Can an employer gather personal information on an employee without their knowledge?
Can an employer gather personal information on an employee without their knowledge?
Pursuant to the provisions of The Privacy Act 2020, the primary means to gather information on an employee, is to obtain the information directly from the person themselves. Outside of that, an employer should only gather information about an employee from other sources, with the prior consent of the employee.
To obtain information about any employee without their prior consent may amount to a breach of the Privacy Act and could also constitute an unjustified disadvantage.
What is Privacy Principle IPP 3A?
As of 1 May 2026, a major change to the Privacy Act 2020 came into effect relating to the gathering of information indirectly about an employee.Â
Principle IPP 3A now requires employers to advise an employee in advance that they will be collecting information about them from another party.Â
Within an employment context this now requires an employer who is implementing a disciplinary process to advice the accused employee in advance, that witness statements will be gathered from other parties. Similarly, in an investigation process, the accused employee will need to be advised the sources from which the investigator will be gathering information – including the complainant, third party sources or electronic recording devices such as CCTV. Other situations where information may be gathered includes during restructures and redundancies, in responding to personal grievances or in seeking to resolve disputes.Â
What must an employer specifically tell the employee about the information to be gathered?
Principle 1PP 3A requires that employers must take reasonable steps to tell the employee:
- that their information has been collected
- the purpose of the collection
- who will receive the information
- who collected and who holds it
- whether the collection is authorised or required by law (and which law)
- their rights to access and correct the informationÂ
This mirrors the existing IPP 3 requirements but extends them to indirect collection.
What are organisations expected to do now?
The Office of the Privacy Commissioner has stated that organisations must:
- identify where personal information is collected indirectly
- review their privacy notices and policies
- ensuring staff understand when notification is required
- update processes for complaints, referrals, investigations, and third-party information flows
What rights do employees have to access information gathered against them?
Principle IPP 6 of the Privacy Act 2020 confirms that an employee has a legal right to request access to all and any personal information the employer may hold about them.Â
This may include information held on:Â
- personnel and HR filesÂ
- performance reviews and disciplinary recordsÂ
- investigation materials relating to the employeeÂ
- emails, notes, or correspondence referring to the employeeÂ
- payroll, leave, attendance, and benefit recordsÂ
- CCTV footage, monitoring data, or recordings (where identifiable)Â
- managers’ notes or assessments about the employee
Where the employee makes a request for disclosure of personal information, the employer must provide the requested and available information within 20 working days of receiving the request.Â
However, in being requested to disclose such information the employer may decline the request where:Â
The disclosure would involve an unwarranted breach of another person’s privacy, such as:
- witness identities
- complainant details
- third-party personal opinions
- The release would pose a serious threat to life, health, or safety of any person
- The Information is protected by legal professional privilege (e.g. advice from the employer’s lawyer)Â
The Privacy Act 2020:
- does not give an employee a right to access information about other employees
- does not require employers to create new documents that don’t already exist
- does not override legitimate confidentiality or safety protections
Get in Touch.
Call now for an obligation free conversation to discuss your needs.
"*" indicates required fields
Other articles
When should we document variations to Employment Terms and Conditions?
What obligations do employers have to disclose information to employees
Medicinal Cannabis in the Workplace – what do Employers need to know?
Can I stand an employee down without pay?
How do you terminate a Casual Employee?
Can custom and practice override written terms and conditions?
Can a Contractor claim that they are an employee?
ARTICLES / Many organisations may seek to engage labour on a ‘contracting’ basis, rather than as employees, believing this offers a greater degree of flexibility within the workforce, while reducing...
How do I determine which employees’ role can be disestablished?
ARTICLES / Restructuring a business that may result in employee redundancies is a complex process, thwart with all kinds of problems that could result in significant employment liabilities being incurred....
