Online workplace conduct and psychosocial risk

Conduct problems in work-controlled digital channels are rarely the work of one badly behaved person. Three things operate together: how the channel is configured, how the work is designed and what standard of behaviour is applied. An employer addressing only the third will meet the same pattern in another team.

Channel design decides who can see what, whether a message arrives at eleven at night, whether a group chat has an accountable owner and whether a thread can be quietly edited. Work design decides whether six people cover fourteen hours of demand and whether escalation depends on one person's phone. Conduct standards decide what happens when someone is repeatedly cut out of a channel.

A review should therefore examine settings, staffing and workflow before personalities, and keep three questions apart: whether the contact was lawful, whether an employee's refusal to respond would be unreasonable, and whether the pattern creates a risk to psychological health. Those questions come from different sources of law, and collapsing them produces poor decisions.

Work health and safety. In jurisdictions adopting the model work health and safety laws, the enacted Act requires a person conducting a business or undertaking to eliminate risks to health and safety so far as is reasonably practicable and, where that is not reasonably practicable, to minimise them. The current model WHS Regulations provide the national model provisions for managing psychosocial risks, but state that they do not of themselves have legal effect: the regulations enacted in each adopting jurisdiction give them force, and it is that enacted law which must be checked. Safe Work Australia's model Code of Practice: Managing psychosocial hazards at work provides national model guidance on identification, assessment, control and review; check the enacted law and status of any approved code in the applicable jurisdiction. Victoria is not a model WHS jurisdiction: duties sit under the Occupational Health and Safety Act 2004 (Vic), and the Occupational Health and Safety (Psychological Health) Regulations 2025, in force from 1 December 2025, impose their own identification, control and review requirements. Use WorkSafe Victoria's compliance material for the Victorian position, not model-WHS wording.

Right to disconnect. Sections 333M to 333Q of the Fair Work Act 2009 (Cth) give an employee a workplace right to refuse to monitor, read or respond to contact, or attempted contact, from an employer or a third party outside the employee's working hours, unless the refusal is unreasonable. It now applies to employees of small-business employers as well. The Fair Work Ombudsman's guidance sets out the statutory factors relevant to reasonableness.

Bullying, harassment and discrimination. The Fair Work Act anti-bullying jurisdiction turns on repeated unreasonable behaviour towards a worker, or group of workers, that creates a risk to health and safety; the Fair Work Commission's guidance explains what that does and does not cover. Discrimination, sexual harassment, sex-based harassment, hostile-environment conduct on the ground of sex and victimisation each have separate statutory tests. They can overlap in one chat thread, but are not interchangeable.

Instruments, contracts and policies. An award or enterprise agreement may contain a right-to-disconnect term, availability and on-call arrangements, overtime and recall provisions and dispute procedures. Contracts, codes of conduct, acceptable-use and remote-work policies add more. These operate alongside statutory duties, and inconsistent drafting causes avoidable dispute.

Privacy and surveillance. Collection, use and disclosure of communications data may be governed by one or more of the Privacy Act 1988 (Cth) and Australian Privacy Principles, State and Territory workplace-surveillance or workplace-privacy statutes, surveillance-device laws and health-records legislation, together with any applicable instrument, contract or policy. Not all apply to every employer, worker, record or jurisdiction, so identify which do before acting.

The matrix below is a starting structure, not a finding. Test each row against the actual configuration, workload and reported experience of the team, and review when the work changes.

Controls relying on individual coping — resilience sessions, etiquette reminders, an employee assistance service — may have a place, but sit below work design, staffing, workflow, escalation rules and system settings. Where a higher-order control is reasonably practicable or required, an awareness measure is unlikely to satisfy the duty. The general cycle is covered in our briefing on psychosocial risk management.

The statutory right does not make out-of-hours contact unlawful or stop an employer sending a message. It protects the employee's refusal to monitor, read or respond outside working hours, unless that refusal is unreasonable. The analysis is about the refusal, not the sending.

