3.17 This section will examine the scope of the Commonwealth’s constitutional power to legislate with respect to privacy, and particularly its constitutional capacity to ‘cover the field’ in this area.
3.18 The Australian Constitution includes a list of subjects about which the Australian Parliament may make laws. That list does not expressly include privacy, but this does not mean that the Australian Parliament has no power in relation to privacy.
3.19 The Privacy Act was enacted on the basis of the Australian Parliament’s express power to make laws with respect to ‘external affairs’. The external affairs power enables the Australian Parliament to make laws with respect to matters physically external to Australia; and matters relating to Australia’s obligations under bona fide international treaties or agreements, or customary international law. The external affairs power is not confined to meeting international obligations, but may also extend to ‘matters of international concern’.
3.20 An important limitation on the scope of the external affairs power is that the Commonwealth Act must be an appropriate means of giving effect to the object of the relevant international treaty or agreement. The Preamble to the Privacy Act makes it clear that the legislation was intended to implement, at least in part, Australia’s obligations relating to privacy under the United Nations International Convention on Civil and Political Rights (ICCPR) as well as the Organisation for Economic Co-operation and Development Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (OECD Guidelines). The Second Reading Speech to the Privacy Bill also referred to the Council of Europe Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data. Section 3 of the Privacy Amendment (Private Sector) Act makes clear that the private sector amendments were also intended to meet Australia’s international obligations relating to privacy.
3.21 In addition to the ‘external affairs’ power, the Commonwealth may rely on other constitutional heads of power as a basis for legislating on privacy, including: s 51(v), which empowers the Australian Parliament to make laws with respect to ‘postal, telegraphic, telephonic, and other like services’; s 51(i), which empowers the Australian Parliament to make laws with respect to ‘trade and commerce with other countries, and among the States’; ss 51(xiii) and (xiv), which empower the Australian Parliament to make laws with respect to banking and insurance, but not state banking or state insurance unless it extends beyond the limits of the state; and s 51(xx), which empowers the Australian Parliament to make laws with respect to ‘foreign corporations, and trading or financial corporations formed within the limits of the Commonwealth’.
3.22 The Commonwealth may legislate so as to ‘cover the field’ (either expressly or impliedly) of a particular subject matter within its legislative powers. The Australian Parliament could pass legislation regulating the handling of personal information to the exclusion of the states and territories. Such legislation, however, would be affected by the express and implied restrictions applying to all Commonwealth constitutional powers, discussed below.
Express and implied constitutional limits
3.23 Express constitutional limitations include those in ss 51(xiii) and 51(xiv) of the Australian Constitution, which provide that the Australian Parliament may legislate with respect to banking and insurance, but not state banking or state insurance that does not extend beyond the limits of the state. ‘State banking’ for the purposes of s 51(xiii) is the business of banking conducted within a state by a bank owned or controlled by a state. Similarly, ‘state insurance’ bears its ordinary meaning, referring to an insurance business established and conducted by a state or its authority.
3.24 If the Privacy Act were to operate upon state banking or state insurance not extending beyond the limits of the state concerned, it would be constitutionally valid only so long as it could not be characterised as a law with respect to banking. The same rationale and outcome applies with respect to the insurance power.
3.25 Implied constitutional limitations include the principles that a federal law may not discriminate against a state, or prevent a state from continuing to exist and function as an independent unit of the federation. In Western Australia v The Commonwealth a majority of the High Court of Australia determined that:
For constitutional purposes, the relevant question is not whether State powers are effectively restricted or their exercise made more complex or subjected to delaying procedures by the Commonwealth law. The relevant question is whether the Commonwealth law affects what Dixon J [in Melbourne Corporation v The Commonwealth] called the ‘existence and nature’ of the State body politic … A Commonwealth law cannot deprive the State of the personnel, property, goods and services which the State requires to exercise its powers and cannot impede or burden the State in the acquisition of what it so requires.
3.26 While state powers may be ‘effectively restricted or their exercise made more complex or subjected to delaying procedures’ by the operation and requirements of the Privacy Act, the Act does not affect the existence and nature of the ‘State body politic’. The Commonwealth could legislate to regulate the handling of personal information in the state public and private sectors to the exclusion of the states.
3.27 Legislative provisions applying to public sector employees in the higher levels of state government may be one qualification to the Commonwealth’s power to exclude state and territory privacy legislation. The High Court has found that Commonwealth laws that seek to regulate state employees at the ‘higher levels of government’ (including ministers, ministerial assistants and advisers, heads of departments and judges) may interfere with the existence and nature of a state. Another limitation may be if the Privacy Act purported to regulate the handling of information that goes to the core of state government functions, such as cabinet-in-confidence documents and other highly sensitive documents.
3.28 These express and implied constitutional limitations do not apply to the territories because the Australian Parliament has plenary power to legislate in relation to them. Further, Commonwealth legislation regulating the handling of personal information in the private sector to the exclusion of state legislation would not breach either the express or implied restrictions on Commonwealth power.
