The paper [PDF] follows the Issues Paper noted last year and reflects public consultation.
It features the following proposals and questions -
4. A New Tort in a New Commonwealth Act
Proposal 4–1 A statutory cause of action for serious invasion of privacy should be contained in a new Commonwealth Act (the new Act).
Proposal 4–2 The cause of action should be described in the new Act as an action in tort.
5. Two Types of Invasion and Fault Proposal
5–1 First element of action: The new tort should be confined to invasions of privacy by: (a) intrusion upon the plaintiff’s seclusion or private affairs (including by unlawful surveillance); or (b) misuse or disclosure of private information about the plaintiff (whether true or not).
Proposal 5–2 Second element of action: The new tort should be confined to intentional or reckless invasions of privacy. It should not extend to negligent invasions of privacy, and should not attract strict liability.
Proposal 5–3 The new Act should provide that an apology made by or on behalf of a person in connection with any invasion of privacy alleged to have been committed by the person: (a) does not constitute an express or implied admission of fault or liability by the person in connection with that matter; and (b) is not relevant to the determination of fault or liability in connection with that matter.
Proposal 5–4 Evidence of an apology made by or on behalf of a person in connection with any conduct by the person is not admissible in any civil proceedings as evidence of the fault or liability of the person in connection with that matter.
6. A Reasonable Expectation of Privacy Proposal
6–1 Third element of action: The new tort should only be actionable where a person in the position of the plaintiff would have had a reasonable expectation of privacy, in all of the circumstances.
Proposal 6–2 The new Act should provide that, in determining whether a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances, the court may consider, among other things: (a) the nature of the private information, including whether it relates to intimate or family matters, health or medical matters, or financial matters; (b) the means used to obtain the private information or to intrude upon seclusion, including the use of any device or technology; (c) the place where the intrusion occurred; (d) the purpose of the misuse, disclosure or intrusion; (e) how the private information was held or communicated, such as in private correspondence or a personal diary; (f) whether and to what extent the private information was already in the public domain; (g) the relevant attributes of the plaintiff, including the plaintiff’s age and occupation; (h) whether the plaintiff consented to the conduct of the defendant; and (i) the extent to which the plaintiff had manifested a desire not to have his or her privacy invaded
7. Seriousness and Proof of Damage
Proposal 7–1 Fourth element of action: The new Act should provide that the new cause of action is only available where the court considers that the invasion of privacy was ‘serious’. The new Act should also provide that in determining whether the invasion of privacy was serious, a court may consider, among other things, whether the invasion of privacy was likely to be highly offensive, distressing or harmful to a person of ordinary sensibilities in the position of the plaintiff.
Proposal 7–2 The plaintiff should not be required to prove actual damage to have an action under the new tort.
8. Balancing Privacy with Other Interests
Proposal 8–1 Fifth element of action: The new Act should provide that the plaintiff only has a cause of action for serious invasion of privacy where the court is satisfied that the plaintiff’s interest in privacy outweighs the defendant’s interest in freedom of expression and any broader public interest. A separate public interest defence would therefore not be needed.
Proposal 8–2 The new Act should include the following non-exhaustive list of public interest matters which a court may consider: (a) freedom of expression, including political communication; (b) freedom of the media to investigate, and inform and comment on matters of public concern and importance; (c) the proper administration of government; (d) open justice; (e) public health and safety; (f) national security; (g) the prevention and detection of crime and fraud; and (h) the economic wellbeing of the country.
9. Forums, Limitations and Other Matters
Proposal 9–1 Federal, state and territory courts should have jurisdiction to hear an action for serious invasion of privacy under the new Act.
Question 9–1 If state and territory tribunals should also have jurisdiction, which tribunals would be appropriate and why?
Proposal 9–2 The new Act should provide that the new tort be limited to natural persons.
Proposal 9–3 A cause of action for serious invasion of privacy should not survive for the benefit of the plaintiff’s estate or against the defendant’s estate.
Proposal 9–4 A person should not be able to bring an action under the new tort after either (a) one year from the date on which the plaintiff became aware of the invasion of privacy, or (b) three years from the date on which the invasion of privacy occurred, whichever comes earlier. In exceptional circumstances the court may extend the limitation period for an appropriate period, expiring no later than three years from the date when the invasion occurred.
Proposal 9–5 The new Act should provide that, in determining any remedy, the court may take into account: (a) whether or not a party took reasonable steps to resolve the dispute without litigation; and (b) the outcome of any alternative dispute resolution process.