Reasonableness is assessed against factors including the reason for the contact, how it is made and the disruption caused, whether the employee is compensated for availability or additional hours, the nature of the role and level of responsibility, and personal circumstances including caring responsibilities. Any right-to-disconnect term in an applicable award or enterprise agreement is also relevant.

Keep the right separate from questions it is often confused with: maximum weekly hours; overtime, recall and on-call entitlements under an instrument or contract; record-keeping obligations; and whether the contact pattern creates a psychosocial risk requiring control. An arrangement can be lawful in employment terms and still need safety controls.

Make contact deliberate. Define what genuinely needs an out-of-hours response, who is rostered and paid to provide it, and by which route; send everything else with delayed delivery or hold it to the next working period. Tell third parties which route to use, then check what happens.

One abrupt message is not workplace bullying, and treating it as though it were makes the response harder to defend. The Fair Work Act formulation requires repeated unreasonable behaviour towards a worker or group of workers creating a risk to health and safety; reasonable management action carried out in a reasonable way is not bullying, even when unwelcome.

That does not make isolated conduct irrelevant. A single act may require action in its own right — a discriminatory remark, an act of sexual harassment, a threat. What converts persistent rudeness into a psychosocial risk requiring control is the combination of frequency, duration, severity, context, work design and cumulative exposure, particularly where a worker cannot avoid the channel and has no escalation route.

Exclusion deserves attention online because it is easy to achieve and easy to deny. Removing someone from a channel, running a parallel chat carrying the real decisions or withholding meeting links can affect health and safety, and may engage anti-discrimination duties where it tracks a protected attribute.

Classify before responding: what is the conduct alleged to be, which duty does it engage, what test applies, and what must the employer do irrespective of outcome. Our briefing on managing workplace complaints covers the process itself; conduct on personal or public accounts is dealt with in employee social-media conduct.

Digital material looks reliable and often is not. Screenshots can be cropped, edited or assembled from different conversations; messages edited or deleted afterwards; retention settings may purge a channel within thirty days; and timestamps may display in the reader's time zone.

Preserve first. When a concern is raised, take prompt, lawful and technically available steps to preserve relevant material within the employer's control, pausing routine deletion and retention processes for the relevant accounts and channels so far as the systems and applicable law allow, and record what was done and when. An employer cannot override a provider's systems, another person's rights or the law, so note what could not be preserved. Take the record from the source system rather than a party's screenshots.

Test authenticity and completeness before concluding. Compare screenshots against system exports; look for gaps, edits and deletions rather than assuming their absence; capture the full thread rather than extracted lines; identify who else was in the channel; and confirm how times display.

Control access. Hold material on a need-to-know basis, record who has it and keep exports away from managers with no role in the matter. Confidentiality has limits; explain them rather than promising anonymity. Identity is often obvious from the content, and a person facing adverse material must have a fair opportunity to answer its substance.

Keep roles clear. An internal fact-finder ordinarily makes findings of fact and, where asked, on policy compliance; determining statutory liability is not their function. A finding that an allegation is not substantiated means the evidence did not establish it on the applicable standard — not that the complaint was fabricated, and treating it that way may create victimisation or adverse-action risk, depending on the complaint, conduct and governing law.

Employers often assume that because the business owns a system, anything in it can be collected, read and used. That assumption is unsafe. Before collecting or using communications data, identify the lawful authority and the requirements attaching to it under the privacy, workplace-surveillance, surveillance-device and health-records laws applying in the relevant jurisdiction, together with any applicable instrument, contract and policy.

The rules differ by jurisdiction. New South Wales regulates computer, camera and tracking surveillance at work under the Workplace Surveillance Act 2005 (NSW), including notice requirements and constraints on covert surveillance. The Australian Capital Territory has its own scheme under the Workplace Privacy Act 2011 (ACT). Other jurisdictions regulate particular devices and practices differently, so a policy written to one State's rules will not do the work elsewhere.

