The Australian Law Reform Commission is inquiring about privacy law in the digital age. I support the establishment of a statutory cause of action for serious invasion of privacy. This is my submission to the Law Reform Commission in response to its discussion paper.
A statutory cause of action for serious invasion of privacy should be contained in a new Commonwealth Act (the new Act).
I support the establishment of a statutory cause of action for serious invasion of privacy.
The cause of action should be described in the new Act as an action in tort.
I agree with this proposition.
First element of action: The new tort should be confined to invasions of privacy by:
intrusion upon the plaintiff’s seclusion or private affairs (including by unlawful surveillance); or
misuse or disclosure of private information about the plaintiff (whether true or not).?
I have nothing to add.
Second element of action: The new tort should be confined to intentional or reckless invasions of privacy. It should not extend to negligent invasions of privacy, and should not attract strict liability.
I have nothing to add.
The new Act should provide that an apology made by or on behalf of a person in connection with any invasion of privacy alleged to have been committed by the person:
does not constitute an express or implied admission of fault or liability by the person in connection with that matter; and
is not relevant to the determination of fault or liability in connection with that matter.
Evidence of an apology made by or on behalf of a person in connection with any conduct by the person is not admissible in any civil proceedings as evidence of the fault or liability of the person in connection with that matter.
Third element of action: The new tort should only be actionable where a person in the position of the plaintiff would have had a reasonable expectation of privacy, in all of the circumstances.
The new Act should provide that, in determining whether a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances, the court may consider, among other things:
the nature of the private information, including whether it relates to intimate or family matters, health or medical matters, or financial matters;
the means used to obtain the private information or to intrude upon seclusion, including the use of any device or technology;
the place where the intrusion occurred;
the purpose of the misuse, disclosure or intrusion;
how the private information was held or communicated, such as in private correspondence or a personal diary;
whether and to what extent the private information was already in the public domain;
the relevant attributes of the plaintiff, including the plaintiff’s age and occupation;
whether the plaintiff consented to the conduct of the defendant; and
the extent to which the plaintiff had manifested a desire not to have his or her privacy invaded
Fourth element of action: The new Act should provide that the new cause of action is only available where the court considers that the invasion of privacy was ‘serious’. The new Act should also provide that in determining whether the invasion of privacy was serious, a court may consider, among other things, whether the invasion of privacy was likely to be highly offensive, distressing or harmful to a person of ordinary sensibilities in the position of the plaintiff.
The plaintiff should not be required to prove actual damage to have an action under the new tort.
Fifth element of action: The new Act should provide that the plaintiff only has a cause of action for serious invasion of privacy where the court is satisfied that the plaintiff’s interest in privacy outweighs the defendant’s interest in freedom of expression and any broader public interest. A separate public interest defence would therefore not be needed.
This element will make the cause of action susceptible to differing application depending on the philosophical position of the judge/s constituting the court for the particular case. For greater consistency, at the least some further guidance would need to be included, perhaps in the objects of the legislation.
The new Act should include the following non-exhaustive list of public interest matters which a court may consider:
freedom of expression, including political communication;
freedom of the media to investigate, and inform and comment on matters of public concern and importance;
the proper administration of government;
public health and safety;
the prevention and detection of crime and fraud; and
the economic wellbeing of the country.
I repeat my concern, as stated in respect of proposal 8-1 above.
Federal, state and territory courts should have jurisdiction to hear an action for serious invasion of privacy under the new Act.
If state and territory tribunals should also have jurisdiction, which tribunals would be appropriate and why?
In Queensland, the Civil and Administrative Tribunal ought to have jurisdiction, as a different costs regime can apply which might facilitate access to justice. A monetary limit could be placed on the tribunal, eg the tribunal could be conferred with jurisdiction to hear claims for which proceedings could be brought in the district court or lower.
The new Act should provide that the new tort be limited to natural persons.
As Plaintiffs, yes. Obviously non-natural persons could be defendants.
A cause of action for serious invasion of privacy should not survive for the benefit of the plaintiff’s estate or against the defendant’s estate.
A person should not be able to bring an action under the new tort after either (a) one year from the date on which the plaintiff became aware of the invasion of privacy, or (b) three years from the date on which the invasion of privacy occurred, whichever comes earlier. In exceptional circumstances the court may extend the limitation period for an appropriate period, expiring no later than three years from the date when the invasion occurred.
