ALRC’s view

74.112 In the absence of a statutory cause of action for serious invasion of privacy, the common law in this area will continue to develop through the Australian courts. Whether this evolution results in the recognition of a tort of invasion of privacy, the adoption of the UK’s approach to breach of confidence, a combination of the two, or a rejection of the international trend, is an open question.

74.113 If Australian courts follow the UK’s approach of developing the cause of action within the equitable action for breach of confidence, or decide tort law should be the preferred vehicle, they will have to develop the cause or causes of action within the rules of equity and tort. This has an impact on the circumstances that will be recognised as giving rise to the cause of action, and on the remedies available to address the wrong.

74.114 Sir Roger Toulson, co-author of a leading text on confidentiality[165] and a judge of the England and Wales Court of Appeal, has highlighted, in the context of the UK’s approach, a limitation inherent in the incremental development of the common law. He identifies an important limitation on the use of breach of confidence to address privacy issues.

A consequence of the development of privacy within the action for breach of confidentiality is that it is presently confined to cases involving the use of information of a private nature, whether in word or pictorial form. So however strong and understandable may be the feeling of harassment of a person who is hounded by photographers when carrying out activities of a private nature, and however unacceptable the behaviour of the pack, there will be no cause of action until an intrusive photograph is published. From the viewpoint of the mischief against which Article 8 [of the Human Rights Act 1998] is aimed, this is illogical.[166]

74.115 To put these comments in an Australian context, if the UK’s approach applied, the plaintiff in Doe v ABC would (and did on the findings of the trial judge) have a recognised cause of action for breach of confidence, but the claimant in Grosse v Purvis would be without a remedy.

74.116 Such constraints can be overcome if a statutory cause of action for serious invasion of privacy is enacted. This avoids the problems inherent in attempting to fit all the circumstances that may give rise to an invasion of privacy into a pre-existing cause of action—such as breach of confidence—or formulating a previously unrecognised cause of action—such as the tort of invasion of privacy. Enacting a statutory cause of action also allows for a more flexible approach to defences and remedies.[167]

74.117 Individuals should be protected from unwanted intrusions into their private lives or affairs in a broad range of contexts, and it is the ALRC’s view that a statutory cause of action is the best way to ensure such protection. It forecloses the possibility of Australian courts adopting an action in breach of confidence as the primary vehicle to protect an individual’s private life from invasion, and alleviates the necessity of judges taking the ‘bold step’[168] of formulating a new tort and a lengthy period of uncertainty and inconsistency as the courts refine the law in this area. Further, it does away with the distinction between equitable and tortious causes of action, and between the defences and remedies available under each.

74.118 The ALRC supports the view expressed in NSWLRC CP1 that the ‘statutory cause of action for invasion of privacy should not be constrained at the outset by an assumption that rules otherwise applicable to torts generally should necessarily apply to the statutory cause of action for invasion of privacy’.[169] In addition, as the NSWLRC notes, this approach allows for the consideration of competing interests, including the public interest, ‘that have not traditionally been relevant in the development of tortious causes of action’.[170]

74.119 In the ALRC’s view, it is also appropriate to set out a non-exhaustive list of the types of acts or conduct that could constitute an invasion of privacy. This will be useful in indicating to the courts the scope of the action. Examples where an invasion of privacy may occur should include where:

  • there has been a serious interference with an individual’s home or family life;

  • an individual has been subjected to unauthorised surveillance;

  • an individual’s correspondence or private written, oral or electronic communication has been interfered with, misused or disclosed; and

  • sensitive facts relating to an individual’s private life have been disclosed.

74.120 In the ALRC’s view, the cause of action should not include use of a person’s identity or likeness without consent. It is questionable whether an unlawful attack on a person’s honour and reputation, placing a person in a false light and using a person’s name, identity, likeness or voice without authority or consent are properly characterised as invasions of privacy. It has been argued, at least in relation to false light and appropriation, that such conduct is better left to the law of defamation.[171] The same argument applies to an unlawful attack on a person’s honour and reputation, which clearly falls within the parameters of defamation law.[172]

74.121 In Lenah Game Meats, Gummow and Hayne JJ commented on the tenuous nexus between privacy and the appropriation and false light torts.

Whilst objection possibly may be taken on non-commercial grounds to the appropriation of the plaintiff’s name or likeness, the plaintiff’s complaint is likely to be that the defendant has taken the steps complained of for a commercial gain, thereby depriving the plaintiff of the opportunity of commercial exploitation of that name or likeness for the benefit of the plaintiff. To place the plaintiff in a false light may be objectionable because it lowers the reputation of the plaintiff or causes financial loss or both. The remaining categories [of the Restatement of the Law, 2nd, Torts, 1977 (US)], the disclosure of private facts and unreasonable intrusion upon seclusion, perhaps come closest to reflecting a concern for privacy ‘as a legal principle drawn from the fundamental value of personal autonomy’, the words of Sedley LJ in Douglas v Hello! Ltd.[173]

74.122 It has also been suggested that the appropriation tort is a form of intellectual property, in that it protects a property right as distinct from the privacy of a person. Alternatively, an extension of the tort of ‘passing off’, or the development of a ‘right of publicity’, may be a better way to deal with the perceived problem.[174]

74.123 It is undesirable for the cause of action to be used as an intellectual property style personality right to protect commercial value. This type of scenario may be illustrated by reference to Douglas v Hello![175] where the plaintiffs claimed the privacy of their wedding photographs in order to protect the commercial value of the photographs that they had sold to a rival magazine. Consequently, it is undesirable expressly to include ‘use of another’s name, identity, likeness or voice’ in the list of types of intrusion that will ground the cause of action for serious invasion of privacy.

74.124 Circumstances giving rise to the cause of action should not be limited to activities taking place in the home or in private places. Clear lines demarcating areas in which privacy can be enjoyed should not be drawn in advance, since each claim will have to be judged in its particular context. The appropriate test is whether the circumstances give rise to a reasonable expectation of privacy, regardless of whether the activity is in public or private.