The federal employee-records exemption is narrower than often described. As the OAIC explains, it applies in certain circumstances to an act or practice directly related to a current or former employment relationship and to an employee record the organisation holds about that individual. It is not a general licence covering every message in a mailbox, records about contractors or prospective workers, or a provider's own handling of data. Assess case by case.

Two lines should not be crossed: do not access private accounts or personal devices without a clear lawful basis and proper authorisation, and do not present covert access as routine administration. Where personal devices are used for work, state what may be collected, when, and what happens on separation.

Collect the minimum necessary for a stated purpose, give notice in the terms the applicable law requires, restrict and log who can run searches, apply retention periods, and check before using data gathered for one purpose in another.

Defaults carry more weight than reminders. Quiet-hours and delayed-send settings, notification behaviour outside rostered hours, whether private meeting chat is enabled, who may create or archive a channel and recording settings each shape behaviour continuously.

Manager practice does the rest. Give criticism in a direct conversation, not a shared thread. State deadlines and the decision required. Do not use wide copy lists to apply pressure. Notice when one person sits outside the channel where decisions are made, and model the out-of-hours behaviour you expect.

Consultation with workers and health and safety representatives is part of the risk-management cycle and often surfaces what system data cannot. It is one input among several — with incident and complaint data, workload analysis and configuration review — not the only source.

An operations team of eleven supports customers across three time zones. Two members in Perth routinely receive messages between 8.00pm and 11.00pm local time from Auckland colleagues working ordinary hours. Some concern genuine incidents; most are status updates. Nobody is on call and no availability allowance is paid. Both have raised fatigue.

Three questions arise. Is the contact lawful? Out-of-hours contact is not prohibited. Would a refusal to monitor, read or respond be unreasonable? Those facts — no compensation for availability, non-supervisory roles, mostly non-urgent traffic — may support the reasonableness of refusing routine contact, but all the statutory factors, any legally required contact and the applicable award, agreement or contract must be checked before a conclusion is reached. Genuine incident contact stands differently, and a paid on-call arrangement would change the assessment. Is there a psychosocial risk requiring control? Repeated evening interruption with no protected recovery period, no rostered coverage and no escalation criteria points to a job-demands and working-time hazard regardless of the second answer.

The response addresses design, not individuals. Define what constitutes an incident requiring an out-of-hours response and route it through a documented escalation path with rostered, paid coverage. Set delayed-send defaults for cross-time-zone teams. Record the change, consult affected workers and any health and safety representative, and review after a set period.

A worker reports that over four months she has twice been removed from a project chat, that a parallel chat carries the real decisions, that her contributions attract mocking reactions, and that a colleague posted a comment about her accent. She provides four screenshots; the retention setting deletes messages after ninety days.

Preservation comes first: pause deletion for the relevant channels and accounts so far as the systems allow, export the complete threads, and record what was preserved and when. Compare the screenshots with the export and confirm time-zone display. Interim measures are risk controls, not findings: restore her channel access, appoint an accountable channel owner, adjust reporting lines if necessary, and record a reason and review date for each.

Then select the pathway on the classified conduct. The exclusion pattern and reactions may engage the repeated-unreasonable-behaviour framing and the safety duty; the accent comment raises a distinct anti-discrimination question. Facilitated resolution may be considered only where appropriate on the facts, having regard to the affected person's wishes, seriousness, safety, power imbalance, recurrence and any governing process; it does not replace fact-finding or other action where required, and statutory and safety duties continue to apply. Do not fix the pathway merely because an allegation is racially framed, and do not signal an outcome. If fact-finding is required, put sufficiently particularised allegations to the respondent, give a fair opportunity to answer the substance of adverse material, and use a decision-maker who can approach the matter fairly and without a disqualifying conflict — internal, or external depending on seniority, sensitivity and any governing instrument.

Australian Workplace Strategies helps employers map duties across digital channels, review configuration and work design against psychosocial risk, and settle out-of-hours contact arrangements that hold in safety and employment terms. We conduct and quality-review workplace investigations involving digital evidence, support psychosocial safety programs, provide advisory input and deliver manager training. We do not provide legal representation.