Employers: think carefully before you decide to collect employees' DNA data - DPP1(1).
The Complaint
What were believed to be menstrual bloodstains were found in the female toilet of a company. Suspecting that the bloodstains had been left by one of its female employees, and to deter any recurrence of such inconsiderate behaviour, the management of the company required all female staff to submit to a DNA test. It was intended that the test results would be matched against the sample bloodstains found in the toilet with a view to positively identifying the employee involved. Feeling humiliated by the employer's decision to collect DNA samples, one employee filed a complaint with the PCPD.
Findings of the Privacy Commissioner
The issue in this case was whether the collection by the company of the DNA data of its employees was excessive under the circumstances. The Privacy Commissioner took the view that it would be highly invasive of privacy to identify an individual by examining unique DNA data. The Privacy Commissioner held that the collection and use of DNA data was only justifiable in serious circumstances e.g. a criminal investigation. The collection of DNA data by the employer, solely for the purpose of ensuring hygienic conditions in the female toilets, was not justified as being either necessary or reasonable. The company was found to have contravened DPP1(1) by collecting excessive personal data of its employees.
Action by the Privacy Commissioner
An enforcement notice was is sued against the company. As a result of that notice the collection of DNA samples was immediately stopped. In addition, those DNA samples or reports that had been collected by the company were destroyed.