 2000 and the Human Rights Act 1998.
 Workplace Surveillance Act 2005, s 10(1).
 Workplace Surveillance Act 2005, s 19.
 Workplace Surveillance Act 2005, ss 15 & 16.
 Victorian Law Reform Commission, above n 50, 27.
 Ibid xv.
 See de Beer, above n 7, 386.
 Victorian Law Reform Commission, above n 50, xii.
 Ibid xiv.
 Ibid xvii.
 Privacy Act 1993, s 46.