The answer often depends on whether the right policies, notices and internal processes were in place before the issue arose.
When an employer suspects that an employee has misused company resources, shared confidential information or exchanged inappropriate messages, reviewing work emails or Microsoft Teams messages can look like the obvious first step. The difficulty is that business IT systems can contain a mix of work-related information, employee personal information and links to separate, private accounts.
Ownership of the device or system does not, by itself, give an employer unrestricted access to everything available through it. Employers must be able to identify what information their systems collect, why the business may access it, how it may be used, and which legal requirements apply in each jurisdiction where employees work.
That is why a properly designed policy framework matters. Batch Mewing Lawyers can help employers put that framework in place before an investigation, complaint or data incident tests it.
The policies need to match the technology
A generic IT policy may not accurately describe the information now generated by Microsoft Teams, email platforms, cloud storage, mobile devices, security tools, access logs, AI platforms, CCTV, and GPS or fleet systems. If a policy does not reflect what the business actually collects and monitors, it may leave open whether employees were adequately informed and whether a proposed use of the information is consistent with the stated purpose.
We can work with an employer’s HR, IT and operational teams to identify the systems in use and turn those practices into a set of documents. Depending on the business, that may include:
- a workplace surveillance or monitoring policy explaining the types of monitoring undertaken and the business purposes they serve
- an acceptable-use policy covering email, Microsoft Teams, messaging and AI platforms, internet use, cloud storage and company devices
- a privacy policy and collection notices that accurately explain how personal information is collected, held, used and disclosed
- employment contract clauses and onboarding documents that are consistent with the policy framework
- investigation and information-access protocols that identify who can authorise access, the scope of a review and how relevant material will be handled
- retention, access and disclosure rules for information obtained from business systems
Different rules can apply across Australia
The legal position is not uniform. New South Wales and the ACT have specific workplace surveillance legislation. In NSW an employer must give written notice before surveillance begins, and computer surveillance must be carried out in accordance with a policy that has been notified to employees in advance. Other privacy, criminal and surveillance laws may also apply, including in jurisdictions without an equivalent general employee-notification regime.
For employers operating in more than one State or Territory, we can review where employees work, the monitoring used in each location and the notices required, then prepare a national policy with jurisdiction-specific provisions, or separate documents where that is clearer and more workable.
The employee records exemption is not a blanket permission
The Privacy Act 1988 (Cth) contains an employee records exemption for certain acts and practices of private sector employers. Its application depends on whether the particular act or practice relates directly to both the employment relationship and an employee record held by the employer.
The exemption should not be treated as authority to collect or use anything found on a work device. Personal banking correspondence, private cloud storage or messages involving contractors, unsuccessful applicants or other third parties may require a different analysis. A legitimate employment purpose for obtaining information also does not necessarily justify every later use or disclosure of it.
We can help employers assess the proposed collection, access, use or disclosure before it happens. That includes defining the employment-related purpose, identifying whose information is involved, considering whether the information is held on the business system or in a separate private account, and limiting the review to material reasonably connected with the issue being investigated.
Proposed amendments to the Privacy Act 1988 (Cth)
Employers should review their privacy, workplace surveillance, acceptable-use and investigation policies now, given the continuing reform of the Privacy Act 1988 (Cth). The proposed next tranche of reforms may change the standards that apply to the collection, use, disclosure and security of personal information. New transparency requirements for certain automated decision-making processes are due to commence on 10 December 2026.
For employers, this means checking whether existing policies accurately describe the information collected through workplace IT systems, including any use of AI or automated tools, the purposes for which that information may be used, who may access it and how it is protected. We can track the reforms, assess what they mean for employee information and update the business’s policy framework, notices and internal procedures as the final requirements become clear.
Policies should support a lawful investigation process
A useful policy does more than reserve a broad right to monitor. It should support a controlled and defensible process when access is required. We can help employers set up an investigation protocol that addresses:
- the concern or allegation that justifies the review
- the source and categories of information that may be examined
- the people authorised to approve and conduct the search
- search parameters designed to avoid unnecessary access to unrelated personal material
- how potentially privileged, confidential or highly sensitive information will be handled
- how relevant information may be used in a disciplinary or other workplace process
- how investigation material will be stored, disclosed, retained and ultimately destroyed
This framework can help decision-makers pause before using a saved password, following a link to a personal account or conducting an unnecessarily broad search. It also gives HR and IT teams a common process to follow when urgent allegations arise.
Implementation matters as much as drafting
A policy is unlikely to achieve its purpose if it is left on an intranet without effective communication or if actual monitoring practices later change. We can help with implementation by preparing employee notices and acknowledgements, aligning onboarding materials, briefing HR and managers, and setting clear approval pathways for requests to access employee communications.
We can also review policies when the business introduces new technology, expands monitoring functions, changes its investigation practices or begins operating in another jurisdiction. The review should test whether the written documents still match the information the systems collect and the purposes for which the business uses it.
Before opening an employee’s inbox or reviewing their device, an employer should be able to explain what it is looking for, why access is necessary, what legal requirements apply and how the information will be used.
If you would like help reviewing your IT use, privacy or workplace surveillance arrangements, contact the Employment, Industrial Relations, and Safety team at Batch Mewing Lawyers.
