Focus: Government consults on new right to sue for invasion of privacy
30 September 2011
In brief: Individuals could soon gain the right to sue other individuals and companies over serious invasions of privacy if the Federal Government adopts recommendations in a long-awaited issues paper. The issues paper considers the introduction of a statutory cause of action for invasions of privacy and how to strike the right balance between an individual's right to privacy and other important public interests, such as freedom of expression. Partner Gavin Smith (view CV) and Law Graduate Rowan Platt explain.
How does it affect you?
- There is currently no overarching legislative or common law right to personal privacy in Australia. The existing Privacy Act 1988 (Cth) provides only limited legislative protection to individuals in relation to information privacy and data protection, and the Act currently only allows individuals to bring complaints to the Privacy Commissioner, who investigates these complaints on the individual's behalf.
- If a new statutory cause of action for invasion of privacy is introduced, individuals would be able to sue another individual or companies (including media organisations) directly and recover civil damages from them. A new statutory tort would also create a remedy for individuals for invasions of privacy of a more spatial or physical nature, rather than being restricted to the manner in which organisations deal with their personal information in data form.
- A key aspect of the discussion focuses on how an invasion, or serious invasion, of privacy should be defined. The issues paper invites submission on this topic.
- But perhaps the most critical question being canvassed in the issues paper is how any statutory cause of action should incorporate a balancing test requiring the claimant to prove that their individual interest in privacy outweighs the public interest in free publication. Such a balance would be intended to enshrine a protection for the freedom of the press to report issues that are in the public interest. This is an area that has already courted particularly fierce debate and is of particular concern for media organisations.
- In 2008, the Australian Law Reform Commission proposed that the cause of action should be restricted to intentional or reckless acts, rather than negligent or accidental invasions of privacy. This is arguably a higher standard than that currently required of businesses under the Privacy Act, where the requirement under National Privacy Principle 4 is to take 'reasonable steps' to protect against informational privacy breaches. Businesses will therefore also have a keen eye on the outcome of the Government's consultation.
On 23 September 2011, the Minister for Privacy and Freedom of Information, Brendan O'Connor, released a long-awaited issues paper titled A Commonwealth Statutory Cause of Action for Serious Invasion of Privacy.
The issues paper, which was the subject of heated press coverage prior to its publication, focuses on the recommendations made in the Australian Law Reform Commission (ALRC) 2008 report on privacy law and practice1. It also refers to similar proposals made by the New South Wales (NSWLRC) and Victorian Law Reform Commissions (VLRC).
The Federal Government has invited public submissions, which are due by 4 November 2011.
Over the past 10 years, a number of Australian courts have considered the possibility of introducing a new common law tort of privacy but no appellate court has yet recognised that such a common law tort exists2. The issues paper explores the ALRC's recommendations to introduce a statutory cause of action for serious invasion of privacy, contained within new federal legislation separate from the Privacy Act.
Under the ALRC's 2008 proposals, claimants would need to satisfy a three-limbed test in order to establish a cause of action for serious invasion of privacy, by demonstrating that, in all the circumstances:
- they had a reasonable expectation of privacy;
- the defendant's act or conduct was highly offensive to a reasonable person of ordinary sensibilities; and
- the public interest in maintaining the claimant's privacy outweighs other matters of public interest (including the public interest in allowing freedom of expression and the interest of the public to be informed about matters of public concern).
The issues paper asks first whether the test of 'highly offensive' is an appropriate standard for a cause of action relating to serious invasions of privacy.
Perhaps more significantly (particularly for media organisations), the issues paper draws attention to the proposed third limb, by asking how best a statutory cause of action should recognise and protect a public interest in freedom of expression. The issues paper highlights the ALRC's reasoning behind integrating a balancing test as an additional third limb within the cause of action, the onus of proof lying with the claimant. By factoring in other public interests as part of the cause of action itself, rather than in the defences, the ALRC concluded in 2008 that this would ensure that individual privacy rights are not privileged over other public interests. In contrast, the VLRC suggested in its proposals that public interest in the conduct that constituted the invasion could be used as a defence to the claimant's cause of action.
The issues paper asks two questions in this regard: whether a balancing of interests should be integrated into the cause of action itself or established as a defence, and, more generally, how best a statutory cause of action could recognise a balancing right of freedom of expression. Many media organisations are of the view that without a constitutional, or other form of statutory right of freedom of expression, the introduction of a statutory cause of action for invasions of privacy could have a significantly detrimental outcome on legitimate investigative journalism. Establishing an appropriate balancing test will therefore be a critical part of any cause of action.
