44.35 A number of submissions to this Inquiry—in particular, those from private investigators and related industry associations—commented on the impact of privacy laws on the ability of individuals to establish, pursue or defend legal rights, such as in debt recovery. The Australian Investigators Association, for example, commented that:
The inability to locate a contact address for an individual who is a witness to an incident such as an accident, fraud or other crimes essentially amounts to a denial of natural justice for the affected parties (defendants) as an investigator cannot complete his or her tasks unless the witness is located.
44.36 One commercial investigator advised that he frequently acts in matters where law enforcement or regulatory agencies have declined to investigate based on commercial considerations. He noted a speech by Nicholas Cowdrey QC (the New South Wales Director of Public Prosecutions), where he stated that frauds below a certain threshold— potentially including frauds of a value of $10,000—will generally not be investigated by the police.
44.37 The issue also was raised by a small business owner who rents out household whitegoods:
Many of our customers are recipients of Centrelink benefits … Unfortunately, we are finding that a number of these people are paying their rent through Centrepay, for a short time, and then disappearing with our goods. Naturally, we attempt to trace these people, but due to the Privacy Act, we are given no assistance by Centrelink. The last two days have been spent on the telephone trying to find someone who can help us, all to no avail. Every person spoken to continually refers to the Privacy Act.
44.38 There is no general exemption from the requirements of the Privacy Act for the purpose of establishing, pursuing or defending a legal claim. Some of the exceptions to the privacy principles, however, are of relevance. An organisation may collect sensitive information where ‘the collection is necessary for the establishment, exercise or defence of a legal or equitable claim’. In addition, some of the exceptions to the ‘Use and Disclosure’ principle could be relied upon by an organisation seeking to establish, pursue or defend its own legal claim against the individual to whom the information relates.
44.39 These provisions, however, do not cover the situation where an agency or organisation is asked to disclose personal information about a third party in order to further a third party’s legal claim. This is in contrast to the United Kingdom, where the Data Protection Act 1998 (UK) excepts personal information from the non-disclosure provisions
where the disclosure is necessary—
(a) for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), or
(b) for the purpose of obtaining legal advice,
or is otherwise necessary for the purposes of establishing, exercising or defending legal rights.
Other processes to obtain personal information
44.40 Personal information that is necessary for the purpose of establishing, pursuing or defending legal rights may be available other than through an exception to the Privacy Act. In particular, information may be obtained through the courts.
44.41 Through the discovery process, parties to litigation have the opportunity to obtain information relevant to the dispute. Although discovery is generally limited to a procedure between the parties, courts also may order third parties to make available information. For example, courts may allow intending litigants to obtain information that will help them to identify a prospective defendant. This can be illustrated by Order 15A of the Federal Court Rules 1979 (Cth), which provides:
Where an applicant, having made reasonable inquiries, is unable to ascertain the description of a person sufficiently for the purpose of commencing a proceeding in the Court against that person … and it appears that some person has or is likely to have knowledge of facts, or has or is likely to have or has had or is likely to have had possession of any document or thing, tending to assist in such ascertainment, the Court may make an order [that the person attend before the court or make discovery of the relevant document].
44.42 The ‘description’ of a person includes (among other information) their name, place of residence, place of business, occupation and sex. Information about the identity of a prospective defendant also can be obtained in equity.
44.43 Freedom of information legislation can sometimes provide another avenue through which individuals can obtain information to establish, pursue or defend legal rights. For example, an individual could apply to the state or territory register of vehicles for information on the registered operator of a vehicle.
44.44 There are clear public policy interests in individuals being able to establish, pursue and defend legal rights. If the application of the Privacy Act is preventing individuals from obtaining the necessary information to assert their legal rights, then changes may be justified. One way in which to do this is through an exception to the ‘Use and Disclosure’ principle along the lines of s 35(2) of the Data Protection Act (UK)—that is, where use or disclosure is necessary for the purposes of establishing, exercising or defending legal rights.
44.45 It is not apparent, however, that adding an exception to this effect would substantially improve the position of intending litigants. To fulfil the requirements of the exception, an agency or organisation must be satisfied that disclosing the information is ‘necessary’ for the above purposes. This requirement will be very difficult to meet in the absence of a court order. Furthermore, the provision functions only as an exception to permit the disclosure of information—it does not compel disclosure by an agency or organisation.