74.125 In Lenah Game Meats, Gleeson CJ noted that ‘an activity is not private just because it is not done in public’.[176] In the alternative, the fact that an activity takes place in public does not mean that an expectation of privacy cannot arise. In Hosking v Runting, a reasonable expectation of privacy did not arise because the photographs were taken in public and disclosed ‘nothing more than could have been observed by an member of the public in Newmarket on that particular day’.[177] In Campbell,[178] the activity photographed was in public, but it revealed information about Campbell’s health, a category of information that has long been considered sensitive and private.

74.126 One commentator has suggested that a reasonable expectation of privacy may arise in public where a person is

involuntarily experiencing an intimate or traumatic experience in public, they are in a place where they reasonably perceive themselves to be reasonably imperceptible, or the defendant has used technological devices to penetrate his or her clothes or other self protection barriers.[179]

74.127 While leaving it open to the courts to determine when a reasonable expectation of privacy exists, the ALRC supports the narrower view of when a public act can be private, as expressed in Campbell rather than the more expansive view of the European courts in cases like Von Hannover, discussed above.[180]

74.128 The ALRC notes the concerns raised by Youthlaw, and considers a number of issues related to capacity, young people and privacy in Chapters 68 and 69. The issue of the capacity of young people generally to bring claims without a litigation guardian, however, is outside the Terms of Reference for this Inquiry.

Elements of a statutory cause of action

74.129 The NSWLRC suggested two possible approaches to establishing the elements of a statutory cause of action for invasion of privacy.

An invasion of privacy could be determined as made out where:

  • The plaintiff had, in all the circumstances, a reasonable expectation of privacy in relation to the relevant conduct or information; and/or

  • The defendant’s invasion of that privacy in relation to that conduct or information, is, in all the circumstances, offensive (or highly offensive) to a reasonable person of ordinary sensibilities.[181]

74.130 The fact that the two approaches are not mutually exclusive is evidenced by the decision in Hosking v Runting.[182] As noted above, the court found that the fundamental requirements for a successful interference with privacy, in the context of wrongful publicity given to private lives, includes both (a) a reasonable expectation of privacy; and (b) conduct that would be considered highly offensive to the hypothetical reasonable person.

74.131 The NSWLRC concedes that these two approaches ‘may often be two sides of the same coin. They are not necessarily mutually exclusive’. However, this may not always be the case. To illustrate the point, the NSWLRC gives the example of a medical practitioner who reveals the claimant’s HIV status by mistake. The NSWLRC suggests that the claimant may have a reasonable expectation of privacy, but that the disclosure of the claimant’s HIV status will not be ‘highly offensive to a reasonable person of ordinary sensibilities’.[183]

74.132 Such a distinction illustrates the point made by Nicholls LJ in Campbell, noted above. The ‘highly offensive’ formulation should be approached with care, one reason being that the phrase ‘highly offensive’ is suggestive of a stricter test of what should be considered private than ‘a reasonable expectation of privacy’.[184]

74.133 In determining what is considered ‘private’ for the purpose of establishing liability under the statutory cause of action, the ALRC’s preference is that there should be both a reasonable expectation of privacy in all the circumstances, and the act complained of must satisfy an objective test of seriousness.

74.134 In DP 72, the ALRC expressed concern that adopting the phrase ‘highly offensive to a reasonable person of ordinary sensibilities’, used by Gleeson CJ in Lenah Game Meats,[185] may be too high a threshold, and suggested that the test should be whether the act in question was ‘sufficiently serious to cause substantial offence’.[186]

74.135 After further consultation and reflection, however, the ALRC now accepts that the higher bar is preferable for the statutory cause of action. Setting a high threshold to establish a serious invasion of privacy is consciously intended to ensure that freedom of expression is respected and not unduly curtailed in the great run of circumstances—the cause of action only will succeed where the defendant’s conduct is thoroughly inappropriate and the complainant suffered serious harm as a result. This formula also offers a number of other advantages, including simplifying the law and providing courts with some guidance on its application—particularly given that the statutory test will be consistent with developments in the common law in Australia and New Zealand.

74.136 The characterisation of the cause of action as a ‘serious invasion of privacy’ also will clarify the types of matters intended to be covered by the action, and allay many of the concerns raised in submissions. For example, street art generally would not fall within the scope of the cause of action. A claimant simply captured in a photograph of a street scene, taken in the manner suggested in some of the submissions, is unlikely to be able to establish either that there was a reasonable expectation of privacy or that the act complained of would be highly offensive to a reasonable person of ordinary sensibilities.

74.137 It is neither feasible nor desirable to attempt to list or limit the types of acts that may be found to be highly offensive to a reasonable person of ordinary sensibilities. As noted above, matters the ALRC previously considered to be worthy of protection through a cause of action include sensitive facts relating to a person’s individual relationships, health, home, family and private life.[187] Acts or disclosures revealing this type of sensitive or intimate information are the most likely to meet the test of what would be highly offensive.

74.138 Protecting such information should not hinder legitimate investigative journalism as described by media groups to this Inquiry. For example, allegations of misconduct or corruption in public life would not fall within this zone of protection.

74.139 To illustrate this point more clearly, the ALRC provides below some examples of the circumstances that the ALRC considers should amount to a serious invasion of privacy for the purposes of the recommended cause of action.

Examples of matters intended to fall within the ALRC’s recommended statutory cause of action for serious invasion of privacy

1. Following the break-up of their relationship, Mr A sends copies of a DVD of himself and his former girlfriend (B) engaged in sexual activity to Ms B’s parents, friends, neighbours and employer.[188]

2. C sets up a tiny hidden camera in the women’s toilet at his workplace, capturing images of his colleagues that he downloads to his own computer and transmits to a website hosted overseas, which features similar images.[189]

3.D works in a hospital and accesses the medical records of a famous sportsman, who is being treated for drug addiction. D makes a copy of the file and sells it to a newspaper, which publishes the information in a front page story.[190]

4.E runs a small business and uses F&Co Financial Advisers to handle her tax affairs and financial advice. Staff at F&Co decide to do a bit of ‘spring cleaning’, and a number of files are put out in a recycling bin on the footpath—including E’s file, which contains her personal and contact details, tax file and ABN numbers, and credit card details. A passerby grabs the file and, unbeknown to E, begins to engage in identity theft: removing money from E’s bank account, using her credit cards and applying for additional credit cards in E’s name.[191]

74.140 While some of the examples above also may give rise to criminal sanctions,[192] a federal statutory cause of action would give complainants access to a broader range of civil remedies to redress the invasion of their privacy. In the case of Giller v Procopets,[193] the defendant showed another person a video of himself and the plaintiff having sex, left a copy of the video with the plaintiff’s father and threatened to show the video to others, including the plaintiff’s employer—and it was found that, under the existing state of the law, the plaintiff was left with no remedy in either criminal or civil law.

