Alana (not her real name) says she was horrified when her boss shared her private medical information with a room full of strangers and other people working in her industry .
Experts say confusing and complicated privacy laws make it hard to define whether acts like this are illegal and even harder to challenge them.
Alana lives with postural orthostatic tachycardia syndrome (POTS), a blood circulation disorder that causes her fatigue and regular fainting episodes.
In August, she was fainting three to four times a day at work. She got used to putting her head down at her desk or sitting on the floor for a couple of minutes while she waited out each episode.
Believing it would be best to alert her boss and manager about what was causing her to faint so often, Alana organised a meeting.
She says she was still performing well in her role but she chose to disclose her condition believing it could be "alarming" for her managers to witness an episode without understanding what was behind it.
Recent research from Diversity Council Australia found around a third of people with disability choose not to share that information with their employers. Source: Getty / Maskot
"I argued that it was and then the advice was: 'Well, don’t tell anyone else in the office. They don’t really need to know this.' That was a weird first conversation," she said.
Then in September, Alana was sitting in a forum hosted by her boss, with around 40 people, including others working in the same field and members of the public.
The forum was focused on the experience of people living with disability and Alana was shocked when her boss said that she understands what the experience of living with a disability is like, referring to Alana’s POTS diagnosis and gesturing towards her.
While Alana says she’s not ashamed of her diagnosis, she understands how close-knit her industry is and she’s worried about the possibility of being discriminated against in future workplaces.
"While I try and self-manage as much as I can, those symptoms are going to be hard. And so, especially in such a public forum where there were people who worked (in my industry) and all that sort of stuff, I felt quite unsafe in that moment," she said.
"I think it was a flippant comment, it was not something she would have even thought about twice — but it really had an impact on the way that I thought other people saw me at that point."
Alana, 20, says she feels unable to advocate for herself in her workplace and she feels used to diminishing her feelings because she doesn’t want to "make a fuss".
The experience has impacted how she feels about staying in her industry in the long-term.
LISTEN TO
Is somebody watching me? Data breaches put spotlight back on digital privacy
SBS News
25/07/202405:53
"If you can’t trust people not to disclose personal medical information that I didn’t consent to being out there and if that can be issued so freely to a group of 40 strangers then yeah, it’s worrying."
'Piecemeal' privacy laws
Experts have pointed out issues with Australia’s privacy laws that make it "incredibly difficult" for people to pursue action against employers who may have breached their privacy.
Information about a person’s health, sexuality, religious beliefs, criminal record, professional, or trade union memberships are considered sensitive personal information under the Privacy Act, which sets out rules and standards for how this information is collected and handled.
Complaints about how an organisation or agency handles personal information can be submitted to the Office of the Australian Information Commissioner (OAIC).
However, privacy protection for employees can be patchy.
According to the federal legislation, a private employer’s handling of employee information is exempt from the Privacy Act if it relates to the employment relationship and an employee record held by the organisation about the worker.
An employee record is defined as a "record of personal information" including health information, contact details, bank details, salary, sick leave, and tax details.
Associate professor Alysia Blackham, an employment law researcher from Melbourne Law School told SBS News that means there is a "massive gap" in how privacy regulation is framed when it comes to employee information.
In a recent paper, Blackham pointed to the OAIC's decision not to investigate one employer who allegedly accessed and used an employee’s personal emails and passwords on a work laptop because the laptop and its contents were seen as falling within the employee records exemption.
Businesses with an annual turnover of under $3 million a year are also excluded from federal privacy law, except for some like those that provide health services or contractor service providers for the Australian government.
According to data from the Australian Bureau of Statistics, 91.9 per cent of businesses had turnover of less than $2 million in the 2022-23 financial year, making the vast majority of businesses exempt from the federal privacy law.
Blackham says that while federal law may not cover the release of sensitive personal information, it may be covered by other state or territory legislation.
For example, Victoria’s Health Records Act sets out Health Privacy Principles that cover employee personnel records.
There are also other ways sensitive employee information may be protected.
"It might be a breach of the term of your employment contract, for example, to release the information or a term of an enterprise agreement, for example," Blackham said.
"But the piecemeal nature of this, that you'd have to look into all these details on a case-by-case basis, makes it really difficult. Most people don't want to go read enterprise agreements and employment contracts."
The complexity of disclosing private health information with a workplace is reflected in recent research from Diversity Council Australia (DCA), which found around a third of people with disability choose not to share that information with their employers.