44.46 The United Kingdom Information Commissioner’s Office has issued legal guidance on the Data Protection Act, which confirms that a data controller is not obliged to disclose personal data following a request by a third party, despite the existence of the exception for the purposes of establishing, exercising or defending legal rights. It advises:
In many cases, the data controller will not be in a position to make a decision as to whether the necessity test can be met, or will not wish to make the disclosure because of his relationship with the data subject, with the result that the requesting party will have to rely upon a Court order to obtain the information.
44.47 Processes are in place through court orders to obtain information in the course of establishing, exercising or defending legal rights. Court processes also have well established rules to prevent abuse by the parties. For example, an employer may request another organisation with which it has a business relationship to provide information on an employee’s purchasing activities to see if the employee is misappropriating funds. Without some evidence that misappropriation was, in fact, occurring, courts would consider this to be a ‘fishing expedition’ and, therefore, impermissible. This safeguard potentially could be bypassed through an exception to the ‘Use and Disclosure’ principle for the purpose of pursuing a legal claim.
44.48 Judicial discretion also plays an integral role in court orders for discovery against third parties. That is, for each application, the requirements of justice to the applicant will be balanced against the respondent’s justification for non-disclosure. Commentators have noted that this discretion provides ‘an appropriate brake on any excesses in the use of the Order’. Indeed, it has been questioned whether an agency should ever disclose personal information, except on the order of a court.
44.49 The ALRC acknowledges the potential drawbacks to requiring an individual to commence court proceedings in order to obtain personal information that he or she needs in order to establish, pursue or defend his or her legal rights. In particular—depending upon the court in which proceedings are commenced—this can be both costly and time-consuming. Court orders made in accordance with established rules, however, are the most authoritative way to secure disclosure. In light of the potential for abuse, as well as its likely limited usefulness, the ALRC does not recommend the introduction of a new exception or exemption from the Privacy Act for the purpose of establishing, pursuing and defending legal rights.
Australian Mercantile Agents Association, Submission PR 508, 21 December 2007; Australian Investigators Association, Submission PR 507, 21 December 2007; Australian Collectors Association, Submission PR 505, 20 December 2007; R Lake, Submission PR 305, 19 July 2007.
Australian Investigators Association, Submission PR 507, 21 December 2007.
R Lake, Submission PR 305, 19 July 2007.
J Tozzi-Condivi, Submission PR 438, 10 December 2007.
Privacy Act 1988 (Cth) sch 3, NPP 10.1(e). Non-sensitive personal information can be collected under the general provision that the information is ‘necessary for one or more of its functions or activities’: Privacy Act 1988 (Cth) sch 3, NPP 1.1.
 See discussion in Ch 25.
Data Protection Act 1998 (UK) s 35(2).
Federal Court Rules 1979 (Cth) O 15A r 3.
Ibid o 15A r 1. Similar rules are in place in certain courts in New South Wales, Tasmania, Victoria, Western Australia, the ACT and the Northern Territory.
 Court orders to this effect are commonly referred to as ‘Norwich orders’, referring to the precedent established in the case of Norwich Pharmacal Co v Commissioners of Customs & Excise  AC 133.
Roads & Traffic Authority of NSW v Australian National Car Parks Pty Ltd  NSWCA 114. This is limited, however, as freedom of information laws include an exemption for documents that would involve the unreasonable disclosure of personal information.
United Kingdom Government Information Commissioner’s Office, Data Protection Act 1998 Legal Guidance (2001), 69.
 In this context, a ‘fishing expedition’ refers to seeking discovery of documents in the hope that they will reveal relevant evidence without any ground for believing that such evidence exists.
Norwich Pharmacal Co v Commissioners of Customs & Excise  AC 133, 175.
B Kremer and R Davies, ‘Preliminary Discovery in the Federal Court: Order 15A of the Federal Court Rules’ (2004) 24 Australian Bar Review 235.
 See the comments of Viscount Dilhorne to this effect: Norwich Pharmacal Co v Commissioners of Customs & Excise  AC 133, 190.