The new Act should provide that, in determining any remedy, the court may take into account:
whether or not a party took reasonable steps to resolve the dispute without litigation; and
the outcome of any alternative dispute resolution process.
The new Act should provide a defence of lawful authority.
The new Act should provide a defence for conduct incidental to the exercise of a lawful right of defence of persons or property where that conduct was proportionate, necessary and reasonable.
The new Act should provide for a defence of absolute privilege for publication of private information that is co-extensive with the defence of absolute privilege to defamation.
The new Act should provide for a defence of qualified privilege to the publication of private information where the defendant published matter to a person (the recipient) in circumstances where:
the defendant had an interest or duty (whether legal, social or moral) to provide information on a subject to the recipient; and
the recipient had a corresponding interest or duty in having information on that subject; and
the matter was published to the recipient in the course of giving to the recipient information on that subject.
The defence of qualified privilege should be defeated if the plaintiff proves that the conduct of the defendant was actuated by malice.
A publication in breach of privacy is an appropriation of one's private information. A defamatory publication is not necessarily able to be described as an appropriation of someone's good name. I suggest considering whether this defence should also be defeated if the plaintiff proves that the conduct of the defendant was actuated by a desire to profit from publishing the plaintiff's private information.
Should the new Act instead provide that the defence of qualified privilege is co-extensive to the defence of qualified privilege to defamation at common law?
I think the torts are analogous but for the reasons stated at proposal 10-4 above I don't believe they are perfectly so.
The new Act should provide for a defence of publication of public documents.
The new Act should provide for a defence of fair report of proceedings of public concern.
Should the new Act provide for a defence of necessity?
The new Act should provide a safe harbour scheme to protect internet intermediaries from liability for serious invasions of privacy committed by third party users of their service.
What conditions should internet intermediaries be required to meet in order to rely on this safe harbour scheme?
That the intermediary has taken all reasonable steps to prevent publication of information obtained in serious breach of privacy.
The new Act should provide that courts may award compensatory damages, including damages for the plaintiff’s emotional distress, in an action for serious invasion of privacy.
I agree. The Act ought to explicitly allow for general damages.
The new Act should set out the following non-exhaustive list of factors that may mitigate damages for serious invasion of privacy:
that the defendant has made an appropriate apology to the plaintiff about the conduct that invaded the plaintiff’s privacy;
that the defendant has published a correction of any untrue information disclosed about the plaintiff;
that the defendant has made an offer of amends in relation to the defendant’s conduct or the harm suffered by the plaintiff;
that the plaintiff has already recovered compensation, or has agreed to receive compensation in relation to the conduct of the defendant;
that the defendant had taken reasonable steps to settle the dispute with the plaintiff in order to avoid the need for litigation; and
that the plaintiff had not taken reasonable steps to settle the dispute, prior to commencing or continuing proceedings, with the defendant in order to avoid the need for litigation.
The new Act should set out the following non-exhaustive list of factors that may aggravate damages for serious invasion of privacy:
that the plaintiff had taken reasonable steps, prior to commencing or continuing proceedings, to settle the dispute with the defendant in order to avoid the need for litigation;
that the defendant had not taken reasonable steps to settle the dispute with the plaintiff in order to avoid the need for litigation;
that the defendant’s unreasonable conduct at the time of the invasion of privacy or prior to or during the proceedings had subjected the plaintiff to special or additional embarrassment, harm, distress or humiliation;
that the defendant’s conduct was malicious or committed with the intention to cause embarrassment, harm, distress or humiliation to the plaintiff; and
that the defendant has disclosed information about the plaintiff which the defendant knew to be false or did not honestly believe to be true.
I agree. Another aggravating factor might be that the defendant was in a position of power or trust vis-a-vis the plaintiff.
The new Act should provide that the court may not award a separate sum as aggravated damages.
I disagree. It should be a matter for the courts to decide how compensation ought to be awarded.
The new Act should provide that, in an action for serious invasion of privacy, courts may award exemplary damages in exceptional circumstances and where the court considers that other damages awarded would be an insufficient deterrent.
The total of any damages other than damages for economic loss should be capped at the same amount as the cap on damages for non-economic loss in defamation.
The new Act should provide that a court may award the remedy of an account of profits.
The new Act should provide that courts may award damages assessed on the basis of a notional licence fee in respect of the defendant’s conduct, in an action for serious invasion of privacy
The new Act should provide that courts may award an injunction, in an action for serious invasion of privacy.