74.141 A number of stakeholders in this Inquiry have claimed that there have not been a sufficient number of complaints to warrant enactment of a cause of action for a serious invasion of privacy. The ALRC suggests that there are two arguments against the logic of that claim. First, the fact that no cause of action currently exists (and the lack of a definitive judgment under the common law) means that the numbers of those who have experienced a serious invasion of privacy cannot be known. Secondly, effective law reform must respond not only to current problems and gaps in the law, but also anticipate where there are likely to be significant problems in the future that will require some kind of regulation. In this case, it is clear that developments in information technology and surveillance technology have led to widespread concerns about an ‘increasingly invasive social environment’.[194]

74.142 In Chapter 11, the ALRC discusses the many submissions this Inquiry received about the permanence of personal information published on the internet by individuals.[195] As well as sites such as Facebook and YouTube, where individuals can post photographs or videos, there are at least 100 websites that contain images of people caught showering or undressing.[196] The ALRC notes the limitations of using ‘take-down’ notices where a person is posting information on the internet in a personal capacity. The utility of establishing an Australian take-down notice scheme is also questionable, given the ease of moving internet content to a website hosted in another jurisdiction. In these cases, a more appropriate remedy would be available through a statutory cause of action for a serious invasion of privacy.

A balancing test

74.143 As noted above, a number of stakeholders argued that placing privacy protection on a statutory footing would give inappropriately great weight to privacy rights at the expense of other rights and interests. In DP 72, the ALRC proposed that the issues of freedom of expression and fair reporting by the press on a matter of public interest be dealt with in the defences to the cause of action, by including as a defence information disclosed as a matter of public interest or a fair comment on a matter of public interest.[197]

74.144 Some stakeholders suggested that the reference to freedom of expression and fair comment by the media in the defences may be problematic. Arguably, it would allow unmeritorious claims to proceed, with defendants being forced to wait until the defence case was called before evidence supporting the defence case was led.

74.145 The ALRC agrees with the APC that the public interest in allowing freedom of expression is an essential criterion to be used to determine ‘the balance between privacy rights for individuals and the public’s right to the free flow of information on matters of public concern’.[198]

74.146 As discussed in Chapter 5, the right to privacy is one of a number of fundamental human rights set out in the ICCPR and other international instruments. The right is not absolute, and privacy competes with other rights and interests, such as freedom of expression. In McKennitt v Ash, Eady J noted that the balancing of these rights does not occur in a vacuum and public attitudes towards the correct balancing of rights may change along with societal expectations:

It is clear that [in the United Kingdom] there is a significant shift taking place as between, on the one hand, freedom of expression for the media and the corresponding interest of the public to receive information, and, on the other hand, the legitimate expectation of citizens to have their private lives protected … Even where there is a genuine public interest, alongside a commercial interest in the media in publishing articles or photographs, sometimes such interests would have to yield to the individual citizen’s right to the effective protection of private life.[199]

74.147 Rather than attempt to protect other rights through a defence, the ALRC agrees it would be better in principle and in practice to add an additional element to the cause of action for a serious invasion of privacy. This would ensure that privacy interests are not privileged over other rights and interests.[200]

74.148 One option would be to require the courts to balance the privacy claim against any other rights and important public interests when determining whether the cause of action is established. In particular, freedom of expression in its broader sense should be considered a key public interest. Other public interests that were identified by the NSWLRC as potentially likely to arise in the context of an invasion of privacy are: matters relating to national security; the commission of criminal conduct; and threats to public health and safety.[201]

74.149 Article 19 of the ICCPR states that:

(1) Everyone shall have the right to hold opinions without interference.

(2) Everyone shall have the right to freedom of expression; this right shall include freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of his choice.

(3) The exercise of the rights provided for in paragraph 2 of this article carries with it special duties and responsibilities. It may therefore be subject to certain restrictions, but these shall only be such as are provided by law and are necessary:

a) For respect of the rights or reputation of others;

b) For the protection of national security or of public order (ordre public), or of public health or morals.

74.150 Freedom of expression is given some limited forms of protection in Australian law—particularly under the Australian Constitution, which is discussed below. The common law, and some federal, state and territory legislation, also provide limited protection to certain categories of expression.[202] For instance, all Australian jurisdictions are subject to at least one ‘freedom of information’ regime, the objectives of which include the fostering of public debate and discussion.[203]

74.151 As noted in Chapter 42, notwithstanding the absence of explicit constitutional protection for free speech, in a series of cases culminating in Lange v Australian Broadcasting Corporation, the High Court has held that the Australian Constitution must be read as impliedly protecting a particular category of expression—namely, political communication.[204] Other jurisdictions, such as the UK[205] and New Zealand,[206] recognise freedom of expression in a statutory bill of rights.

74.152 Regardless of whether it is protected by a constitutional or a statutory bill of rights, freedom of expression tends to be conceived, and protected, in a manner that is broadly consistent with the approach taken in art 19 of the ICCPR.[207] In other words, freedom of expression is regarded as a human right of fundamental importance—though, in certain circumstances, even this right must be reconciled with other competing rights or interests.

74.153 The Human Rights Act 1998 (UK) includes a provision in s 12 which requires the courts to have particular regard to freedom of expression and art 10 of the ECHR when granting any relief which may impact on freedom of expression.

74.154 Although Australia is a signatory to the ICCPR, it would be difficult for the test under this cause of action to require the balancing of ‘privacy rights’ with the ‘right to freedom of expression’, as neither right has been given effect in domestic legislation, except in relation to information privacy under the Privacy Act. The ALRC also recommends the adoption of a broader conception of freedom of expression than is currently contained in the High Court cases which have found the existence of an implied constitutional right.[208] In particular, protection should not be limited to political speech. Nor should it be limited only to reporting by the media, as artistic and other creative works could also fall within ‘freedom of expression’.