10. Defences and Exemptions
Proposal 10–1 The new Act should provide a defence of lawful authority.
Proposal 10–2 The new Act should provide a defence for conduct incidental to the exercise of a lawful right of defence of persons or property where that conduct was proportionate, necessary and reasonable.
Proposal 10–3 The new Act should provide for a defence of absolute privilege for publication of private information that is co-extensive with the defence of absolute privilege to defamation.
Proposal 10–4 The new Act should provide for a defence of qualified privilege to the publication of private information where the defendant published matter to a person (the recipient) in circumstances where: (a) the defendant had an interest or duty (whether legal, social or moral) to provide information on a subject to the recipient; and (b) the recipient had a corresponding interest or duty in having information on that subject; and (c) the matter was published to the recipient in the course of giving to the recipient information on that subject. The defence of qualified privilege should be defeated if the plaintiff proves that the conduct of the defendant was actuated by malice.
Question 10–1 Should the new Act instead provide that the defence of qualified privilege is co-extensive to the defence of qualified privilege to defamation at common law?
Proposal 10–5 The new Act should provide for a defence of publication of public documents.
Proposal 10–6 The new Act should provide for a defence of fair report of proceedings of public concern.
Question 10–2 Should the new Act provide for a defence of necessity? Proposal 10–7 The new Act should provide a safe harbour scheme to protect internet intermediaries from liability for serious invasions of privacy committed by third party users of their service. Question 10–3 What conditions should internet intermediaries be required to meet in order to rely on this safe harbour scheme?
11. Remedies and Costs
Proposal 11–1 The new Act should provide that courts may award compensatory damages, including damages for the plaintiff’s emotional distress, in an action for serious invasion of privacy.
Proposal 11–2 The new Act should set out the following non-exhaustive list of factors that may mitigate damages for serious invasion of privacy: (a) that the defendant has made an appropriate apology to the plaintiff about the conduct that invaded the plaintiff’s privacy; (b) that the defendant has published a correction of any untrue information disclosed about the plaintiff; (c) that the defendant has made an offer of amends in relation to the defendant’s conduct or the harm suffered by the plaintiff; (d) that the plaintiff has already recovered compensation, or has agreed to receive compensation in relation to the conduct of the defendant; (e) that the defendant had taken reasonable steps to settle the dispute with the plaintiff in order to avoid the need for litigation; and (f) that the plaintiff had not taken reasonable steps to settle the dispute, prior to commencing or continuing proceedings, with the defendant in order to avoid the need for litigation.
Proposal 11–3 The new Act should set out the following non-exhaustive list of factors that may aggravate damages for serious invasion of privacy: (a) that the plaintiff had taken reasonable steps, prior to commencing or continuing proceedings, to settle the dispute with the defendant in order to avoid the need for litigation; (b) that the defendant had not taken reasonable steps to settle the dispute with the plaintiff in order to avoid the need for litigation; (c) that the defendant’s unreasonable conduct at the time of the invasion of privacy or prior to or during the proceedings had subjected the plaintiff to special or additional embarrassment, harm, distress or humiliation; (d) that the defendant’s conduct was malicious or committed with the intention to cause embarrassment, harm, distress or humiliation to the plaintiff; and (e) that the defendant has disclosed information about the plaintiff which the defendant knew to be false or did not honestly believe to be true.
Proposal 11–4 The new Act should provide that the court may not award a separate sum as aggravated damages.
Proposal 11–5 The new Act should provide that, in an action for serious invasion of privacy, courts may award exemplary damages in exceptional circumstances and where the court considers that other damages awarded would be an insufficient deterrent.
Proposal 11–6 The total of any damages other than damages for economic loss should be capped at the same amount as the cap on damages for non-economic loss in defamation. Proposal 11–7 The new Act should provide that a court may award the remedy of an account of profits.
Proposal 11–8 The new Act should provide that courts may award damages assessed on the basis of a notional licence fee in respect of the defendant’s conduct, in an action for serious invasion of privacy.
Proposal 11–9 The new Act should provide that courts may award an injunction, in an action for serious invasion of privacy.
Proposal 11–10 The new Act should provide that courts may order the delivery up and destruction or removal of material, in an action for serious invasion of privacy.
Proposal 11–11 The new Act should provide that courts may make a correction order, in an action for serious invasion of privacy.
