Working From Home or Being Watched? What Employers Can Legally Monitor
Working from home has become a normal part of Australian workplaces. However, with that shift, many employers have adopted technology to manage productivity, protect confidential information, monitor cyber security risks and ensure employees are performing work during paid hours. That can include monitoring work emails, internet usage, log-in times, application use, keystrokes, screenshots, device location and activity on employer systems.
The short answer is that an employer may be able to monitor an employee working from home, but only within legal limits. Those limits depend on where the employee works, what type of surveillance is used, whether the device or system is employer-owned, whether notice has been given, and whether the monitoring is reasonable and connected to a legitimate business purpose.
Employers often monitor remote work for practical and lawful reasons. These may include confirming attendance, managing performance, protecting client or customer data, identifying unauthorised access to systems, complying with regulatory obligations and investigating suspected misconduct. In professional services, finance, health, technology and other data-heavy industries, monitoring may also be part of broader cyber security and confidentiality controls.
However, the fact that an employee is working from home does not give an employer unrestricted access to the employee’s private life. A home remains a private environment. The more intrusive the monitoring, the stronger the employer’s justification, notice and safeguards should be.
There is no single national law that comprehensively regulates all workplace monitoring in Australia. Instead, employers must consider a combination of federal privacy law, state and territory surveillance legislation, employment contracts, workplace policies, industrial instruments and general employment law obligations such as acting reasonably and in good faith.
The Privacy Act 1988 (Cth) (Act) does not specifically regulate workplace surveillance, and the employee records exemption may limit how the Act applies to some employee information. However, privacy principles remain important where monitoring captures personal information outside that exemption, where contractors are involved, or where sensitive information is collected.
In New South Wales, the Workplace Surveillance Act 2005 (NSW) is particularly important. It regulates camera, computer and tracking surveillance of employees at work. Generally, an employer must give written notice before surveillance starts, and the notice must explain the type of surveillance, how it will be carried out, when it will start, whether it is continuous or intermittent, and whether it is ongoing or for a limited period. Notice must usually be given at least 14 days before surveillance starts, unless the employee agrees to a shorter period.
The Australian Capital Territory has similar workplace privacy legislation, while other states and territories rely more heavily on general surveillance devices and listening devices legislation. This means the answer can vary depending on the jurisdiction. Employers with staff working remotely across multiple states should not assume that a single approach will be compliant everywhere, therefore it is beneficial to contact a lawyer to discuss your specific circumstances and jurisdiction.
Common forms of remote-work monitoring include monitoring log-in and log-out times, VPN usage, email traffic, internet browsing on work systems, access to files, use of work applications, device security alerts and productivity software. Some employers also use more intrusive tools, such as screenshot capture, keystroke monitoring or webcam-based activity checks.
Lawfulness will often depend on whether the monitoring is confined to work devices, work systems and working hours, and whether employees have been clearly told about it in advance. Monitoring a company laptop used during rostered hours is very different from monitoring an employee’s personal device, private accounts or activity outside work.
Computer surveillance should also be carried out in accordance with a written policy. A well-drafted policy should identify:
Monitoring evidence may be used in performance management or disciplinary action if it has been lawfully obtained and is relevant to the issue being investigated. For example, records showing repeated unexplained absences from systems, non-attendance at meetings, or failure to perform duties during paid working hours may support an employer’s concerns.
In Suzie Cheikho v Insurance Australia Group Services Limited [2023] FWC 1792, the Fair Work Commission upheld the dismissal of an employee after the employer relied on a review of her cyber activity while she was working from home. The review included daily activity, hourly activity as well as VPN activity, and showed significant periods of inactivity during rostered working hours.
The decision illustrates that employers may be able to rely on records of work system activity when assessing whether an employee working from home has performed their duties. However, employers should still ensure procedural fairness by putting the concerns to the employee, giving them a genuine opportunity to respond, considering any explanation and ensuring any disciplinary outcome is proportionate.
Monitoring should not be covert unless a specific legal basis exists. In NSW, covert workplace surveillance is generally prohibited unless authorised under the statutory process. Employers should also be very cautious about audio recording, webcam access, GPS tracking and monitoring outside working hours. These forms of surveillance are more likely to raise privacy, consent and proportionality concerns.
Employers should also avoid collecting more information than necessary. For example, continuous screenshots that capture personal messages, health information, family information or private banking details may create unnecessary risk. If employees are permitted to use work devices for limited personal use, policies should explain the limits of that use and the extent to which personal activity may be incidentally captured.
Employers considering remote-work monitoring should start with a clear business reason. Is the monitoring needed for cyber security, client confidentiality, billing integrity, workplace safety or performance management? The answer should guide the type and extent of monitoring used.
Employers should then update employment contracts, remote work policies, IT acceptable use policies and privacy notices to ensure employees understand what is happening. In jurisdictions such as NSW, the statutory notice requirements must be followed before surveillance begins. Training managers is also important, because monitoring data should not be used selectively, unfairly or without context.
Employers should also review data governance arrangements. Monitoring records should be stored securely, accessed only by authorised personnel, retained only for as long as necessary, and used only for legitimate workplace purposes. If the monitoring involves third-party software providers, employers should check contractual terms, data hosting arrangements and information security controls.
Employees should read their employment contract, remote work agreement, IT policy and any workplace surveillance notice carefully. If it is unclear whether monitoring is occurring, employees can ask what systems are being monitored, when monitoring occurs, what data is collected and how it may be used.
Employees should also avoid using work devices or work accounts for private activities unless the employer’s policy permits it. Where possible, personal accounts, banking, health information and family matters should be kept off employer systems. If an employee believes monitoring is excessive, undisclosed or being used unfairly, they should seek advice before refusing to comply or taking unilateral action.
At Chamberlains Law Firm, we help businesses navigate the complexities of termination, contractor agreements and workplace compliance. Our workplace lawyers can review your contracts, advise on termination risks and represent you in disputes. Whether you need updated templates, compliance advice or support managing a workplace dispute, our Workplace Law Team is here to help.
Get clear, strategic advice on workplace surveillance, employee privacy and managing remote work compliance obligations, contact our Senior Associate Antonia Tahhan on 1300 676 823.