16.08.2010
Background
44.50 Private investigators provide investigative and legal support services to government agencies, corporate entities and the public in areas that include: fraud prevention, detection, assessment and resolution; corporate fraud and risk management services; insurance fraud and claims investigation, monitoring and assessment; aviation accident and loss investigation; marine loss investigations; occupational health and safety incident investigation; witness location and skip tracing; criminal investigations; child protection investigations; investigative journalism; family law investigations; intellectual property protection services; background checking; consumer investigations; and missing person investigations.[57]
44.51 The Privacy Act makes no specific provision for the activities of private investigators. Private investigators are generally required to comply with the NPPs, even where they are small businesses—the small business exemption does not apply to organisations that trade in personal information.[58]
44.52 Various aspects of the operation of the Privacy Act have been identified as hampering the activities of private investigations, including: the obligation under NPP 1.5 to take reasonable steps to make individuals aware that information is being collected about them; and the application of the ‘Use and Disclosure’ principle in NPP 2, which may prohibit organisations from disclosing information—including information necessary for debt collection, service of legal process, and fraud investigation—to private investigators.
44.53 A particular concern that has been raised in this Inquiry by private investigators and their representative associations is that, while the Privacy Act facilitates access to personal information by law enforcement bodies, no such access is available to private investigators, including those who may be engaged by defendants or others who are subject to law enforcement action. As discussed above, the ALRC does not consider a general exception that allows for disclosure of personal information for the purposes of establishing, pursuing or defending legal rights to be appropriate. Further consideration is given here to the more specific situation of private investigators.
Regulatory framework
44.54 Most states and territories have statutory schemes for licensing private investigators. Licences are granted in New South Wales, Victoria, Queensland, Western Australia, South Australia, Tasmania and the Northern Territory.[59] At present, the ACT does not require private investigators to be licensed.[60]
44.55 In New South Wales, for example, the Commercial Agents and Private Inquiry Agents Act 2004 (NSW) establishes the regulatory framework for commercial agents and private inquiry agents. Under the Act, the Commissioner of Police issues licences to business owners (master licences) and their employees (operator licences) who undertake commercial agent or private inquiry agent activities.[61] The legislation provides for:
Threshold requirements for granting a licence—including Australian citizenship, minimum age and an absence of convictions for ‘major offences’[62] and, for master licence applicants, compliance with the requirements of any approved industry association and an absence of bankruptcy.
Discretionary considerations for granting a licence—including appropriateness or fitness to hold a licence, previous convictions or findings of guilt for ‘minor offences’,[63] and public interest considerations. Applications also may be refused where the prospective licensee does not meet set training or qualification requirements.
Licensing offences—including offences in relation to: practising without a licence; failing to produce a licence on demand; employing an unlicensed person to carry out commercial agent or private inquiry work; and disposing of licences through sale, loan or gift.
44.56 A number of the regulatory features set out in the New South Wales legislation are common throughout the state and territory schemes. There are also some key differences, however, including the nature of offences that automatically disentitle an applicant from holding a licence; qualifications and training requirements; and penalties for licensing offences.
44.57 There is some movement towards harmonisation of the regulation of private investigators. Regulation of the security industry, including private investigators, has recently been considered by the Council of Australian Governments (COAG), as a part of its review of Australia’s counter-terrorism arrangements. This included consideration of national standards for the security industry, such as training, accreditation, competency, registration and licensing requirements.[64] A proposed national standard for the regulation of the private security industry was presented to COAG at its meeting of 13 April 2007; however, no agreement was reached at this time.[65]
44.58 Several states have introduced or proposed legislation responding to COAG’s call for harmonisation of licensing regimes for the security industry. The Security Providers Amendment Act 2007 (Qld), for example, expands the categories of activities that are subject to its provisions, tightens probity checking of prospective licensees, increases the penalties for operating without a licence or engaging unlicensed personnel, and provides for the introduction of a mandatory code of practice and ongoing industry-based training.[66] As of February 2008, reforms to the regulation of the security industry in Western Australia were before the Legislative Council.[67]
44.59 Private investigators also may be subject to various industry self-regulatory schemes. For example, the Australian Institute of Private Detectives (AIPD) requires its members to be bound by an AIPD Code of Practice, Code of Ethics, standards and guidelines.[68] The only sanction for a breach of these requirements, however, is the cancellation a person’s membership. The AIPD does not have any power to remove a person’s licence to practise as a private investigator.
Options for reform
44.60 If privacy laws impact unduly on the functions of private investigators, there are a number of options for reform. First, a specific exemption or exceptions for private investigators could be inserted into the Act. An alternative is to clarify the application to private investigators of the generally available exceptions to the privacy principles.