74.155 Chapter 5 notes that, although the right to privacy is an individual right, there is a strong public interest in protecting that right. There is also a public interest in allowing freedom of expression, and the free flow of information, in an open and democratic society.[209] A statutory cause of action would provide an opportunity to ensure that the appropriate balance between the public interests in protection of privacy and freedom of expression (and other public interests) is struck. Recognition of these other public interests simply reflects the fact that the right to privacy is not absolute. In appropriate circumstances, it will have to give way to other competing interests.

74.156 As noted above, and in Chapter 5, public interests can be, and frequently are, balanced against each other by the courts. In the traditional breach of confidence cases under the common law, the court can determine that the public interest in the protection of confidences is outweighed by a greater public interest in disclosure.[210] In the protection of confidential information under s 126 of the Evidence Act 1995 (NSW), the court must balance a number of public interests, including the probative value of the evidence in the proceeding and the nature of the offence, with the likelihood of harm to the protected confider in adducing the evidence, and then decide if it is appropriate to give a direction under the section.

74.157 The ALRC, therefore, recommends that, in determining whether an individual’s privacy has been invaded for the purpose of establishing the cause of action for serious invasion of privacy, the court must take into account whether the public interest in maintaining the claimant’s privacy outweighs other matters of public interest—including the interest of the public to be informed about matters of public concern and the public interest in allowing freedom of expression.

The role of consent

74.158 In most cases, consent—whether express or implied by the claimant or some person entitled to consent on the claimant’s behalf—will provide an answer to a cause of action for invasion of privacy. Legislatively, it can be dealt with in the following ways.[211] It can:

  • be included as an essential element of the cause of action—for example, to use ‘letters, diaries or other personal documents of a person … without the consent, express or implied, of the person or some other person who has the lawful authority to give the consent’, may in a variety of circumstances constitute an invasion of privacy;[212]

  • be considered when determining whether there was a reasonable expectation of privacy in all the circumstances, or as a circumstance in determining whether the act complained of meets the test of ‘sufficiently serious to cause substantial offence to a person of ordinary sensibilities’;

  • operate as an exception to the general cause of action;[213] or

  • be a defence to an action.[214]

74.159 While one stakeholder argued that consent should be included as a defence to an action, in the ALRC’s view, issues of consent are best dealt with in terms of an essential element of the cause of action. In particular, consent should be considered when determining whether the claimant had a reasonable expectation of privacy in the circumstances or when determining whether the act complained of was sufficiently serious to cause substantial offence to a person of ordinary sensibilities. This is consistent with the approach to consent adopted in the protection of personal information. Consent should be considered in the first instance when determining whether there has been a breach of the privacy principles, not as a defence to justify a breach.[215]

Natural persons

74.160 In DP 72, the ALRC proposed that the cause of action only be available for natural persons,[216] on the basis that the desire to protect privacy is founded on notions of individual autonomy, dignity and freedom.[217] In Chapter 7, the ALRC discusses the reasons why privacy laws are restricted to individuals, and supports the view that it is not appropriate to extend privacy protection to corporations and other commercial entities. Extending the protection of a human right to an entity that is not human is inconsistent with the fundamental approach of Australian privacy law.

Intentional or reckless acts

74.161 An act is intentional when the defendant deliberately or wilfully invades the plaintiff’s privacy. Section 5.4 of the Criminal Code (Cth) defines ‘recklessness’ as follows:

(1) A person is reckless with respect to a circumstance if:

(a) he or she is aware of a substantial risk that the circumstance exists or will exist; and

(b) having regard to the circumstances known to him or her, it is unjustifiable to take the risk.

(2) A person is reckless with respect to a result if:

(a) he or she is aware of a substantial risk that the result will occur; and

(b) having regard to the circumstances known to him or her, it is unjustifiable to take the risk.

(3) The question whether taking a risk is unjustifiable is one of fact.

(4) If recklessness is a fault element for a physical element of an offence, proof of intention, knowledge or recklessness will satisfy that fault element.

74.162 The Law Reform Commission of Hong Kong, in recommending a cause of action for intrusion into the solitude, seclusion or private affairs of another person, rejected the suggestion that a plaintiff should be allowed to recover for accidental or negligent intrusions. It was of the view, however, that liability should lie for reckless intrusions:

Since indifference to the consequences of an invasion of privacy is as culpable as intentionally invading another’s privacy, we consider that an intrusion must be either intentional or reckless before the intruder could be held liable.[218]

74.163 The NSWLRC suggested that ‘including liability for negligent or accidental acts in relation to all invasions of privacy would, arguably, go too far’.[219]

74.164 The ALRC agrees with the NSWLRC, and recommends that the fault element of the cause of action for invasion of privacy should be restricted to intentional or reckless acts on the part of the respondent.

Proof of damage

74.165 The statutes of British Columbia, Saskatchewan, Manitoba, and Newfoundland and Labrador providing for the tort of violation of privacy all specify that the tort of violation of privacy is actionable without proof of damage. In other words, the cause of action is actionable per se—there is no requirement on the claimant to prove that any actual damage arose from the invasion of privacy.

74.166 In this regard, the Canadian tort of invasion of privacy differs from the tort of negligence, in that proof of damage is an essential element of the latter. The treatment of the tort of invasion of privacy is, therefore, more akin to trespass to the person or defamation, which are actionable without proof of damage.

74.167 Following this course would allow for an award of compensation for insult and humiliation.[220] It also would allow the court to award a wider range of remedies to address the invasion—for example, an order requiring the respondent to apologise to the claimant.

74.168 Finally, providing that invasion of privacy is actionable without proof of damage is itself recognition that the cause of action protects a fundamental human right, which should not be dependent on proof of damage flowing from the breach.[221]

Defences

74.169 The defences to a cause of action for invasion of privacy in other jurisdictions generally include:

  • the act or conduct was incidental to the exercise of a lawful right of defence of person or property;
  • the act or conduct was authorised or required by or under law;
  • the disclosure of information was of public interest or was fair comment on a matter of public interest; or
  • the disclosure of information was, under defamation law, privileged.[222]

74.170 As noted above, the ALRC considers that the defence of disclosure in the public interest or fair comment on a matter of public interest should form part of the elements of the cause of action.