The requisite fault element
The issues paper also highlights the ALRC's recommendation that the cause of action be restricted to intentional or reckless acts by the respondent. Recklessness3 occurs where a person is aware of a substantial risk that a circumstance or result will occur, but continues in their conduct notwithstanding their knowledge of that risk. To limit the cause of action in this way would preclude actions brought where there has been only a negligent or accidental invasion of privacy. The issues paper asks whether this proposed fault element is appropriate or whether it should be amended.
The ALRC, NSWLRC and VLRC have been divided on this issue. The VLRC disagreed with the ALRC that negligence should be excluded. The NSWLRC did not address the requisite standard of fault at all. And it is also worth noting in this regard that the Commonwealth Privacy Commissioner, Timothy Pilgrim, has recently indicated in a public forum that he thinks a test of recklessness might not be appropriate.
What type of acts or conduct will it protect against?
The ALRC recommended that proposed legislation should contain a non-exhaustive guiding list of the types of activities and conduct that may constitute serious invasions of privacy, including:
- a serious interference with an individual's home or family life;
- unauthorised surveillance of an individual;
- interference with, or misuse or disclosure of, an individual's correspondence or private written, oral or electronic communication; and
- disclosure of sensitive facts relating to an individual's private life.
The issues paper asks whether a non-exhaustive list of activities should be included in the legislation itself or in other explanatory material. It also seeks particular feedback as to whether item (d) above is defined sufficiently clearly, or whether it could be further refined.
It is proposed that a range of defences to the cause of action should be available where:
- the act or conduct was incidental to the exercise of a lawful right of defence of person or property;
- the act or conduct was required or authorised under law; or
- the publication of the information was privileged under defamation law.
Proof of damage and remedies
In its 2008 report, the ALRC proposed that claims under the statutory tort of privacy should not require the claimant to show proof of damage in the same manner as for the torts of trespass and defamation in Australia. The issues paper asks respondents to consider whether a cause of action should require proof of damage and, if so, how damage should be defined.
The ALRC also proposed that if a court were satisfied that a serious invasion of privacy had been established, it should be empowered to choose the most appropriate remedy in the circumstances, including damages, aggravated (but not exemplary) damages, an accounts of profits, an injunction, declarations, a court-ordered apology, correction orders and an order to deliver up and/or destroy material. Both the NSWLRC and the VLRC also proposed a similarly wide range of remedies. The issues paper asks whether these remedies are necessary and sufficient.
The issues paper makes clear that the Federal Government is keen to strengthen and update Australia's laws on privacy to take account of the digital age. But the issues paper also emphasises that changes should not occur at the expense of freedom of expression and the freedom of the media to seek out and disseminate information of public concern.
Despite previous assurances by the ALRC in 2008 that the proposed cause of action would not hinder legitimate investigative journalism, none of the ALRC, NSWLRC or VLRC proposals include any exemption for media organisations that publish information about an individual's private life where it is in the public interest. Instead, it would be for the court to determine whether the journalism in question was permissible, based on a consideration of the facts of the case, the nature of the invasion of privacy, and having considered the relevant public interests.
This marks an important departure from the current position under the Privacy Act, where media organisations are afforded an automatic exemption from compliance with the Act where they use personal information in the course of journalism. This also brings into stark relief the lack of a constitutional or legislative guarantee of freedom of expression in Australian law (other than the implied right of freedom of political expression).
Whatever the precise formulation of any proposed tort of privacy, it can reasonably be expected that the introduction of any separate statutory cause of action will require the media industry and a broader range of businesses to reassess their practices so as to minimise their liability.
Submissions on the issues paper are due by Friday, 4 November 2011. For more details, see the Department of Prime Minister and Cabinet's website.
- 'For Your Information: Australian Privacy Law and Practice', ALRC Report 108, 11 August 2008.
- ABC v Lenah Game Meats (2002) 208 CLR 199; Grosse v Purvis  QDC 151; Kalaba v Commonwealth of Australia  FCAFC 326; Doe v Australian Broadcasting Corporation  VCC 281; Giller v Procopets  VSCA 236.
- which is defined in Section 5.4 of the Criminal Code Act 1995 (Cth).
- Gavin SmithPartner,
Ph: +61 2 9230 4891
- Michael PattisonPartner,
Ph: +61 3 9613 8839