Exemptions or exceptions to the Privacy Act
44.61 A possible reform would be to amend the definition of ‘enforcement body’ in s 6 of the Privacy Act to include private investigators in relation to matters before courts or tribunals.[69] The effect of this would be to allow disclosure of personal information to a private investigator where disclosure is reasonably necessary for the preparation for proceedings before a court or tribunal.
44.62 There is some precedent for including private investigators within a law enforcement exception to privacy legislation. Under the Canadian Personal Information Protection and Electronic Documents Act 2000 (PIPED Act),[70] for example, private investigators are included within the exception for investigative bodies provided they meet certain requirements, including having a privacy code that is compliant with the relevant standard and being a member in good standing of a professional association with such a code.[71] This exception has a relatively narrow scope, permitting the exchange of personal information without consent for investigative purposes between or among private organisations only in circumstances where obtaining consent is impossible, impractical or undesirable because it would frustrate the conduct of the investigation.[72]
Accommodation of private investigators under the present privacy framework
44.63 Some of the concerns raised by private investigators about the Privacy Act may be overcome by a better understanding of its application to their functions, both within the private investigation industry and the agencies and organisations with which they deal. For example, one concern for private investigators is the obligation, under NPP 1.5, to take reasonable steps to make individuals aware that a private investigator is collecting information about them. In this context, the OPC has noted that the ‘reasonable steps’ required by the privacy principle could include taking no steps, where, for example, a suspicion of fraud or unlawful activity is being investigated.[73]
44.64 However, where investigators are investigating activity that is ‘improper rather than unlawful’—for example, ‘misuse of employer resources, abuse of power or position, or marital infidelity’—complying with the collection principle ‘may impinge on the activities of private investigators’.[74] The OPC has observed that:
it is considerably less clear in these circumstances that the public interest in investigating possibly improper activity outweighs the individual and the public interest in individuals being aware that they are under investigation.[75]
44.65 Where private investigation services are engaged directly by an agency or organisation, that agency or organisation also could gain consent to a range of information sharing practices.[76] For example, the notice given by an insurance company at the time that a customer takes out a policy or at the time that a customer makes a claim could include private investigators within its description of the entities to which it may disclose personal information.[77] This approach was suggested by the OPC in its Review of the Private Sector Provisions of the Privacy Act 1988 (the OPC Review).[78] Its use was illustrated in the case of O v Insurance Company, in which an insurance company investigated a worker’s compensation claim through a private investigator.[79] The Privacy Commissioner found that information gathered by the private investigator was a part of a lawful investigation into the factors affecting the complainant’s return to work.
Submissions and consultations
44.66 In DP 72, the ALRC acknowledged the legitimate role that private investigators play in providing investigative and legal support services, but did not consider there to be sufficient accountability and oversight mechanisms in relation to the industry to justify an exemption (or other special provisions) from the operation of the Privacy Act. The ALRC asked whether the Australian Government should request that the Standing Committee of Attorneys-General (SCAG) consider the regulation of private investigators and the impact of federal, state and territory privacy and related laws on the industry.[80]
44.67 Private investigators and related industry associations did not comment specifically on the ALRC’s question but submitted further on the negative impact that privacy laws have on their functions; in particular, on their role in the legal process.[81]
44.68 The majority of stakeholders that responded to this question either specifically supported consideration of the regulation of private investigators by SCAG,[82] or commented that they saw the need for greater clarity and consistency in the regulation of the information-gathering practices of private investigators.[83]
44.69 Some stakeholders supplemented their support for further consideration with views on their preferred outcome. The Public Interest Advocacy Centre and National Legal Aid commented that—although they supported a review by SCAG—they did not consider that private investigators should be exempt from the Privacy Act.[84] The Investment and Financial Services Association, on the other hand, submitted that:
the insurance industry relies upon the activities of private investigators to assist in reducing fraudulent claims and consequently would be opposed to any restrictions on their ability to provide this legitimate investigative role for the industry.[85]
44.70 The South Australian Government objected to the statement that private investigators are not accountable, at least in the case of South Australia. It advised that the Security and Investigation Agents Act 1995 (SA) provides for disciplinary action against an agent if he or she acts unlawfully, improperly, negligently or unfairly in the course of work as an agent or is not a fit and proper person to hold a licence.[86] It commented that
given that States and Territories license agents to carry out private investigations, it must follow that this is a proper occupation and that the activities within the purview of the licence should not be impeded by the Act.[87]
44.71 Although the South Australian Government accepted that the matter could be referred to SCAG, it suggested that it could be dealt with more simply by the list of ‘non excluded matters’,[88] at least with regard to those agents to whom a statutory discipline regime applies.[89]
44.72 The ABA did not support a referral to SCAG ‘as it could lead to separate regulation or alternate regulation of the privacy aspects of private investigators outside of the Privacy Act’.[90] A few stakeholders submitted that there was no need for any special review of the impact of privacy laws on private investigators, who should remain subject to all the principles.[91]
ALRC’s view
44.73 Private investigators have a legitimate role in providing investigative and legal support services in a range of contexts. There is, for example, a social interest in individuals being able to take effective action to recover debts owed to them, find a person who is at fault in a car accident, and prepare a case for court proceedings. In some instances, private investigators may perform tasks that could be done by the police or other law enforcement bodies if resources and priorities permitted. This role is often dependent on an ability to obtain access to personal information. The ALRC recognises that the Privacy Act, and state and territory privacy legislation, may present obstacles to private investigators in obtaining personal information.