Required or authorised by or under law

74.171 Another important defence is that the act or conduct was required or authorised by or under law. This defence assumes particular importance in the context of law enforcement and national security.

74.172 In Chapter 16, the scope of this exception in the context of the Privacy Act is discussed in detail. The Privacy Act generally should not fetter a government’s discretion to require or authorise that personal information be handled in a particular way. It follows, therefore, that a requirement that the act or conduct was required or authorised by or under law would be a defence to the statutory cause of action. As discussed in Chapter 16, the ALRC’s view is that the definition of ‘law’ for the purposes of the ‘required or authorised by or under law’ exception should include Commonwealth and state and territory Acts and delegated legislation as well as duties of confidentiality under common law or equity.[223]

Other defences

74.173 The requirement for the court to balance the public interest in maintaining the claimant’s privacy against other public interests, including freedom of expression, will address many of the concerns raised by the APC, and other media and arts interest groups.

74.174 Consequently, the additional defences of consent, information already being in the public domain, and disclosure for the purpose of rebutting an untruth—as proposed by the APC—are unnecessary. If the claimant had consented to the invasion of his or her privacy or the information was already public, it is unlikely that the elements of the cause of action would be satisfied. In other words, the claimant would not have a reasonable expectation of privacy nor would publication be highly offensive to a reasonable person of ordinary sensibilities.

74.175 Publication made for the purpose of rebutting an untruth on behalf of a claimant is already adequately covered by the public interest test. This is illustrated by Campbell[224] where the fact that Campbell was a drug addict was conceded by Campbell to be a publishable fact—there was a public interest in correcting the public statements made that she did not use drugs.

Remedies

74.176 In NSWLRC CP 1, the NSWLRC, as noted above, articulates the range of remedies that could be used to address an invasion of privacy. Given the wide range of circumstances in which an action for invasion of privacy may be brought under the statute, the ALRC agrees with the NSWLRC that it makes sense to ‘enable the court to choose the remedy that is most appropriate in the fact situation before it, free from the jurisdictional constraints that may apply to that remedy in the general law’.[225]

74.177 In DP 72, the ALRC proposed that the following remedies should be available:

  1. damages, including aggravated damages, but not exemplary damages;
  2. an account of profits;
  3. an injunction;
  4. an order requiring the respondent to apologise to the claimant;
  5. a correction order;
  6. an order for the delivery up and destruction of material; and
  7. a declaration.[226]

74.178 In response to the concerns expressed by the APC that an account of profits could be unworkable, the ALRC notes that courts only would choose to apply this in circumstances where an account of profits could be determined. An account of profits is an equitable remedy for breach of confidence, breach of fiduciary duty and infringement of intellectual property.[227] It has been acknowledged, in those contexts, that it may be hard to determine a defendant’s ‘profit’, because of difficulties determining how much of the profit is attributable to the breach and how much to other factors (such as the defendant’s skill). Nonetheless, courts have said that this difficulty will not preclude assessment, where possible.[228] An account of profits was included as one of the remedies in the Irish Privacy Bill.[229]

74.179 The ALRC does not agree that the availability of a court-ordered apology will lead to a disincentive on the part of claimants to settle. The main incentive for an out of court settlement is to save time, costs and the possible emotional trauma of a court hearing.

74.180 Therefore, the ALRC does not recommend any change to the proposal as set out in DP 72.

Should the statutory cause of action be in federal legislation?

74.181 Having recommended statutory recognition of a cause of action for a serious invasion of privacy, a question arises about where the cause of action should be located.

74.182 Inconsistency and fragmentation of laws regulating the handling of personal information were major issues in this Inquiry.[230] To avoid a similar problem arising in relation to the enactment of a statutory cause of action for invasion of privacy, it is desirable to ensure national consistency from the outset. Models for achieving national consistency are canvassed in detail in Chapter 3.

74.183 Supporters of a statutory cause of action also issued a plea for uniformity. The Centre for Law and Genetics, for example, stated that, if a statutory cause of action were developed, ‘it is critically important that it should be consistent across Australia, either as uniform state and territory legislation through agreement between the relevant Ministers, or as federal legislation’.[231] The OPC noted that

it would be preferable to introduce a tort of privacy in a uniform manner throughout Australia, particularly to avoid inconsistencies and ‘forum shopping’ … Nevertheless, by what method a tort would be established and in what manner it would be introduced, it should not contribute to the national inconsistency that currently exists in the privacy laws arena.[232]

74.184 Most of those in favour of a statutory cause of action expressed the view that it should be enacted in federal legislation. The Queensland Government, for example, recommended that, ‘if implementation of a statutory cause of action for breach of privacy is proposed, such a cause of action should be located in federal legislation’.[233] Similarly, AAMI stated, ‘the legislation should definitely be federal (one set of rules for the whole country). The Privacy Act is the logical place for it’.[234]

74.185 Professor Graham Greenleaf, Nigel Waters and Associate Professor Lee Bygrave of the Cyberspace Law and Policy Centre suggested that:

Given that the Commonwealth has asserted constitutional power in relation to the protection of privacy in the private sector, it may be consistent with this for the Commonwealth to also legislate, in the Privacy Act, for a statutory tort or torts to protect other aspects of privacy in relation to the private sector. It will be necessary to carefully align the elements of a statutory privacy tort with what is already protected by privacy principles.[235]

74.186 For the reasons outlined in Chapter 3, the ALRC considers that the federal government has the constitutional power to enact a statutory cause of action for serious invasion of privacy, to the exclusion of state and territory legislation. The federal government could decide, however, to include a provision that provides that the federal Act is not intended to exclude or limit the operation of a law of a state or territory that is capable of operating concurrently with the federal Act.[236] If the latter policy option prevails, it is essential to ensure that the states and territories enact uniform legislation. Failure to do so would give rise to the fragmentation and inconsistency that has characterised the regulation of information privacy to date.

