Workplace surveillance and AI: applying existing laws to new technology

Workplace surveillance is no longer limited to traditional CCTV cameras or swipe card access systems. As artificial intelligence (AI) becomes embedded in everyday workplace operations, it is reshaping how employers monitor safety, productivity and security. At the same time, reports indicate it has heightened employee uncertainty and concern about the potential for surveillance to occur without sufficient transparency or oversight.

Many employers now deploy a range of digital tools to monitor work, safety, productivity or security.

Examples of modern workplace surveillance include:

• video and audio surveillance, such as CCTV in offices, retail environments, warehouses and vehicles
• digital monitoring tools, including monitoring of email, messaging platforms, system usage or device activity
• location and movement tracking, such as GPS tracking in work vehicles or on employer‑issued devices, and access‑card data showing employee movements within a workplace
• collection and use of biometric information, such as fingerprint scanners and facial recognition software.

Further, AI is being used to streamline surveillance processes, such as through data categorisation, automatic policy violation detection and activity tracking.

While these technologies can offer significant operational, safety and productivity benefits, they also raise important legal considerations.

Employers are not currently facing AI-specific workplace surveillance laws at a federal level in Australia, but they must grapple with how existing workplace surveillance, privacy and employment frameworks apply to increasingly sophisticated forms of monitoring.

These issues are further complicated by the fact that workplace surveillance regulation in Australia remains largely state and territory based, with different obligations applying depending on where employees are located.

The legal landscape: a fragmented, state-based framework

There is no single, national law regulating workplace surveillance in Australia. Instead, the use of surveillance tools by employers is governed by a patchwork of state and territory legislation, with different regimes applying depending on where workers are located.

Some jurisdictions regulate workplace surveillance through dedicated workplace laws. For example, in New South Wales, the Workplace Surveillance Act 2005 (NSW) specifically regulates camera, computer and tracking surveillance of employees "at work", including requirements around advance notice and limits on the use of surveillance records. Similarly, the ACT has a tailored regime under the Workplace Privacy Act 2011 (ACT), which imposes notice, consultation and regulates how workplace surveillance records may be used and disclosed.

In contrast, other jurisdictions regulate workplace surveillance primarily through general surveillance devices legislation that applies to all persons and organisations, including employers.

For example, in Victoria, workplace surveillance is governed by the Surveillance Devices Act 1999 (VIC), which prohibits the use of listening, optical and tracking devices to record private conversations or private activities, unless a specific exception applies (such as consent, a warrant or other lawful authorisation), and separately restricts the communication or publication of material obtained through surveillance.

Comparable regimes exist in Western Australia's Surveillance Devices Act 1998 (WA), South Australia's Surveillance Devices Act 2016 (SA) and the Northern Territory's Surveillance Devices Act 2007 (NT), each with their own definitions, offences and exceptions.

Whilst Queensland and Tasmania also rely on general surveillance devices legislation, the legislation is more limited in scope.

In Queensland, the Invasion of Privacy Act 1971 (Qld) prohibits the use of listening devices to overhear, record, monitor or listen to a private conversation unless an exception applies, and restricts the communication or publication of the private conversation.

Additionally, the Queensland Criminal Code prohibits visual surveillance in circumstances reasonably expected to afford privacy, such as bathrooms, bedrooms and changing rooms.

Tasmania has similar regulations of listening devices under its Listening Devices Act 1991 (Tas) with its own definitions, offences and exceptions.

The Privacy Act 1988 (Cth) and the Australian Privacy Principles regulate the collection and use of information being captured by surveillance devices and are applicable to certain entities.

The principles require entities to only collect personal information that is reasonably necessary to their functions or activities, and to not use such information for another purpose without an individual's consent.

Where the information captured is considered sensitive information, such as racial, religious or health-related information, or certain biometric information, entities need to comply with additional consent requirements when collecting them.

For employers using AI enabled surveillance tools, the concern is not around the novelty of the technology. Rather the legal question is whether AI devices fall within existing statutory categories, such as camera, data or tracking surveillance, and whether the relevant jurisdiction specific requirements have been satisfied.

Case study: Surveillance monitoring devices in light vehicles

A recent issue we have grappled with is the use of AI enabled cameras and in vehicle monitoring systems.

Some employers are deploying technology such as AI fatigue cameras (which may be optical surveillance devices) and GPS based monitoring systems (which may be tracking surveillance).

Whether those tools could lawfully operate depends not only on their function, but also on factors such as:

• whether the employee had been given advance notice of the surveillance
• whether valid consent had been obtained (and from whom)
• whether the vehicle was being used for work or personal purposes at the relevant time
• which state or territory law applied at the time the surveillance occurred.

Take the followings examples.

• in New South Wales, the Workplace Surveillance Act 2005 (NSW) prohibits employers from conducting camera or tracking surveillance of employees outside of work
• in Victoria and South Australia, the use of cameras or tracking devices during personal use may be lawful only where valid consent has been obtained, and, in the case of optical surveillance, may require the consent of all occupants of the vehicle, making compliance difficult in practice
• in Western Australia, camera-based surveillance is generally prohibited during personal use, even with consent, while tracking surveillance may be permitted only where the consent of the person being tracked has been obtained
• in Queensland and Tasmania, there is no dedicated workplace surveillance regime, but the lawful operation of cameras and tracking devices during personal use typically turns on consent and notice.

Even where surveillance was permitted under state-based legislation, employers needed to consider overlapping obligations under the Privacy Act 1988 (Cth), particularly where surveillance data constituted personal or sensitive information.

It is imperative to consider whether continuous monitoring is reasonably necessary, whether appropriate notice had been given, and whether consent was required for the collection of certain categories of data.

Key takeaways

The regulatory landscape for AI-enabled workplace surveillance currently aligns with the Australian Government's National AI plan – see our earlier article. The plan emphasises a "regulation where necessary" approach that relies on existing, technology neutral laws to manage AI-related risks. In the employment context, as AI tools become more widely adopted, employers will need to keep consideration how established laws regarding matters such as workplace surveillance, privacy and work health and safety apply.

For employers, the key takeaway is that AI enabled surveillance tools are rarely unlawful simply because they use AI. Instead, legal risk most often arises from how, when and where those tools are deployed.

Employers must balance legitimate business objectives, such as safety and productivity, against jurisdiction specific surveillance requirements and privacy obligations. As AI enabled monitoring tools become more prevalent, careful design, clear policies and jurisdiction aware implementation will be critical to managing these risks.

When implementing AI-driven technology in the workplace, employers should ensure they have considered whether the tools are compatible with existing laws.