44.74 The ALRC, however, agrees with the conclusion of the OPC Review that, as the industry presently stands, it is difficult to recommend that private investigators be accorded similar access rights to personal information as law enforcement agencies.
Private detectives can be distinguished from other enforcement bodies on the basis that they are not accountable to the government or the community, or any accountability body such as an ombudsman who can investigate complaints and award compensation, in the same way that law enforcement agencies are.[92]
44.75 Comprehensive regulatory structures are required before any exemption or exceptions is granted to the private investigation industry, particularly in light of the potential for unethical and unlawful behaviour. A recent report by the Information Commissioner’s Office in the United Kingdom, for example, noted that companies and individuals that unlawfully obtain confidential personal information ‘are almost invariably part of the private investigation industry’.[93] Unscrupulous information brokerage by the private investigation industry has been illustrated further by the high profile United States case of Remsburg v Docusearch Inc.[94] No comparable Australian cases, however, were brought to the ALRC’s attention in this Inquiry.
44.76 Some recognition of the private investigation industry might be justified if it were regulated more stringently. Currently, however, such recognition is premature. A broad spectrum of stakeholders agreed that a review of the regulation of private investigators and the impact of federal, state and territory privacy and related laws on the industry would be beneficial. In particular, stakeholders acknowledged the need for greater clarity and consistency in the regulation of the information-gathering practices of private investigators. Although private investigators did not make a submission on this issue, research reported in 2001 concluded that the industry would support ‘tougher licensing, especially in pre-service training requirements’ in return for an enhanced capacity to access information relevant to investigations.[95]
44.77 Before Industry Canada accepted private investigators as an ‘investigative body’ for the purposes of PIPEDA it assessed:
the operational structure of the body or process, including identified responsibility and accountability centres;
specific legal regimes, licensing requirements, regulations or oversight mechanisms to which the body is subject, including sanctions or penalties for non-compliance;
the privacy protection policies or procedures followed by the body; and
the amount of information provided to individuals about the existence and operation of the body and how to make a complaint or seek redress.[96]
44.78 In DP 72, the ALRC suggested that SCAG may be the appropriate body to review the regulation of the private investigation industry. Ministerial responsibility for oversight of private investigators varies, however, with responsibility vested in ministers for police,[97] community affairs,[98] and attorneys-general.[99] As SCAG’s focus is directed towards matters within the portfolio responsibilities of its members,[100] private investigators may not come within its scope. COAG, therefore, is the appropriate body to review the regulation of private investigators. This is appropriate given the recent inclusion of the private security industry on COAG’s agenda.
44.79 The application of the Privacy Act to the functions of private investigators also can be assisted by clarifying the range of ways that its requirements can be satisfied. For instance, where a private investigator acts as an agent of an agency or organisation, this could be set out in the agency’s or organisation’s Privacy Policy.[101] Under the ‘Notification’ principle, ‘reasonable steps’ to inform an individual that personal information about them has been collected might, in some circumstances, equal ‘no steps’.[102] This often would be the case in the context of private investigators. The clarification of the Privacy Act’s provisions is an overriding objective of this Inquiry and the focus of numerous recommendations. These measures will accommodate sufficiently the situation of private investigation and, therefore, there is no need for further guidance in this context.
Recommendation 44-3 The Australian Government should recommend that the Council of Australian Governments consider models for the regulation of private investigators and the impact of federal, state and territory privacy laws on their operations.
[57]Australian Institute of Private Detectives Ltd, Code of Practice for Private Investigators in Australia (2005), 5.
[58] To trade in personal information is to collect personal information about another individual from, or disclose such information to, anyone else for benefit, service or advantage (unless it occurs with the consent of the individuals concerned, or is authorised or required by law): Privacy Act 1988 (Cth) s 6D(7), (8).
[59]Commercial Agents and Private Inquiry Agents Act 2004 (NSW); Private Agents Act 1996 (Vic); Security Providers Act 1993 (Qld); Security and Investigation Agents Act 1995 (SA); Security and Related Activities (Control) Act 1996 (WA); Security and Investigations Agents Act 2002 (Tas); Commercial and Private Agents Licensing Act 1979 (NT).
[60] However, other parts of the security industry are regulated through the Security Industry Act 2003 (ACT).
