HR and payroll breaches: the employee records exemption, TFNs and the NDB scheme

Why it matters. Payroll, HR and recruitment systems hold staff tax, bank, health and performance details. When one is breached, an early question for a private-sector employer is whether the Notifiable Data Breaches (NDB) scheme applies at all. The answer depends on the employee records exemption in section 7B(3) of the Privacy Act 1988, on who is holding the data, and on whether tax file numbers (TFNs) are in it. This page sets out what the OAIC says on each point; it is general information, not legal advice.

The link between the exemption and the NDB scheme

The OAIC explains that the NDB scheme only applies to entities and information holdings that are already subject to security requirements under the Privacy Act, so acts and practices that are exempt from the Privacy Act may also be exempt from the NDB scheme. The employee records exemption is one of the exemptions it names, alongside media organisations acting in the course of journalism and registered political parties.

What the exemption covers

According to the OAIC, a private-sector employer's handling of employee records is exempt from the Australian Privacy Principles where the act or practice is directly related to a current or former employment relationship between the employer and the individual, and to an employee record held by the organisation about that individual. Section 6(1) of the Privacy Act defines an employee record as a record of personal information relating to the employment of the employee. The OAIC's examples include health information about an employee and information about engagement, training, discipline, resignation or termination; terms and conditions of employment; personal and emergency contact details, performance or conduct, hours, salary or wages; professional association or trade union membership; leave; and the employee's taxation, banking or superannuation affairs.

Where the exemption stops

The OAIC lists several limits that matter in an incident:

1. Future employment is not covered. Information about job applicants who are not hired falls outside the exemption; once someone is hired, the records of their pre-employment checks become exempt.

2. Acts outside the employment relationship are not covered. The OAIC's example is an employer that plans to sell a list of employees to another organisation for marketing.

3. Contractors and subcontractors are not covered when they handle another organisation's employees' information, whatever the contract says. The OAIC says the exemption is unlikely to apply to providers of recruitment, human resource management, medical, training or superannuation services under contract to an employer, or to workers compensation insurers that are not the employer.

4. Volunteers are not covered, because an organisation and a volunteer are not treated as having an employment relationship for this exemption.

5. Not everything about an employee is an employee record. The OAIC notes that while an employee's bank details may be part of the record, emails the employee receives from their bank in a work mailbox may not be, and whether email content is part of the record depends on the circumstances.

TFNs keep the scheme in play

The OAIC's NDB guidance says the employee records exemption does not apply to TFN information contained in an employee record. Separately, the NDB scheme applies to TFN recipients in relation to their handling of TFN information (s 26WE(1)(d)). A TFN recipient is any person in possession or control of a record that contains TFN information (s 11), and TFN information is information that connects a TFN with the identity of a particular individual (s 6). The OAIC says the scheme applies to a TFN recipient to the extent that TFN information is involved in a breach; if it is not, the recipient only has to comply for other information if it is also a credit provider or an APP entity. Entities whose security obligations cover particular types of information only, such as small businesses that must secure TFN information, do not need to notify about breaches affecting information outside those obligations.

The binding Privacy (Tax File Number) Rule 2015 also requires TFN recipients to take reasonable steps to protect TFN information from loss, unauthorised access, use, modification, disclosure or other misuse, and to securely destroy or permanently de-identify it when it is no longer required by law or needed for a taxation, personal assistance or superannuation purpose. The OAIC notes that sections 8WA and 8WB of the Taxation Administration Act 1953 create offences for unauthorised requests for a TFN and for unauthorised recording, use or disclosure of an individual's TFN, unless an exception applies.

Small businesses

A small business operator is one that has not had an annual turnover of more than $3 million in any financial year since 2001 (s 6D). The OAIC says small business operators generally have no obligations under the APPs unless an exception applies (s 6D(4)), for example where they provide a health service and hold health information, trade in personal information, are related to an APP entity, are a credit reporting body or have opted in under s 6EA. A small employer that holds staff TFNs is still a TFN recipient for that information.

A short triage for an HR or payroll breach

1. Who held the data? If it was a payroll, recruitment or HR service provider rather than the employer, the OAIC says the exemption is unlikely to help that provider.

2. Whose data is it? Split current and former employees from applicants who were never hired, volunteers and contractors; only the first group can fall under the exemption.

3. Is every field really an employee record? Check mailbox contents, shared drives and anything not related to the employment itself.

4. Are TFNs in the data? If so, treat the TFN information as inside the NDB scheme and run the serious harm assessment for it. The OAIC expects assessments to take no more than 30 days wherever possible.

5. Write the reasoning down. Whichever way the answer goes, record which exemption you relied on, what data was involved and why, so the decision can be explained later.