Can you monitor your employees’ keystrokes?

The remote work trend has caused many employers to struggle to adapt how they monitor productivity. Employers are increasingly utilising software to track employee output, including keystroke monitoring software (i.e. software applications that record the number of individual keystrokes typed on a keyboard, as well as mouse movement, over time).

The Fair Work Commission (Commission) recently considered keystroke monitoring in the context of an unfair dismissal application in Cheikho v Insurance Australia Group Services Limited [2023] FWC 1792 (Cheikho), holding that a dismissal based on keystroke data was not unfair.

Cyber Reviews in Unfair Dismissal

Cheikho concerned an unfair dismissal application made by an employee who commenced employment in 2005, and worked remotely on an almost permanent basis from 2022 until her dismissal.[1] The employer was a large Australian insurance company which operates much of its workforce remotely.[2]

In November 2022, the employee received a formal warning about her output and was put on a performance improvement plan, before she was dismissed in early 2023 for misconduct involving a failure to work as required during the period of October to December 2022.

The employer argued that the employee had failed to work her designated hours, was often uncontactable, failed to start work on time, had remarkably low productivity and engaged in other misconduct. The employer conducted a ‘cyber review’ over a three-month period in making the dismissal, which involved the use of software to monitor the keystrokes from the employee’s computer. The cyber review revealed that the employee averaged 34.56 keystrokes per hour and elapsed 143 hours with no keystroke activity in her least productive month, falling well below the 500 keystrokes per hour target.[3]

The Commission held this evidence demonstrated that the employee had not worked as she was required to and agreed with the employer’s characterisation that this amounted to misconduct.[4] When given an opportunity to refute the allegations of non-performance, the employee could not do so.

The Commission held that the dismissal was not harsh, unjust or unreasonable, and therefore not unfair.[5] As to the employee’s conduct, the Commission held that “it was on a scale and at a sufficient level of seriousness to constitute misconduct.”[6]

This decision signals that employers may be able to rely on keystroke data when taking disciplinary action, in appropriate circumstances.

Workplace Surveillance Legislation

In conducting workplace surveillance (including keystroke monitoring), employers should be mindful of applicable privacy and workplace surveillance legislation. Businesses must comply with the Privacy Act 1988 (Cth)[7] and other privacy laws that may apply to workplaces,[8] such as the prohibition against making video recordings without consent in places that people would expect to be private.[9]

Some Australian jurisdictions have workplace surveillance legislation. New South Wales has specific requirements for employers using technology for surveillance in the workplace,[10] as does the Australian Capital Territory.[11] In these jurisdictions, employers must inform employees of surveillance, including data surveillance,[12] and the specific information that will be collected. There are further requirements for employers to have a workplace surveillance policy and comply with the terms of that policy.[13] Meanwhile, Victoria has legislation that prohibits the use of surveillance devices in the workplace in certain settings, such as in toilets and changerooms.[14]

The Northern Territory, Queensland, Tasmania, Western Australia and South Australia do not have specific workplace surveillance legislation. This means that employers may monitor computer and internet use, provided that the surveillance complies with general surveillance legislation, criminal law, and federal telecommunications law.[15]

Conclusion

Employers are able to rely on keystrokes data in certain circumstances, subject to compliance with applicable privacy and workplace surveillance laws. Looking forward, it remains to be tested whether more invasive forms of technology, such as video live streaming and desktop mirroring, would be permissible to monitor productivity when employees work remotely.

Employers conducting any form of workplace surveillance should implement a workplace surveillance policy to ensure that its practices are clearly outlined, even in jurisdictions where no workplace surveillance legislation applies. Having a well-defined and robust policy will place employers in a defensible position in this rapidly evolving space.

Gadens is well-positioned to assist businesses with tailored employment and industrial relations advice on all aspects of the engagement of labour.

If you found this insight article useful and you would like to subscribe to Gadens’ updates, click here.

Authored by:
Jonathon Hadley, Partner
Liam Elliot, Solicitor

[1] Suzie Cheikho v Insurance Australia Group Services Limited [2023] FWC 1792.

[2] Ibid [9].

[3] Ibid [21].

[4] Ibid [30].

[5] Ibid [50]-[51].

[6] Ibid [43].

[7] Privacy Act 1988 (Cth) section 7B(3). See also Lee v Superior Wood Pty Ltd T/A Superior Wood

[2018] FWC 4762 and Lee v Superior Wood Pty Ltd T/A Superior Wood [2019] FWCFB 2946 (on appeal).

[8] For example, Criminal Code Act 1899 (Qld) section 227A; Surveillance Devices Act 1999 (Vic) part 2A.

[9] For example, bathrooms and changerooms.

[10] Workplace Surveillance Act 2005 (NSW) parts 2-4.

[11] Workplace Privacy Act 2011 (ACT) division 3.2.

[12] Ibid section 11.

[13] Ibid division 3.2; Workplace Surveillance Act 2005 (NSW) parts 2-4.

[14] Surveillance Devices Act 1999 (Vic) part 2A.

[15] For example, Invasion of Privacy Act 1971 (Qld); Criminal Code Act 1899 (Qld); Criminal Code Act 1995 (Cth); Telecommunications Act 1997 (Cth).