Geofencing risks center on the transition from safety monitoring to intrusive surveillance, creating significant liability if location data is misused. In Australia, the WHS Act 2011 requires PCBUs to ensure site safety, while in the United States, OSHA mandates worker protection. Both jurisdictions require that safety tracking does not violate privacy laws or employment contracts.
Surveillance Without Consent Creates Legal Liability
In Australia, the WHS Act 2011 mandates that PCBUs maintain a safe workplace, which includes knowing exactly who is on site during an emergency. In the United States, OSHA regulations require similar safety oversight, though employers must navigate state-specific privacy laws and the CCPA regarding the collection of precise geolocation data. In our work with Australian and US organisations, we have found that the legal risk increases when “safety tracking” begins to look like “performance monitoring.”
Automatic Tracking Isn’t a Substitute for Consent
Many organisations implement geofencing to solve the problem of staff forgetting to sign in, but they fail to define the boundary between site safety and personal privacy. When location data is captured without strict parameters, it ceases to be a safety tool and becomes a surveillance liability.
- Tracking staff members after they have exited the defined geofence or outside of contracted work hours.
- Allowing unauthorized personnel to access location reports, rather than restricting access to designated safety administrators.
- Using real-time occupancy data to monitor employee movement for productivity rather than for muster point verification.
- Failing to provide manual alternatives for staff who opt out of smartphone-based geolocation tracking.
Privacy-First Occupancy Tracking
A professional visitor management system closes the gap by tying geolocation strictly to site occupancy and emergency response. This ensures that data is captured for the sole purpose of generating a real-time evacuation report during an incident.
- Utilising ISO 27001 certified infrastructure to ensure data is sent directly to secure servers without third-party processing.
- Implementing strict role-based access control so only authorised users can access reports and occupancy data.
- Establishing automatic data deletion schedules to ensure location history is not retained longer than necessary for compliance.
- Defining precise geofence boundaries that trigger automatic sign-in and sign-out events only at the perimeter of the designated work location.
Time and People: Visitor Management That Works When It Has To
For over 12 years, we have helped organisations across Australia and the United States convert complex compliance obligations into reliable, cloud-connected visitor management infrastructure. We’ve found that the most secure sites are those that balance automated efficiency with rigid data privacy standards, such as ISO 27001 certification. We focus on the technology that ensures every person on site is accounted for, so your team can focus on the people they are protecting.
Content prepared by Time and People — visitor and contractor management across Australia and the United States.