[61] See Commercial Agents and Private Inquiry Agents Act 2004 (NSW) pt 2. The Commercial Agents and Private Inquiry Agents Act has been used as the basis for the draft bill prepared by the Australian Institute of Private Detectives (AIPD) to indicate how uniform national regulation of private investigation might be enacted. See Australian Institute of Private Detectives, Private Investigators Bill 2005 <www.aipd.
com.au> at 15 May 2008.
[62] As defined in s 4.
[63] As defined in s 4.
[64] Council of Australian Governments, Council of Australian Governments’ Communiqué Special Meeting on Counter Terrorism, 27 September 2005.
[65]Council of Australian Governments, Council of Australian Governments’ Communiqué, 13 April 2007. The areas of counter-terrorism or security are not on COAG’s 2008 work agenda: Council of Australian Governments, Council of Australian Governments’ Communiqué, 20 December 2007.
[66]Security Providers Amendment Act 2007 (Qld). At the time of writing, no code of conduct or training program had been introduced.
[67] Security and Related Activities (Control) Amendment Bill 2007 (WA). The Bill was passed by the Legislative Assembly on 22 November 2007.
[68]Australian Institute of Private Detectives Ltd, Code of Practice for Private Investigators in Australia (2005), 22.
[69] This reform was submitted for consideration by the AIPD to the OPC Review: Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005), 229.
[70]Personal Information Protection and Electronic Documents Act 2000 SC 2000, c 5 (Canada).
[71]Regulations Specifying Investigative Bodies 2000 SOR/2001–6 (Canada).
[72]Government of Canada, ‘Regulatory Impact Analysis Statement for Regulations Amending the Regulations Specifying Investigative Bodies’, Canada Gazette, 21 April 2004.
[73]Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005), 225.
[74]Ibid, 226.
[75]Ibid, 226. The ‘Collection’ principle is discussed in Ch 21.
[76] The ‘Specific Notification’ principle is discussed in Ch 23.
[77] See Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005), 231.
[78]Ibid, 231.
[79]O v Insurance Company [2007] PrivCmrA 17.
[80]Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Question 40–1.
[81]Australian Mercantile Agents Association, Submission PR 508, 21 December 2007; Australian Investigators Association, Submission PR 507, 21 December 2007; Australian Collectors Association, Submission PR 505, 20 December 2007; R Lake, Submission PR 305, 19 July 2007.
[82]Suncorp-Metway Ltd, Submission PR 525, 21 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Recruitment and Consulting Services Association Australia & New Zealand, Submission PR 353, 30 November 2007.
[83]Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; Investment and Financial Services Association, Submission PR 538, 21 December 2007; National Legal Aid, Submission PR 521, 21 December 2007.
[84]Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; National Legal Aid, Submission PR 521, 21 December 2007.
[85]Investment and Financial Services Association, Submission PR 538, 21 December 2007.
[86]Government of South Australia, Submission PR 565, 29 January 2008.
[87]Ibid.
[88] The ALRC is recommending that the Privacy Act should not apply to a law of a state or territory so far as the law deals with any ‘preserved matters’: see Rec 3–3.
[89]Government of South Australia, Submission PR 565, 29 January 2008.
[90]Australian Bankers’ Association Inc, Submission PR 567, 11 February 2008.
[91]Australian Privacy Foundation, Submission PR 553, 2 January 2008; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007.
[92]Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005), 230.
[93]United Kingdom Government Information Commissioner’s Office, What Price Privacy? The Unlawful Trade in Confidential Personal Information (2006), 21.
[94] In this case, a stalker obtained a young woman’s personal information from an internet-based private investigation service and used this information to locate and murder the woman. Helen Remsburg, Administratrix of the Estate of Amy Lynn Boyer v Docusearch Inc 816 A 2d 1001 (Supreme Court of New Hampshire, 2003).
[95]T Prenzler, Private Investigators in Australia: Work, Law, Ethics and Regulation (2001) Criminology Research Council, 6.
[96]Government of Canada, ‘Regulatory Impact Analysis Statement for Regulations Amending the Regulations Specifying Investigative Bodies’, Canada Gazette, 21 April 2004.
[97] In New South Wales, Victoria, Western Australia.
[98] In South Australia.
[99] In Queensland, Tasmania, Northern Territory.
[100]Australian Government Attorney-General’s Department, Standing Committee of Attorneys-General <www.ag.gov.au> at 14 April 2008.
[101] In Ch 24, the ALRC recommends a system whereby agencies and organisations create a ‘Privacy Policy’ setting out their polices on the management of personal information and how personal information is collected, held, used and disclosed.
[102]The obligation on agencies and organisations to notify an individual whose personal information has been, or is to be, collected—including the situation where taking ‘reasonable steps’ equates with taking ‘no steps’—is considered in Ch 23.