74.187 The ACT Department of Justice and Community Safety expressed concern that a cause of action for serious invasion of privacy may be enacted to the exclusion of state and territory legislation. In particular, the Department expressed concern that the Human Rights Act 2004 (ACT) should not be excluded or limited by the operation of the statutory cause of action. Consequently, it would support the inclusion of an express provision in any federal legislation to the effect that the statutory cause of action is not intended to exclude or limit the operation of state and territory laws such as the Human Rights Act.[237]

74.188 The South Australian Government did not support any move to apply the cause of action to state public sectors through application of the Privacy Act to state bodies.[238]

74.189 In the ALRC’s view, to ensure uniformity and to avoid the problems associated with inconsistent legislation, the statutory cause of action for invasion of privacy should be in federal legislation and should cover federal agencies, organisations and individuals. It also should cover state and territory public sector agencies, subject to any of the constitutional limitations discussed in Chapter 3.[239]

74.190 The ALRC acknowledges that this approach differs from the proposed model for reform of information privacy legislation relating to the state and territory public sectors discussed in Chapter 3. The difference is warranted, however, because the handling of personal information is currently regulated in all state and territory public sectors. As no states or territories currently have a statutory cause of action for invasion of privacy, failure to extend the coverage of the cause of action to state and territory public sectors would result in gaps in coverage, rather than merely inconsistent regulation.

74.191 If, however, states and territories adopted mirror legislation enacting the cause of action, or a cooperative scheme to regulate state and territory public sectors,[240] then there would be no need for the federal legislation to cover the state and territory public sectors. It is important to ensure that a consistent regime is enacted—how precisely that is achieved is a matter for government.

Should the statutory cause of action be in the Privacy Act?

74.192 The prevailing view of supporters of a cause of action for invasion of privacy is that the cause of action should be enacted in federal legislation. In response to IP 31, the OPC suggested that the role, if any, to be played by the Privacy Commissioner should determine the location of the cause of action.

If the tort is actionable via the complaints process administered by the Privacy Commissioner, then there may be merit in streamlining all privacy-related complaints through this process. By contrast, if the tort will be actionable directly in the Courts it may be preferable to create a separate statute, to distinguish the tort of invasion of privacy from complaints handled under the Privacy Act.[241]

74.193 The recommended cause of action for invasion of privacy extends beyond information privacy, which is the current focus of the Privacy Act. Disclosure of personal information, however, may give rise to both a breach of the privacy principles and liability under the cause of action. Conversely, adherence to guidelines issued by the OPC, or protocols designed to ensure compliance with privacy principles, may be a relevant factor in determining whether the privacy principles have been breached, or the elements of the cause of action made out.

74.194 The same circumstances, therefore, may give rise to a complaint to the Privacy Commissioner under the Privacy Act, and an action in court for invasion of privacy. While the statute could provide that an individual must choose either to lodge a complaint or institute a cause of action, the ALRC considers that such a requirement is undesirable. An individual should be able to choose the forum that will provide the most appropriate remedy. The costs associated with pursuing the action or complaint also will be a relevant factor. Further, if pursuing both avenues simultaneously can be shown to be unfair, the proceedings in one forum may be stayed pending the outcome in the other forum.[242]

74.195 In DP 72, the ALRC’s preliminary view was that the Privacy Act should be amended to include a new part setting out the provisions relating to the cause of action for a serious invasion of privacy. However, the ALRC now takes the view that there may be significant confusion arising from the placement of the cause of action in that Act. For example, whether the exemptions under the Privacy Act applied to the cause of action, and the interaction between the cause of action and other complaint mechanisms, may be unclear if the Privacy Act were amended to include the cause of action. The ALRC therefore recommends that the cause of action should be enacted in a separate federal statute. The legislation should abolish any common law action for the invasion or violation of a person’s privacy.

74.196 A related, but separate, question is whether the appropriate forum to bring the action is the state and territory or federal courts. Locating the cause of action in federal legislation does not preclude state courts from hearing such matters. The use of state courts to hear federal matters is made possible by ss 71 and 77(iii) of the Australian Constitution. Section 71 vests the judicial power of the Commonwealth in the High Court, in such other federal courts as the Australian Parliament creates, and in such other courts as it invests with federal jurisdiction. Section 77(iii) provides that the Australian Parliament may make laws investing state courts with federal jurisdiction. Section 39(2) of the Judiciary Act 1903 (Cth) invests state courts with federal jurisdiction in both civil and criminal matters, subject to certain limitations and exceptions.[243]

74.197 The appropriate court to hear the action will depend on the circumstances giving rise to liability, and the nature and extent of the remedies claimed. If the cases brought to date in Australia are any guide, it is likely that the district and county courts will be the most appropriate forum given the scope of their jurisdiction, the cost of litigating in those courts, and the expertise of the judges in hearing comparable matters, such as tort actions.

74.198 It is important that the general public be informed about activities that may give rise to liability under the cause of action, including the possible consequences of publishing material on the internet.[244] The ALRC recommends that the OPC provide information to the public concerning the recommended statutory cause of action. This is consistent with the Privacy Commissioner’s oversight and educational functions under s 27 of the Privacy Act.

Federal legislation should provide for a statutory cause of action for a serious invasion of privacy. The Act should contain a non-exhaustive list of the types of invasion that fall within the cause of action. For example, a serious invasion of privacy may occur where:

  1. there has been an interference with an individual’s home or family life;
  2. an individual has been subjected to unauthorised surveillance;
  3. an individual’s correspondence or private written, oral or electronic communication has been interfered with, misused or disclosed; or
  4. sensitive facts relating to an individual’s private life have been disclosed.

Federal legislation should provide that, for the purpose of establishing liability under the statutory cause of action for invasion of privacy, a claimant must show that in the circumstances:

  1. there is a reasonable expectation of privacy; and
  2. the act or conduct complained of is highly offensive to a reasonable person of ordinary sensibilities.

In determining whether an individual’s privacy has been invaded for the purpose of establishing the cause of action, the court must take into account whether the public interest in maintaining the claimant’s privacy outweighs other matters of public interest (including the interest of the public to be informed about matters of public concern and the public interest in allowing freedom of expression).

Federal legislation should provide that an action for a serious invasion of privacy:

  1. may only be brought by natural persons;
  2. is actionable without proof of damage; and
  3. is restricted to intentional or reckless acts on the part of the respondent.