Of those who choose not to share their disability status, 35 per cent said they did not share it out of fear of being seen less favourably by managers or being overlooked for promotion, 33 per cent said they didn’t trust sharing would result in a positive outcome and 39 per cent said they were concerned about privacy and how the information would be used.
Anti-discrimination law, as well as workplace health and safety laws, including new laws that cover psychosocial risk such as job demands, bullying and poor support in workplaces may cover these issues but Blackham says it’s tricky overall for employees to pursue action against employers who may have breached privacy.
"One of the real challenges in this area is that we have different rights under labour or employment law, under discrimination law, under privacy law and often they are pursued in different avenues," she said.
"It's incredibly difficult to challenge that practice and it's incredibly difficult to know what your rights are and to assert your rights."
While the Fair Work Ombudsman sets out best practice guidelines for privacy for employers and managers, these are non-enforceable.
The federal government is currently considering amendments to the Privacy Act, including changes to civil penalties for interference with privacy and enforcement.
However, changes to the employee record exemption aren’t part of the proposals.
Legal recourse
Alana is not alone in her experience of having personal information shared by an employer without consent — nor in her apprehension to seek legal recourse for what happened to her.
Jenna (not her real name) lives with a chronic health condition and worked in a government department for 20 years.
She says after she disclosed her condition to management due to multiple surgeries and hospitalisations, one of her team leaders would loudly discuss the condition at her desk in an open-plan office.
Jenna repeatedly asked the manager to stop because she didn’t want her private medical information to spread among colleagues — but the behaviour didn’t stop.
Jenna says it was part of a pattern of bullying behaviour from that manager and described the choice to share her private information as a "power play".
After quitting the job due to what she described as a "mental breakdown" Jenna says she felt too exhausted and didn’t fully understand her rights, so she didn’t pursue legal action.
Founder of Chronic Illness at Work Michelle Irving recommends workers make a number of considerations before disclosing medical information to employers. Credit: Supplied by Michelle Irving
Jenna now works as a disability inclusion consultant and says she sees how vulnerable people living with chronic physical disabilities and mental health conditions are in the workplace.
"I let so much happen to me that like, if it was me no there’s no way in hell I would allow someone to put up with that kind of thing," she said.
LISTEN TO
Hysterical: 'Push through' or quit: The choice facing women with chronic pain in inflexible workplaces
SBS News
11/09/202417:57
Avinash Singh is the principal lawyer at Astor Legal. He told SBS News stories like Alana and Jenna's are common and he receives one to two inquiries a week from employees who believe they have had their confidentiality breached.
However, Singh says many employees or ex-employees do not have the resources to pursue civil action against an employer.
"Unfortunately, the sticking point is generally going down the path of commencing legal proceedings. That tends to be a big hurdle to a lot of people," he said.
When to disclose
Stigma, discrimination, and privacy considerations make disclosing a chronic illness or disability a fraught decision in workplaces.
Michelle Irving, founder of consultation and education company Chronic Illness at Work, says that because of this, many people with chronic conditions will actively try to manage the visible presentations of it.
"That’s not great for them and that’s not great for companies," Irving said.
Irving's personal medical information was shared without consent in a workplace earlier in her career.
Living with an autoimmune condition that affected her liver, Irving disclosed her medical information to her manager at the time. Later, an executive assistant confronted her at her desk in their open plan office asking if Irving if she was "an alcoholic".
"Firstly, it was deeply shocking. Secondly, it was frightening because suddenly I had shared this incredibly sensitive information about a life-threatening experience I was having," Irving said.
Now, Irving encourages her clients to take specific steps before disclosing medical information to managers, including first establishing with management that they are looking to have a serious medical conversation, having a strong understanding of the outcomes they are looking for and checking the disability and privacy policies of an employer.
CEO of Diversity Council Australia Lisa Annese told SBS News that when it comes to disclosure, she wants to see a reframing so that employers see the benefits of becoming more agile and flexible to worker needs, which naturally change over a person’s lifetime.
Annese said managers need to understand that "people aren’t robots" and making accommodations for individual needs can build a more loyal workforce.
Irving said that within workplaces, she has seen what she calls "chronic confusion" about how to treat sensitive personal information and so encourages people leaders to treat information about chronic medical or mental health conditions "as sensitively as they would a domestic violence disclosure".
"It’s not to appropriate that process but it is to say we know how to contain deeply sensitive information in an appropriate way, to make adjustments in a working environment without disclosing".