Proposal 11–12 The new Act should provide that courts may make an order requiring the defendant to apologise to the plaintiff, in an action for serious invasion of privacy.
Proposal 11–13 The new Act should provide that courts may make a declaration, in an action for serious invasion of privacy.
Question 11–1 What, if any, provisions should the ALRC propose regarding a court’s power to make costs orders?
12. Breach of Confidence Actions for Misuse of Private Information
Proposal 12–1 If a statutory cause of action for serious invasion of privacy is not enacted, appropriate federal, state, and territory legislation should be amended to provide that, in an action for breach of confidence that concerns a serious invasion of privacy by the misuse, publication or disclosure of private information, the court may award compensation for the claimant’s emotional distress.
Proposal 12–2 Relevant court acts should be amended to provide that, when considering whether to grant injunctive relief before trial to restrain publication of private (rather than confidential) information, a court must have particular regard to freedom of expression and any other countervailing public interest in the publication of the material.
13. Surveillance Devices
Proposal 13–1 Surveillance device laws and workplace surveillance laws should be made uniform throughout Australia.
Proposal 13–2 Surveillance device laws should include a technology neutral definition of ‘surveillance device’.
Proposal 13–3 Offences in surveillance device laws should include an offence proscribing the surveillance or recording of private conversations or activities without the consent of the participants. This offence should apply regardless of whether the person carrying out the surveillance is a participant to the conversation or activity, and regardless of whether the monitoring or recording takes place on private property.
Proposal 13–4 Defences in surveillance device laws should include a defence of responsible journalism, for surveillance in some limited circumstances by journalists investigating matters of public concern and importance, such as corruption.
Question 13–1 Should the states and territories enact uniform surveillance laws or should the Commonwealth legislate to cover the field?
Proposal 13–5 Surveillance device laws should provide that a court may make orders to compensate or otherwise provide remedial relief to a victim of unlawful surveillance.
Question 13–2 Should local councils be empowered to regulate the installation and use of surveillance devices by private individuals?
14. Harassment Proposal
14–1 A Commonwealth harassment Act should be enacted to consolidate and clarify existing criminal offences for harassment and, if a new tort for serious invasion of privacy is not enacted, provide for a new statutory tort of harassment. Alternatively, the states and territories should adopt uniform harassment legislation
15. New Regulatory Mechanisms
Proposal 15–1 The ACMA should be empowered, where there has been a privacy complaint under a broadcasting code of practice and where the ACMA determines that a broadcaster’s act or conduct is a serious invasion of the complainant’s privacy, to make a declaration that the complainant is entitled to a specified amount of compensation. The ACMA should, in making such a determination, have regard to freedom of expression and the public interest.
Proposal 15–2 A new Australian Privacy Principle should be inserted into the Privacy Act 1988 (Cth) that would: (a) require an APP entity to provide a simple mechanism for an individual to request destruction or de-identification of personal information that was provided to the entity by the individual; and (b) require an APP entity to take reasonable steps in a reasonable time, to comply with such a request, subject to suitable exceptions, or provide the individual with reasons for its non-compliance.
Question 15–1 Should the new APP proposed in Proposal 15–2 also require an APP entity to take steps with regard to third parties with which it has shared the personal information? If so, what steps should be taken?
Question 15–2 Should a regulator be empowered to order an organisation to remove private information about an individual, whether provided by that individual or a third party, from a website or online service controlled by that organisation where: (a) an individual makes a request to the regulator to exercise its power; (b) the individual has made a request to the organisation and the request has been rejected or has not been responded to within a reasonable time; and (c) the regulator considers that the posting of the information constitutes a serious invasion of privacy, having regard to freedom of expression and other public interests?
15–3 The Privacy Act 1988 (Cth) should be amended to confer the following additional functions on the Australian Information Commissioner in relation to court proceedings relating to interferences with the privacy of an individual: (a) assisting the court as amicus curiae, where the Commissioner considers it appropriate, and with the leave of the court; and (b) intervening in court proceedings, where the Commissioner considers it appropriate, and with the leave of the court.The paper notes that the ALRC's inquiry
builds on four other recent inquiries into privacy law or related issues conducted in Australia, three of which recommended the enactment of a statutory cause of action.
The ALRC’s report, For Your Information: Privacy Law and Practice (ALRC Report 108, 2008) focused on data protection: information collection, access and use. The ALRC recommended that Commonwealth legislation should provide for a statutory cause of action for serious invasion of privacy.
