AI Staff Monitoring: 'They Consented' No Longer Protects You

The consent you're relying on is about to stop working

If you track your staff with AI — GPS that scores each technician's day, productivity software that logs keystrokes, an algorithm that rosters and ranks — the legal ground under you is shifting. The defence most employers lean on is a line in the employment contract. A new report says that line is close to worthless.

On 20 October 2026, the University of Technology Sydney's Human Technology Institute released its "Drawing the Line" report on worker surveillance. Co-Director Edward Santow's verdict: "Our laws are dangerously out of date." The headline recommendation is that the Fair Work Act be amended so that any monitoring of workers must be "fair and reasonable" — the same standard the Privacy Act is moving toward for personal information.

The report's sharpest point is about consent. Employers typically rely on a worker "agreeing" to monitoring when they sign on. As HTI's Sarah Sacher put it: "we all know that's not real consent" — a person who needs the job can't meaningfully negotiate what surveillance is reasonable. Strip that away and the question stops being "did they sign?" and becomes "can you show this monitoring is fair, necessary and proportionate?" Most Australian SMEs can't, because they never wrote it down.

What the report wants — and what's already law

The HTI makes four recommendations: amend the Fair Work Act to require monitoring to be fair and reasonable; let modern awards and enterprise agreements build on that floor; create a dedicated Fair Work Commission complaints stream for privacy-related complaints; and have regulators publish practical guidance on applying the rules. These are proposals, not law yet — but they signal the direction, and one state has already moved.

In New South Wales, algorithms, AI and automated platforms are now a work-health-and-safety duty under the Digital Work Systems Act — the first law of its kind in Australia, with penalties that run into the millions for employers whose scheduling or monitoring tools create excessive workloads or unreasonable performance pressure. Victoria has committed to its own surveillance laws. The federal privacy reforms add a layer on top. The trajectory is one way: more transparency, more human oversight, less tolerance for watch-everything-by-default.

What it means for an Australian business

The exposure is bigger than most owners think, because a single rollout touches several regimes at once. Switch on intrusive monitoring without notice and you've breached state surveillance law where it applies. Skip the risk assessment and you've breached a WHS psychosocial-hazard duty. Skip consultation and you've handed someone a Fair Work claim. From 10 December 2026, if a computer program makes or substantially shapes a significant decision about a worker, the Privacy Act requires you to disclose it. Four obligations, one unconsidered settings toggle.

This bites hardest in exactly the businesses adopting AI fastest. A trades firm whose job-management platform tracks completion times and utilisation rates is monitoring its people, whether or not it calls it that. A professional-services firm running screen-recording or keystroke logging to measure billable output is doing the same. The tools arrive switched on; the obligations arrive regardless. If you can't say how much of your current software already crosses into regulated surveillance, map where AI already touches your people before you add another tool.

Build the policy before you need the defence

The answer isn't to stop monitoring — it's to monitor in a way you can defend. That means a written AI-monitoring policy, and it's a short document, not a legal epic. Six things make it hold up against a "fair and reasonable" test: a specific, legitimate purpose for each tool (safety, billing accuracy — not "because we can"); the least intrusive method that achieves it (sampling over always-on recording); plain-language transparency about what's collected and who sees it, given before go-live; data minimisation and a deletion schedule; human review of any consequential decision, so the algorithm never fires or disciplines someone on its own; and a named complaints path — the exact mechanism the HTI wants legislated, which you can simply have already.

That policy is also the evidence you did the three steps every employer already owes — notice, a risk assessment, and consultation before go-live. Build it once and it scales as you add tools, instead of a fresh scramble each time a vendor switches on a new feature. The firms that write this down now are buying cheap insurance against a standard that is visibly rising.