"Bossware and the law: workplace monitoring in Australia after the Digital Work Systems Act"
Bossware and the law: workplace monitoring in Australia after the Digital Work Systems Act
Employee monitoring software has quietly become standard equipment. Keystroke counts, screenshot captures, app and website logs, mouse movement scores, GPS on company vehicles, sentiment analysis of your messages. The products are marketed on productivity, and the pitch to managers is that none of this is new: we have always had CCTV and email logs. The law, however, was written for cameras and phone taps, not for software that infers how you feel while you work.
In February 2026 the NSW Parliament passed the Work Health and Safety Amendment (Digital Work Systems) Act 2026, the first law of its kind in Australia, and the first acknowledgment in statute that algorithmic management is itself a workplace hazard. It changes the conversation about monitoring from "did the employer notify me" to "did the employer assess the risk of what it is doing to us".
The patchwork you are actually covered by
Australia regulates workplace surveillance in layers, and they do not line up neatly:
- State surveillance acts. NSW's Workplace Surveillance Act 2005 covers camera, computer and tracking surveillance and requires advance notice of the nature of the surveillance; covert surveillance needs a magistrate-issued authority and cannot be used for performance monitoring or in change rooms and toilets. Victoria, the ACT and other jurisdictions have their own, narrower regimes. There is no national workplace surveillance statute.
- The Privacy Act, mostly displaced. As the OAIC explains, private sector employee records are exempt from the Privacy Act when handling relates directly to the employment relationship. So a keystroke log used to assess your performance may sit outside federal privacy law entirely. The OAIC notes that where monitoring records are kept and used beyond that narrow relationship, the Australian Privacy Principles can apply.
- Fair Work. The Fair Work Commission accepts surveillance evidence in dismissal cases, provided the monitoring itself complied with state law and notice requirements.
- Now, WHS. The new NSW duty treats digital work systems, defined broadly as algorithms, AI, automation or online platforms used to allocate, monitor or manage work, as something an employer must proactively manage for health and safety risks, alongside excessive workloads and excessive monitoring or performance metrics.
That last layer is the significant one. As employment firm Mapien's March 2026 analysis puts it, digital monitoring tools are now treated as systems of work, meaning employers must assess and manage their psychosocial risks the way they would any physical hazard. Psychosocial risk is exactly what unbounded monitoring produces: the constant sense of being watched, targets set by opaque scoring, algorithmic pressure to speed up.
The cases that show how this plays out
The leading precedent remains Suzie Cheikho v Insurance Australia Group Services Ltd [2023] FWC 1792, where the Fair Work Commission upheld a dismissal based on keystroke monitoring data, finding the inactivity data a valid indicator of underperformance, as Mapien's review recounts. A 2026 decision ([2026] FWC 519) upheld another dismissal based on monitoring software detecting falsified timesheets. So surveillance data can end your employment, and courts will accept it if the collection was lawful.
What the law has not yet resolved is the newer layer: AI systems that analyse tone, response times and behavioural patterns, making automated inferences about attitude or competence. Mapien notes Victorian parliamentary submissions documenting failures where AI misclassifies interactions, and that these tools create new pathways for unfairness and discrimination, particularly when opaque systems make decisions managers cannot justify or replicate. Victoria has given in-principle support to 15 of 18 recommendations from its parliamentary inquiry into workplace surveillance; that is a parliamentary process, not enacted law, so label it accordingly.
What this means for employers
If you run a business and monitor staff, the compliance posture has changed even where the statutes have not:
- Notice is not enough anymore. A blanket "we may monitor" clause satisfied the 2005-era statutes. Under the new WHS duty in NSW, you also need to show you assessed the risks your monitoring creates, including psychosocial harm from excessive monitoring, and that you mitigated them.
- Proportionality is now a live test. Continuous screen recording and unrestricted keystroke logging are increasingly viewed as high-risk practices even when technically legal, as compliance guides tracking 2026 observe. Aggregated, role-based, purpose-driven data is the defensible model.
- Your vendor contract is part of your risk assessment. If the SaaS product scores sentiment and surfaces it to managers, that capability is in scope of your WHS duty, not a feature flag.
- Privacy law still bites at the edges. Employee records used beyond the employment relationship, recruitment data, contractor data, are all squarely within the OAIC's remit, and the OAIC's enforcement appetite is not theoretical.
The parts of you the software keeps
Beyond the monitoring question sits a second problem: what happens to the data itself. A keystroke log, a screenshot archive or a sentiment score is personal information, and once it identifies a worker the Australian Privacy Principles can attach, subject to the employee records carve-out. As Victorian parliamentary commentary noted, surveillance is often treated as "consented to" but there are currently no clear limits on how employers may use the data once captured, creating legal risk around secondary use, profiling and automated decision-making, as Mapien's review summarises. In practice that means a screenshot taken to troubleshoot a bug can resurface in a performance meeting, and there is often no policy line saying it cannot.
Biometric data raises the stakes again. Face recognition clock-in systems and voice analytics are increasingly bundled into workforce platforms, and the OAIC treats facial recognition and biometric scanning among its 2025-26 regulatory priorities as rights-preservation issues in emerging technology. A biometric template cannot be changed if it is breached, and it is stored alongside employment data that determines your livelihood. Employees asked to enrol a face or voiceprint for timekeeping are entitled to ask how it is stored, where it is processed, and what happens on termination, and the answers today are frequently unsatisfying.
What this means for workers
If you are being monitored, a few grounded points:
- Check the notice. In NSW, camera, computer and tracking surveillance is only lawful with proper advance notice of its nature; covert surveillance without a magistrate's authority is unlawful, and unlawful surveillance information is generally inadmissible. The NSW Act's text is readable and short by legislation standards.
- The employee records exemption cuts both ways. It can limit your ability to see what the software recorded about you under the Privacy Act, as the OAIC's employment guidance explains, though workplace laws give you some access routes via the Fair Work Ombudsman.
- Health and safety is your lever. If monitoring is being used punitively and it is affecting your wellbeing, that is no longer just a privacy grievance; in NSW it is a WHS matter an employer must manage, and your union or WHS representative can raise it as such.
- Assume it persists. Monitoring records live in vendor clouds with their own retention and breach profiles. Minimise what you put through monitored channels where you legitimately can. For the personal side of reducing your digital exposure, see our OSINT lockdown guide.
Australia has not solved workplace surveillance; it has started pricing it. NSW's Digital Work Systems duty is the first statute to say the employer's monitoring software is part of the workplace the employer must make safe, and other jurisdictions are watching. Until the patchwork unifies, the practical rule for both sides is the same: if you cannot explain a monitoring practice to the person being monitored, including why its risks were assessed as acceptable, it will not survive contact with a regulator, a commission, or a jury of peers. This article is general information, not legal advice.
Sources: Work Health and Safety Amendment (Digital Work Systems) Act 2026 (NSW), Workplace Surveillance Act 2005 (NSW), current version, OAIC workplace monitoring guidance, Mapien, Workplace Surveillance in 2026, 31 March 2026. This article is general information, not legal advice.