The range of defences to the statutory cause of action for a serious invasion of privacy provided for in federal legislation should be listed exhaustively. The defences should include that the:

  1. act or conduct was incidental to the exercise of a lawful right of defence of person or property;
  2. act or conduct was required or authorised by or under law; or
  3. publication of the information was, under the law of defamation, privileged.

To address a serious invasion of privacy, the court should be empowered to choose the remedy that is most appropriate in the circumstances, free from the jurisdictional constraints that may apply to that remedy in the general law. For example, the court should be empowered to grant any one or more of the following:

  1. damages, including aggravated damages, but not exemplary damages;
  2. an account of profits;
  3. an injunction;
  4. an order requiring the respondent to apologise to the claimant;
  5. a correction order;
  6. an order for the delivery up and destruction of material; and
  7. a declaration.

Federal legislation should provide that any action at common law for invasion of a person’s privacy should be abolished on enactment of these provisions.

The Office of the Privacy Commissioner should provide information to the public concerning the recommended statutory cause of action for a serious invasion of privacy.

 

[165] R Toulson and C Phipps, Confidentiality (2nd ed, 2006).

[166] R Toulson, ‘Freedom of Expression and Privacy’ (Paper presented at Association of Law Teachers Lord Upjohn Lecture, London, 9 February 2007), 7.

[167] A case note on Doe v ABC published in the Australian Press Council News noted, ‘if a privacy tort were defined by statute, it could incorporate workable defences. In addition to a strong public interest defence, a defence could be based on an appropriate offer-of-amends procedure’: I Ryan, ‘Doe v ABC—A Case Note’ (2007) 19(2) Australian Press Council News <www.presscouncil.org.au>, 7.

[168]Doe v Australian Broadcasting Corporation [2007] VCC 281, [157].

[169] New South Wales Law Reform Commission, Invasion of Privacy, Consultation Paper 1 (2007), [1.7].

[170] Ibid, [1.7].

[171] D Butler, ‘A Tort of Invasion of Privacy in Australia?’ (2005) 29 Melbourne University Law Review 339, 368.

[172] See, eg, s 3(c) of the uniform Defamation Act 2005 in force in New South Wales, Victoria, Queensland, Western Australia, South Australia, Tasmania, and the Northern Territory.

[173]Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd (2001) 208 CLR 199, [125].

[174] For a discussion of the application to appropriation cases of intellectual property law, the tort of ‘passing off’ and the development of a ‘right of publicity’, see R Zapparoni, ‘Propertising Identity: Understanding the United States Right of Publicity and its Implications—Some Lessons for Australia’ (2004) 28 Melbourne University Law Review 690. For a discussion of information privacy as a form of property, see J Rule, ‘Towards Strong Privacy: Values, Markets, Mechanisms, and Institutions’ (2004) 54 University of Toronto Law Journal 183. A contrary view is discussed in R Toulson and C Phipps, Confidentiality (2nd ed, 2006), [2–056]–[2–066].

[175]OBG Ltd v Allan; Douglas v Hello! Ltd [2007] 2 WLR 920.

[176]Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd (2001) 208 CLR 199, [42].

[177]Hosking v Runting [2005] 1 NZLR 1, [164].

[178]Campbell v MGN Ltd [2004] 2 AC 457.

[179] M Moreham, ‘Privacy in Public Places’ (2006) 65 Criminal Law Journal 606.

[180] In the ALRC’s view, the interpretation of Von Hannover, suggested by Professor Phillipson, is the preferable approach for Australian courts to adopt.

[181] New South Wales Law Reform Commission, Invasion of Privacy, Consultation Paper 1 (2007), [7.5].

[182]Hosking v Runting [2005] 1 NZLR 1, [117].

[183] New South Wales Law Reform Commission, Invasion of Privacy, Consultation Paper 1 (2007), [7.6].

[184]Campbell v MGN Ltd [2004] 2 AC 457, [22].

[185]Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd (2001) 208 CLR 199, [42].

[186] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), [5.80].

[187] Australian Law Reform Commission, Unfair Publication: Defamation and Privacy, ALRC 11 (1979), [236].

[188] This example is loosely drawn from the circumstances in Giller v Procopets [2004] VSC 113 and Grosse v Purvis (2003) Aust Torts Reports 81–706.

[189] This example is loosely drawn from the circumstances described in D Emerson, ‘SBS: Camera in Change Room’, Sydney Morning Herald, 5 May 2008, <www.smh.com.au>; L McKenny, ‘SBS Ignored Peeping Tom Alert: Inquiry’, Sydney Morning Herald, 22 May 2008, <www.smh.com.au>; and ‘Perve Films Flatmate with Teddy Bear Camera’, Sydney Morning Herald, 24 April 2008, <www.smh.com.au>.

[190] This example is loosely drawn from the circumstances in ‘AFL Up in Arms Over Records Leak’, ABC News Online, 29 April 2007, <www.abc.net.au>; C Ornstein, ‘UCLA Workers Snooped in Spears’ Medical Records’, Los Angeles Times, 15 March 2008, <www.latimes.com>; and R Goldman, ‘Clooney Proves Private Health Records Not So Private’, ABC News (US), 11 October 2007, <www.abcnews.go.com>.

[191]This example is loosely drawn a number of ‘files on the footpath’ cases, including M Moore, ‘Private Files Put on Street for All to Read’, Sydney Morning Herald, 6 May 2008, <www.smh.com.au>; A Falk, ‘Health Files are Sold as Scrap Paper to Utah’, Deseret News, 10 March 2008 <deseretnews.com>; ‘Report Details Private Health Records Misplaced in Public Places’, ABC News Online, 4 October 2006, <www.abc.net.au>.

[192] For example, the Crimes Act 1900 (NSW) creates offences of peeping or prying or stalking. In addition, the Summary Offences Act 1988 (NSW) creates an offence of filming someone without their consent for a sexual purpose.

[193]Giller v Procopets [2004] VSC 113.

[194]OBG Ltd v Allan; Douglas v Hello! Ltd [2007] 2 WLR 920, [111], cited in New South Wales Law Reform Commission, Invasion of Privacy, Consultation Paper 1 (2007), [123].