Australian Constitution s 51(xxix). See Privacy Act 1988 (Cth) Preamble.
Horta v Commonwealth (1994) 181 CLR 183.
Commonwealth v Tasmania (1983) 158 CLR 1; Polyukhovich v Commonwealth (1991) 172 CLR 501; Horta v Commonwealth (1994) 181 CLR 183.
 In XYZ v The Commonwealth (2006) 227 CLR 532, the High Court stated that it was unnecessary to decide whether the Australian Parliament may make laws with respect to matters of ‘international concern’ because the Commonwealth could rely on other recognised aspects of the external affairs power to uphold the validity of the legislation under challenge. Kirby J, however, considered the concept of ‘international concern’ and concluded that the concept is still ‘undeveloped in Australia’: Ibid, –. Callinan and Heydon JJ, in dissent, also considered the concept of ‘international concern’. In their view, there is no case in the High Court deciding that the ‘international concern’ doctrine exists. They stated that there ‘are dicta which support the view, or which some contend support the view, that it does. But there is less to these dicta than meets the eye’: Ibid, .
R v Burgess; Ex parte Henry (1936) 55 CLR 608, 646; R v Poole; Ex Parte Henry (No 20) (1939) 61 CLR 364; Airlines of New South Wales v New South Wales (No 2) (1965) 113 CLR 54, 82, 102, 118, 126, 141; Commonwealth v Tasmania (1983) 158 CLR 1; Richardson v Forestry Commission (1988) 164 CLR 261. There remains legislative discretion to choose among appropriate means for implementing those obligations: Commonwealth v Tasmania (1983) 158 CLR 1, 130–131.
International Covenant on Civil and Political Rights, 16 December 1966,  ATS 23, (entered into force generally on 23 March 1976), art 17.
 Organisation for Economic Co-operation and Development, Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980). The OECD Guidelines are discussed further in Ch 1 and Part D.
Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data, 28 January 1981, Council of Europe, CETS No 108, (entered into force generally on 1 October 1985).
 Recent human rights legislation has been based on a range of constitutional powers. See, eg, Age Discrimination Act 2004 (Cth) s 10.
 For example, pt IIIA of the Privacy Act seeks to engage s 51(v) by regulating the use of ‘eligible communications services’ in the course of activities relevant to credit reporting. The term ‘eligible communications services’ is defined to mean ‘a postal, telegraphic, telephonic or other like service, within the meaning of paragraph 51(v) of the Constitution’: Privacy Act 1988 (Cth) s 6(1).
 This restriction is reflected in s 12A of the Privacy Act and is discussed further below.
 The Privacy Act is partly directed towards the actions of ‘organisations’ in respect of an individual’s personal information. ‘Organisation’ is defined to include ‘a body corporate’: Privacy Act 1988 (Cth) s 6C.
Botany Municipal Council v Federal Airports Corporation (1992) 175 CLR 453, 464–465.
Melbourne Corporation v Commonwealth (1947) 74 CLR 31, 52, 65, 70, 78, 86, 97.
Attorney-General (Victoria) v Andrews (2007) 233 ALR 389. See also P Lane, Lane’s Commentary on The Australian Constitution (1997), 215.
Bourke v State Bank of New South Wales (1990) 170 CLR 276, 290. The Court’s decision has been subject to criticism: D Rose, ‘Judicial Reasonings & Responsibilities in Constitutional Cases’ (1994) 20 Monash Law Review 195, 199–200.
Attorney-General (Victoria) v Andrews (2007) 233 ALR 389.
Melbourne Corporation v Commonwealth (1947) 74 CLR 31, 78; Victoria v Commonwealth (1957) 99 CLR 575; Queensland Electricity Commission v Commonwealth (1985) 159 CLR 192; Western Australia v Commonwealth (1995) 183 CLR 373.
Melbourne Corporation v Commonwealth (1947) 74 CLR 31, 78; Queensland Electricity Commission v Commonwealth (1985) 159 CLR 192; Victoria v Commonwealth (1971) 122 CLR 353; Re Australian Education Union; Ex parte Victoria (1995) 184 CLR 188; Austin v Commonwealth (2003) 215 CLR 185.
Western Australia v Commonwealth (1995) 183 CLR 373, 480.
 Ibid, 480.
 A number of pieces of federal human rights legislation, including the Age Discrimination Act 2004 (Cth), the Disability Discrimination Act 1992 (Cth) and the Racial Discrimination Act 1975 (Cth), regulate the activities of state and territory public sector authorities.
Re Australian Education Union; Ex parte Victoria (1995) 184 CLR 188, 233; Austin v Commonwealth (2003) 215 CLR 185.
Australian Constitution s 122.
 Re Lee; Ex parte Harper (1986) 160 CLR 430, 453; Western Australia v The Commonwealth (1995) 183 CLR 373, 477.