I agree. And to ensure the injunctive powers are effective, they ought to be able to be exercised where the court considers that serious invasion of privacy is likely or has been threatened.
The new Act should provide that courts may order the delivery up and destruction or removal of material, in an action for serious invasion of privacy.
The new Act should provide that courts may make a correction order, in an action for serious invasion of privacy.
The new Act should provide that courts may make a declaration, in an action for serious invasion of privacy.
What, if any, provisions should the ALRC propose regarding a court’s power to make costs orders?
In the courts costs should follow the event, including in matters where the plaintiff is represented pro bono. In the tribunals, different costs regimes may apply, such as costs only where the public interest requires such an order to be made, or where the action has been brought vexatiously, or the party has caused the other to incur costs unreasonably.
If a statutory cause of action for serious invasion of privacy is not enacted, appropriate federal, state, and territory legislation should be amended to provide that, in an action for breach of confidence that concerns a serious invasion of privacy by the misuse, publication or disclosure of private information, the court may award compensation for the claimant’s emotional distress.
Relevant court acts should be amended to provide that, when considering whether to grant injunctive relief before trial to restrain publication of private (rather than confidential) information, a court must have particular regard to freedom of expression and any other countervailing public interest in the publication of the material.
The court should be required to consider all of the circumstances of the matter, including the public interest.
Surveillance device laws and workplace surveillance laws should be made uniform throughout Australia.
I agree. In addition, employee records should no longer be exempted from the Privacy Act, or, in the alternative, ought to be subjected to some form of privacy protection.
Surveillance device laws should include a technology neutral definition of ‘surveillance device’.
Offences in surveillance device laws should include an offence proscribing the surveillance or recording of private conversations or activities without the consent of the participants. This offence should apply regardless of whether the person carrying out the surveillance is a participant to the conversation or activity, and regardless of whether the monitoring or recording takes place on private property.
Defences in surveillance device laws should include a defence of responsible journalism, for surveillance in some limited circumstances by journalists investigating matters of public concern and importance, such as corruption.
I suspect such a defence would be difficult to administer.
Should the states and territories enact uniform surveillance laws or should the Commonwealth legislate to cover the field?
Surveillance device laws should provide that a court may make orders to compensate or otherwise provide remedial relief to a victim of unlawful surveillance.
Should local councils be empowered to regulate the installation and use of surveillance devices by private individuals?
A Commonwealth harassment Act should be enacted to consolidate and clarify existing criminal offences for harassment and, if a new tort for serious invasion of privacy is not enacted, provide for a new statutory tort of harassment. Alternatively, the states and territories should adopt uniform harassment legislation
The ACMA should be empowered, where there has been a privacy complaint under a broadcasting code of practice and where the ACMA determines that a broadcaster’s act or conduct is a serious invasion of the complainant’s privacy, to make a declaration that the complainant is entitled to a specified amount of compensation. The ACMA should, in making such a determination, have regard to freedom of expression and the public interest.
A new Australian Privacy Principle should be inserted into the Privacy Act 1988 (Cth) that would:
require an APP entity to provide a simple mechanism for an individual to request destruction or de-identification of personal information that was provided to the entity by the individual; and
require an APP entity to take reasonable steps in a reasonable time, to comply with such a request, subject to suitable exceptions, or provide the individual with reasons for its non-compliance.
Should the new APP proposed in Proposal 15–2 also require an APP entity to take steps with regard to third parties with which it has shared the personal information? If so, what steps should be taken?
Should a regulator be empowered to order an organisation to remove private information about an individual, whether provided by that individual or a third party, from a website or online service controlled by that organisation where:
an individual makes a request to the regulator to exercise its power;
the individual has made a request to the organisation and the request has been rejected or has not been responded to within a reasonable time; and
the regulator considers that the posting of the information constitutes a serious invasion of privacy, having regard to freedom of expression and other public interests?
The Privacy Act 1988 (Cth) should be amended to confer the following additional functions on the Australian Information Commissioner in relation to court proceedings relating to interferences with the privacy of an individual:
assisting the court as amicus curiae, where the Commissioner considers it appropriate, and with the leave of the court; and
intervening in court proceedings, where the Commissioner considers it appropriate, and with the leave of the court.
As stated above, employee records are presently exempted from the Privacy Act, and are largely unregulated. Any privacy reform legislation should take the opportunity to correct this problem.