This is a concept website · Enquire about this domain

Hiring law, a guide by Dotto

Guide 4 of 5 · Privacy Act 1988, s 7B(3) and APPs 3, 5 and 11

Job applicants and privacy: what may be collected, what they are told, and how it is kept

The Privacy Act’s employee records exemption covers an employer’s act or practice only where it is directly related to “a current or former employment relationship” with the individual and to an employee record about them (s 7B(3)), and an applicant who has never been employed by the organisation has no such relationship with it. For an organisation the Act binds, three Australian Privacy Principles do most of the work in hiring: APP 3 on what may be collected, APP 5 on what the applicant is told, and APP 11 on keeping the information safe and destroying it.

Dotto does not recruit staff, run training or give migration advice: it is not a registered training organisation or a migration agent, and this guide is not legal or migration advice. General information only. The official place to check is the Office of the Australian Information Commissioner (OAIC).

  1. Licence
  2. Illegal work
  3. Sponsorship
  4. Pay secrecy
  5. Privacy
  6. Disability

Where the employee records exemption stops

The employee records exemption in s 7B(3) reaches only an act or practice directly related to “a current or former employment relationship” and an employee record, so it does not reach an applicant who has never been employed by the organisation. The principles below bind an “APP entity”; the OAIC’s guidance explains which organisations are APP entities and when.

APP 3: collect only what the role needs

“If an APP entity is an organisation, the entity must not collect personal information (other than sensitive information) unless the information is reasonably necessary for one or more of the entity’s functions or activities” (APP 3.2). The OAIC calls “reasonably necessary” an objective test: “whether a reasonable person who is properly informed would agree that the collection is necessary”, and it is for the entity to justify it.

The OAIC gives two hiring examples. It lists, among the instances where it “has previously ruled” a collection was not reasonably necessary, “a job applicant being asked to advise if they had suffered a work-related injury or illness, when this was not relevant to the position being advertised”. And among other examples of collection that may not be reasonably necessary, it gives “collecting personal information about all job applicants, when information is only required for shortlisted candidates”.

Three more rules in APP 3 shape a hiring process:

  • Sensitive information needs consent. An organisation must not collect sensitive information unless the individual consents and it is reasonably necessary for its functions or activities, or one of the situations in APP 3.4 applies (APP 3.3).
  • Lawful and fair means. “An APP entity must collect personal information only by lawful and fair means” (APP 3.5). The OAIC says a fair means “does not involve intimidation or deception”.
  • From the person. Personal information is collected from the individual unless “it is unreasonable or impracticable to do so” (APP 3.6).

Where a third party collects for an organisation, as a recruiter may for an employer, the OAIC says the organisation “should make sure the arrangements (such as a contract) cover how personal information will be handled and that the third party is aware of the Privacy Act obligations”. Among its examples of solicited personal information, where collected for inclusion in a record or generally available publication, the OAIC lists “an employment application sent in response to either a job advertisement published by an entity or an expression of interest register maintained by the entity”.

APP 5: what an applicant is told

At or before collection, or as soon as practicable after if that is not practicable, an APP entity must take whatever steps, if any, are reasonable to tell the individual about those APP 5.2 matters that are reasonable in the circumstances, or otherwise make sure the individual knows of them (APP 5.1). The ten matters are:

  1. the entity’s identity and contact details;
  2. if it collects the information from someone other than the individual, or the individual may not know it has collected it, that fact and the circumstances;
  3. if an Australian law or a court or tribunal order requires or authorises the collection, that fact, with the name of the law or details of the order;
  4. the purposes of collection;
  5. the main consequences, if any, for the individual if some or all of it is not collected;
  6. the other entities, bodies or persons, or kinds of them, to which it usually discloses information of that kind;
  7. that its APP privacy policy says how the individual may access and seek correction of the information;
  8. that its APP privacy policy says how the individual may complain about a breach of the APPs, or a registered APP code that binds it, and how it will deal with the complaint;
  9. whether it is likely to disclose the information to overseas recipients;
  10. if so, the countries where those recipients are likely to be, if it is practicable to say.

APP 11: keeping it safe, then letting it go

An APP entity that holds personal information must take reasonable steps to protect it “from misuse, interference and loss” and “from unauthorised access, modification or disclosure” (APP 11.1). Those steps include “technical and organisational measures” (APP 11.3).

When the entity no longer needs the information for any purpose the APPs allow, the information is not in a Commonwealth record, and no Australian law or court or tribunal order requires it to be kept, the entity must take reasonable steps to destroy it or make sure it is de-identified (APP 11.2). For an unsuccessful applicant, the question APP 11.2 asks is whether any allowed purpose for the file remains. The OAIC adds that “Over-collection can increase risks for the security of personal information.”

Screening applicants with AI tools is outside this guide.