In 2009, the New South Wales Law Reform Commission (NSWLRC) recommended that a general cause of action for invasion of privacy was required to provide a ‘basis for the ongoing development of the law of privacy in a climate of dynamic societal and technological change’.
In 2010, the Victorian Law Reform Commission (VLRC) issued the report, Surveillance in Public Places, which followed a decade-long inquiry into workplace privacy and privacy in public places.
In September 2011, the Department of the Prime Minister and Cabinet (DPM&C) released an Issues Paper on a statutory cause of action for invasion of privacy, prompted by a number of ‘high profile privacy breaches’ in Australia and overseas.
In addition to a continuing debate in Australia on the desirability of a statutory cause of action, there have been important developments in privacy protection in other countries. Privacy torts have been well-established in the United States for many decades, although the protection they provide is limited by the constitutional protection of free speech in the First Amendment of the US Constitution. Some states, such as California, have also introduced a statutory tort of invasion of privacy.
The United Kingdom has developed extensive legal protection of privacy by extending the equitable action for breach of confidence, under the influence of the Human Rights Act 1998 (UK). This Act requires the courts to give effect to the protection of rights and freedoms set out in arts 8 and 10 of the European Covenant on Human Rights.
The Canadian provinces of British Columbia, Manitoba, Newfoundland and Labrador, Quebec and Saskatchewan have enacted statutory torts for invasion of privacy, and the Ontario Court of Appeal has also recognised common law protection. New Zealand courts have recently recognised common law torts of misuse of private information and of intrusion.
The state of development of a country’s common law protection of privacy has a significant impact on the question of whether there is a need to legislate for a cause of action. Committees in both the United Kingdom and New Zealand have recommended against the introduction of a statutory cause of action, in view of the common law developments in those two countries.
In contrast, a common law tort for invasion of privacy has not yet developed in Australia, despite the High Court leaving open the possibility of such a development, in Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd. While a tort of invasion of privacy has been recognised by two lower court decisions, no appellate court has confirmed the existence of this tort. The general consensus is that the likely direction of the future development of the common law is uncertain. Should a new cause of action be enacted?
The ALRC considers that the question of whether a statutory cause of action for serious invasion of privacy would be beneficial to the Australian community is best answered after considering:
- the existing legal protections for privacy;
- the gaps in that legal protection identified;
- the precise elements of the proposed cause of action; and
- any alternative ways in which the unacceptable gaps in the law might be filled.
Only a very few stakeholders who made submissions to the Inquiry told the ALRC that the law did not need to be changed at all, and that there were no gaps in the legal protection of privacy in Australia. Those who opposed the introduction of a new cause of action recognised the gaps in the law, but submitted that it would be preferable to fill those gaps in other ways. Many other stakeholders expressed their support for a statutory cause of action. Both stakeholders who supported and those who opposed the introduction of a new cause of action made submissions as to the desirable elements of any such action.
The cause of action proposed in this Discussion Paper is more precise than similar privacy actions recommended in other law reform reports, and in some respects more narrow. The ALRC believes that precision is important so that stakeholder groups, individuals and lawmakers can reach a more informed view on the potential interpretation and application of the proposed action, on the extent of protection it may provide to potential claimants, and on the impact it may have on those who would face potential liability. Only when these assessments are made can there be an informed debate on the relative desirability of the proposed statutory cause of action or other alternatives.
Privacy law must recognise other values and interests, such as freedom of expression. This is reflected in the design of the tort proposed in this Discussion Paper. While this may mean that one interest is not as protected or as unconstrained to the extent some advocates would prefer, the ALRC considers that the law may be able to find a middle ground where a balance can be reached and a degree of useful protection can be enacted.
The statutory cause of action is thus directed at serious invasions of privacy committed intentionally or recklessly with no countervailing justification or defence. If the statute provides remedies for such invasive conduct, Australia will have made an important and clear step in providing greater protection for privacy than is currently available. It will give Australians the privacy protections enjoyed by those in other countries, including the UK, New Zealand and Canada.
The statutory cause of action is not, however, the only way that greater protection could be achieved by statutory reform. This Discussion Paper, in Part 3, suggests other measures that should be considered to improve the protection in Australia of people’s privacy in the digital age, some in addition to and some as an alternative to a new statutory cause of action.[Disclosure: I'm cited numerous times on the basis of a submission in response to the Issues Paper.]