[195] See, eg, Health Informatics Society of Australia, Submission PR 554, 2 January 2008; Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; National Children’s and Youth Law Centre, Submission PR 491, 19 December 2007; Australia’s National Computer Emergency Response Team, Submission PR 474, 14 December 2007; Privacy NSW, Submission PR 468, 14 December 2007; Youth Affairs Council of Victoria Inc, Submission PR 388, 6 December 2007; J Watts, Submission PR 302, 10 July 2007; Office of the Privacy Commissioner, Submission PR 215, 28 February 2007; Legal Aid Commission of New South Wales, Submission PR 107, 15 January 2007.

[196] C Calvert, Voyeur Nation: Media, Privacy, and Peering in Modern Culture (2000), cited in D Solove, M Rotenberg and P Schwartz, Information Privacy Law (2nd ed, 2006), 100.

[197] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 5–5.

[198] Australian Press Council, Submission PR 48, 8 August 2006.

[199]McKennitt v Ash [2005] EMLR 10, [57].

[200] This was also the view taken by the ALRC in regards to the review of sedition offences in 2006. Those offences contained a defence for media, which the ALRC recommended should be changed to require the trier of fact to take into account whether the conduct was done in specific circumstances: Australian Law Reform Commission, Fighting Words: A Review of Sedition Laws in Australia, ALRC 104 (2006), Rec 12–2.

[201] New South Wales Law Reform Commission, Invasion of Privacy, Consultation Paper 1 (2007), [7.37].

[202] See M Chesterman, Freedom of Speech in Australia: A Delicate Point (2000), 7–13.

[203]Freedom of Information Act 1982 (Cth); Freedom of Information Act 1989 (NSW); Freedom of Information Act 1982 (Vic); Freedom of Information Act 1992 (Qld); Freedom of Information Act 1992 (WA); Freedom of Information Act 1991 (SA); Freedom of Information Act 1991 (Tas); Freedom of Information Act 1989 (ACT); Information Act 2002 (NT).

[204]Lange v Australian Broadcasting Corporation (1997) 189 CLR 520.

[205]Human Rights Act 1998 (UK) ss 12–13.

[206]New Zealand Bill of Rights Act 1990 (NZ) ss 13–14.

[207]Convention for the Protection of Human Rights and Fundamental Freedoms, 10 December 1948, Council of Europe, ETS No 005, (entered into force generally on 3 September 1953).

[208]Lange v Australian Broadcasting Corporation (1997) 189 CLR 520.

[209]Hinch v Attorney-General (Vic) (1987) 164 CLR 15, 86 (Gaudron J).

[210] New South Wales Law Reform Commission, Invasion of Privacy, Consultation Paper 1 (2007), [7.29], citing Attorney-General v Guardian Newspapers Ltd (No 2) [1990] 1 AC 109.

[211] Generally see Ibid, [7.12]–[7.17].

[212]Privacy Act 1978 RSS c P–24 (Saskatchewan) s 3(d) (emphasis added).

[213]Privacy Act 1996 RSBC c 373 (British Columbia) s (2)(a).

[214]Privacy Act 1990 RSNL c P–22 (Newfoundland and Labrador) s 5(1)(a); Privacy Act 1978 RSS c P–24 (Saskatchewan) s 4(1)(a); Privacy Act CCSM s P125 (Manitoba) s 5(a). See also, Hong Kong Law Reform Commission, Civil Liability for Invasion of Privacy (2004), recs 4, 9.

[215] The role of consent in the context of the model UPPs is discussed in detail in Ch 19.

[216] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 5–3.

[217]Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd (2001) 208 CLR 199, 225.

[218] Hong Kong Law Reform Commission, Civil Liability for Invasion of Privacy (2004), [6.71].

[219] New South Wales Law Reform Commission, Invasion of Privacy, Consultation Paper 1 (2007), [7.24].

[220] F Trindade and P Cane, The Law of Torts in Australia (3rd ed, 1999), 23.

[221] For a discussion of the status of privacy as a human right, see Ch 1.

[222] See, eg, Privacy Act 1990 RSNL c P–22 (Newfoundland and Labrador) s 5; Privacy Bill 2006 (Ireland) cl 5(1), 6. For the types of disclosure covered by privilege in defamation law, see ss 27 and 30 of the Uniform Defamation Act 2005 in force in New South Wales, Victoria, Queensland, Western Australia, South Australia, Tasmania and the Northern Territory.

[223] As such, the concerns raised by the New South Wales Department of Corrective Services would fall under this defence.

[224]Campbell v MGN Ltd [2004] 2 AC 457.

[225] New South Wales Law Reform Commission, Invasion of Privacy, Consultation Paper 1 (2007), [8.3].

[226] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 5–6.

[227] M Tilbury, Civil Remedies (1990), [4079].

[228]Docker v Somes (1834) 39 All ER 1094, 1101.

[229] Privacy Bill 2006 (Ireland), cl 8. See also New South Wales Law Reform Commission, Invasion of Privacy, Consultation Paper 1 (2007), [8.30].

[230] See Part C.

[231] Centre for Law and Genetics, Submission PR 127, 16 January 2007.

[232] Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.

[233] Queensland Government, Submission PR 242, 15 March 2007.

[234] AAMI, Submission PR 147, 29 January 2007.

[235] G Greenleaf, N Waters and L Bygrave—Cyberspace Law and Policy Centre UNSW, Submission PR 183, 9 February 2007.

[236] For an example of such a provision, see the Age Discrimination Act 2004 (Cth) s 12(3).

[237] ACT Department of Justice and Community Safety, Submission PR 577, 12 March 2008.

[238] Government of South Australia, Submission PR 565, 29 January 2008.

[239] The distinction between federal, state and territory agencies is discussed in detail in Ch 34.

[240] See Ch 3.

[241] Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.

[242] For a discussion of the power of a court to grant a stay, see Walton v Gardiner (1993) 177 CLR 380, 392–393; S Odgers, Uniform Evidence Law (6th ed, 2004), [1.1.1240]–[1.1.1260]. For a discussion of the complaint-handling powers of the OPC, see Ch 49.

[243] See Australian Law Reform Commission, The Judicial Power of the Commonwealth, ALRC 92 (2001).

[244] See S Hawkins, Submission PR 382, 6 December 2007.