AI Staff Surveillance: Victoria Draws the Toughest Line Yet

Victoria just promised the toughest surveillance laws in the country

Only two of Australia's eight states and territories have a dedicated workplace surveillance law. Victoria isn't one of them — which is exactly why its promise, on 20 July 2026, to legislate the toughest workplace surveillance laws in the country matters well beyond its borders. The state with the weakest statutory protection just pledged to leapfrog everyone. If you've read "no surveillance law in my state" as "no exposure", the floor is moving under you.

The Victorian proposal is specific. Employers would have to tell staff they're being monitored, consult before bringing in new surveillance, and only monitor for a legitimate purpose. Biometric data could be collected only where no less intrusive option exists, and reading emotions from it would be banned without a genuine reason. Using AI to track bathroom breaks, a limp or a pregnancy would be out. Any significant automated decision affecting a worker's rights would need a human to review it, and workers would get the right to see the surveillance data held on them. Premier Jacinta Allan's line: "No Victorian should be watched at work without knowing about it." One caveat that matters — this is an election commitment, contingent on Labor's re-election in November 2026. It is not law yet.

What already binds every Australian employer

Here's the part owners miss while they wait to see whether a bill passes: three rules already apply, in every state, whether or not your jurisdiction has a surveillance Act. The first is work health and safety. Safe Work Australia's 2026 guidance treats AI and digital technologies as a WHS matter, and the model Managing Psychosocial Hazards at Work Code names "intrusive surveillance" — keystroke logging, email and file monitoring, GPS-for-performance — as a hazard you must identify, assess and control. The second is notice, where your state imposes it: in NSW, the Workplace Surveillance Act requires at least 14 days' written notice before overt camera, computer or tracking surveillance, and the ACT adds a consultation duty. The third lands on 10 December 2026, when Privacy Act changes require covered organisations to disclose where computer programs make decisions that significantly affect someone — explicitly including AI used in recruitment, rostering, performance and monitoring.

None of this is abstract. A trades business running GPS that scores each technician's day, or a professional-services firm screen-recording and keystroke-logging its people, is conducting surveillance — and a single rollout can trip all three rules at once. Skip the notice and you've breached surveillance law; skip the risk assessment and you've breached a WHS duty; skip consultation and you've handed someone a Fair Work claim. These are the three steps every employer already owes — notice, a risk assessment, and consultation before go-live, Victorian bill or not. If you can't say how much of your current software already crosses into regulated surveillance, map where AI already touches your people before you add another tool.

The quiet cost: your best people

There's a reason to get this right beyond the penalties. The evidence on heavy-handed monitoring is unflattering — it tends to lift stress and dent job satisfaction while showing no measurable gain in output. In a labour market where a good tradesperson or a senior accountant can leave on a fortnight's notice, surveillance that reads as distrust is a retention problem you're paying to create. The firms that handle this well monitor less, not more: only what a genuine business need justifies, only as much as that need requires, and never in secret. That test — necessity, proportionality, transparency — is, not coincidentally, what every one of these laws is reaching for.

What to do about it

Don't wait for Victoria's bill, and don't wait until you're in NSW to act like you're in NSW. Treat monitoring as a project, not a settings toggle. Inventory what your existing job-management, comms and scheduling tools already capture — most owners are surprised how much is logged by default. For anything that reads as intrusive, run the psychosocial risk assessment WHS law already requires, give the written notice your state demands, and consult your team before go-live rather than after the complaints. Then hold every tool to the same three-part test the regulators keep returning to. The direction of travel is one way: more notice, more human oversight, more disclosure. Building to that standard now is cheaper than retrofitting it when the law — in your state — catches up.