NCAT Finds Internal Recruitment Checks Unlawfully Exposed Transgender Employee to Privacy Risk

| October 19, 2026

A recent decision of the New South Wales Civil and Administrative Tribunal (NCAT) highlights the discrimination risks that can arise when recruitment and onboarding processes unnecessarily expose sensitive personal information.

For employers, the decision is a reminder to review how employee information is collected, verified and shared, particularly where access to that information could expose employees to discrimination or unwanted disclosure of personal circumstances.

Background

In HGY v Secretary, Ministry of Health in respect of Northern NSW Local Health District [2026] NSWCATAD 278, NCAT upheld a complaint that NSW Health’s internal recruitment processes unlawfully discriminated against a transgender employee.

NCAT ordered NSW Health to pay the applicant $35,000, comprising $25,000 for non-economic loss and $10,000 in aggravated damages.¹

The applicant was a transgender man who had legally changed his first and middle names in 2012. When initially recruited by NSW Health, he disclosed his former names for identity verification, Working With Children and police checking purposes.²

Several years later, while applying for an internal role, he discovered that the recruitment process required his former names to be disclosed and verified again.

The applicant was concerned that disclosing this information to hiring managers and colleagues could reveal that he was transgender and expose him to the risk of being involuntarily “outed” in the workplace.³

After unsuccessful attempts to resolve the issue internally, he lodged a complaint alleging indirect transgender discrimination under the Anti-Discrimination Act 1977 (NSW).

The use of a transgender person’s former name is commonly referred to as deadnaming, with the former name sometimes called a deadname. Disclosure of a former name may also reveal a person’s transgender status without their consent, highlighting the importance of handling sensitive identity information carefully.

Understanding Indirect Discrimination in the Workplace

Indirect discrimination can occur when an employer imposes an apparently neutral requirement or condition that disproportionately disadvantages people with a protected attribute and is not reasonable in the circumstances.⁴

In this case, the relevant protected attribute was transgender status.

Other protected attributes under applicable discrimination legislation can include age, sex, race, religious belief, disability, relationship status and family responsibilities.

Importantly, a workplace process can be discriminatory even when the same requirement applies to all employees.

A requirement that appears neutral may nevertheless create a disproportionate disadvantage for a particular group, particularly where a less discriminatory alternative is available.

What NCAT Decided

NCAT upheld the applicant’s complaint, finding that NSW Health’s internal recruitment process constituted indirect discrimination on transgender grounds.

The Tribunal found that:

• Disclosure of the applicant’s former names would likely reveal that he was transgender.⁵
• Compliance with the recruitment requirement created a genuine risk of involuntary disclosure of his transgender status.⁶
• Many transgender employees would experience fear, distress and disadvantage when required to comply with the process.⁷
• Most cisgender employees would not experience comparable disadvantage.⁸
• A less discriminatory alternative was available through centralised HR or recruitment verification rather than disclosure to hiring managers and local workplace staff.⁹

NCAT placed significant weight on evidence that the relevant verification process could be completed through a centralised People and Culture or recruitment function with minimal administrative burden.

NSW Health’s own policies also contemplated centralised checking processes, supporting the availability of a less discriminatory alternative.¹⁰

The decision does not suggest that identity verification, police checks or other legitimate screening processes are inherently discriminatory. Rather, the issue was how those checks were conducted and who was given access to sensitive information.

Why Confidentiality Policies Were Not Enough

NCAT was not persuaded that existing confidentiality obligations, workplace policies and employee training adequately addressed the discrimination risk.

The Tribunal considered that these safeguards did not remove the disadvantage created by unnecessarily disclosing sensitive information in the first place.¹¹

This distinction is important for employers. Protecting personal information is not only about preventing unauthorised access or breaches of confidentiality. It also involves determining whether particular employees or managers need access to the information at all.

Understanding Deadnaming and Workplace Privacy

Deadnaming generally refers to using a transgender person’s former name, particularly a name they no longer use following a transition.

For some transgender employees, disclosure or use of a former name may reveal their transgender status without their consent, potentially causing distress or exposing them to discrimination.

Employers may have legitimate reasons to retain historical names for identity verification and compliance purposes. However, access to that information should be limited to those who genuinely need it.

The distinction is between retaining information for a lawful purpose and unnecessarily disclosing it during everyday workplace processes.

What This Means for Employers

Recruitment, onboarding and employee record systems often contain sensitive personal information for legitimate compliance and risk management purposes, including former names, aliases and identity changes.

Organisations generally focus on collecting and storing that information securely. However, this decision demonstrates that equal attention should be given to who can access it and whether that access is necessary.

NCAT also considered evidence concerning employees who may have changed their names for safety reasons, including family and domestic violence victim-survivors.¹²

Although those circumstances were not the focus of the proceedings, the decision highlights broader privacy and discrimination risks associated with collecting and sharing historical identity information.

Employers should therefore consider whether apparently neutral administrative requirements disproportionately affect employees with protected attributes and whether the same legitimate objectives could be achieved through less intrusive processes.

Practical Steps for Employers

1. Review Access to Sensitive Identity Information

Assess who can access former names, aliases and other sensitive personal information.

Consider whether access is limited to those with a genuine operational need or whether managers and colleagues are receiving information that could be handled elsewhere.

2. Centralise Verification Processes Where Possible

Where appropriate, identity verification and historical name checks should be managed by a dedicated HR, People and Culture, recruitment or compliance function.

Separating sensitive verification tasks from hiring managers may reduce unnecessary disclosure while allowing employers to meet legitimate screening requirements.

3. Audit Internal Recruitment Processes

Review internal mobility and recruitment systems to determine whether:

• Former names are repeatedly verified after already being validated.
• Recruitment systems automatically disclose sensitive information to managers.
• Existing checks continue to serve a legitimate operational purpose.

4. Strengthen Privacy Governance

Privacy protections should extend beyond data security.

Employers should ensure that access controls are appropriately restricted, sensitive information is shared on a need-to-know basis and recruitment personnel understand their confidentiality obligations.

5. Assess Indirect Discrimination Risks

Review workplace policies and administrative processes that may appear neutral but create disproportionate disadvantages for employees with protected attributes.

Consider whether alternative processes could achieve the same business objective with less discriminatory impact.

6. Handle Employee Complaints Carefully

The Tribunal was critical of aspects of the employer’s handling of the applicant’s concerns and the conduct of the proceedings.

Employers should ensure workplace complaints are addressed appropriately, responses are accurately documented and communications remain respectful and evidence-based.

Conclusion

The NCAT decision does not prevent employers from conducting identity checks, police checks or other legitimate recruitment screening processes.

Rather, it reinforces the need to consider not only the purpose of a workplace process but also its practical impact on employees.

Where sensitive information can be handled in a way that achieves the same business objective while better protecting employee privacy and dignity, employers should consider adopting that approach.

Proactively reviewing recruitment, onboarding and people-management systems can help reduce discrimination risks and protect both employees and organisations.

Need Support With Recruitment Policies or Workplace Discrimination?

IRiQ Law assists employers with reviewing recruitment and onboarding practices, strengthening workplace policies and managing discrimination risks.

For practical advice on ensuring your workplace processes meet legal obligations, contact our team.