With more employees working from home, more employers have been using surveillance to keep tabs on what they are doing. Workplace surveillance can include computer monitoring, GPS tracking, video surveillance and call recording - all of which have the potential to capture employees' private lives. Australian privacy law, by way of the Privacy Act, was first legislated in 1988 - before home internet access, let alone mobile phones. While the Act has been updated in the interim, it still grapples to adequately protect the privacy of modern Australian workers.

For starters, Australian privacy law doesn't cover workplace surveillance and, as such, the extent of surveillance that an employer can engage in will vary from state to state. Having state-based laws for workplace surveillance doesn't make sense when many employers operate nationally, and many employees travel inter-state for work. State-based laws are also particularly complex at a time when many employees are opting to work remotely from a state in which they are not technically employed.

While there are some protections in Australian privacy law regarding the circumstances in which employers can demand private information from their employees, these protections are being eroded in response to the pandemic.

Mid-last year the Fair Work Commission upheld the dismissal of an employee who, in the lead up to the pandemic being declared by the WHO, refused to provide details of his personal travel history and future travel plans to his employer.

The employer asserted that it required such information to manage the risk of COVID-19. The employee refused on the basis the demand breached Australian privacy law, pointing out he hadn't taken leave recently and therefore could not have been overseas (this occurred before community transmission of COVID in Australia).

But the Commission concluded the employer's direction to provide personal travel information was lawful and, by refusing, the employee had engaged in misconduct justifying his dismissal.

In doing so, the Commission essentially activated a loophole in Australian privacy law on the basis that the employer's actions were justified by the pandemic. The Commission's decision raises legitimate questions about how far employers can go in demanding details of their employees' private lives under the guise of the pandemic.

If your boss can ask for travel information, why not information about what cafes/restaurants/pubs/weddings/houses/bedrooms you've been in? And, while they're at it, why not collate information about whom you were with at these places. This begs the bigger question - are such actions by employers justified in the context of the pandemic, or do our privacy laws need amending?

Australian privacy laws are also deficient when it comes to protecting the personal information of employees held by their employers - such as copies of employees' vaccination certificates, which many have been requiring. Examples of other personal information employers regularly hold include addresses and phone numbers.

If you use an employer-provided mobile phone or laptop for personal matters, chances are your employer will have access to more personal information than you'd like - such as your bank login, fingerprint and Face ID.

Many employees are also directed to attend medical assessments during or prior to their employment, which can result in their employers possessing their blood, urine, saliva and stool samples as well as the abundance of sensitive information which can be obtained from them.

Should employees' personal information not be properly stored and protected by employers, employees not only risk such information being used for purposes they wouldn't consent to but also risk being the victim of identity theft and financial crime.

Many Australians would be unaware small businesses (with a turnover of less than $3 million per year) are exempt from Australian privacy laws, as are large private businesses when it comes to employee records.

This means that, unless you work in the public sector or your employer is using your information for a purpose unrelated to your employment, Australian privacy law does not offer any protections.

In the coming weeks and months, a number of cases are expected to be filed by workers and unions challenging employers' rights to mandate vaccines. The first was filed by the CFMMEU against BHP last week. These cases will have implications well beyond vaccine mandates.

A line is about to be drawn by Australian courts and tribunals as to the precise circumstances in which employers can command their employees' health decisions.

Instead of turning a deaf ear, this could be an opportunity for all workers to think more broadly on what personal information their employer holds about them and what their employer can do with that information.

Vaccine mandates aside, now is the time to have your say about where the line between your personal and work life should be drawn.