Immunity

Background

46.62 The Commissioner, and any person acting under his or her direction or authority, has immunity from civil action for acts done in good faith in the exercise of any power conferred by the Privacy Act.[81] This immunity also extends to an adjudicator under an approved privacy code and his or her delegate.[82] Privacy legislation in state, territory and overseas jurisdictions provides similar immunities to privacy commissioners,[83] and precedent for immunity can also be found in the Ombudsman Act 1976 (Cth).[84]

46.63 The Privacy Act also provides that civil action will not lie against a person in respect of loss, damage or injury suffered by another person because of certain acts done in good faith. These acts are: the making of a complaint under the Act or under an approved code; the acceptance of a complaint under s 40(1B); or the making of a statement to, or giving information to, the Privacy Commissioner.[85] Similar immunity for complainants can be found in privacy legislation in Australian states and territories.[86]

46.64 In addition, persons who give information, produce a document or answer a question when directed to do so by the Commissioner are not liable to penalties under other Acts.[87]

Submissions and consultations

46.65 In DP 72, the ALRC identified support in submissions and consultations for the scope of immunities conferred on the Privacy Commissioner, adjudicators and other persons by the Privacy Act. The OPC supported the continuation of the immunity from civil actions provided to the Commissioner (or code adjudicator) and their delegates and also supported the protection from civil action provided to complainants. It explained that ‘this is fundamental to providing individuals with an opportunity to freely raise a complaint without concern that they may be liable for defamation or other civil action’.[88]

46.66 The Australian Privacy Foundation described these immunities as important and suggested that ‘the law should confirm that the protection extends to bodies bringing representative complaints and otherwise drawing privacy compliance issues to the attention of the Commissioner and the public’.[89]

ALRC’s view

46.67 The current immunity afforded to the Privacy Commissioner and code adjudicators, and their delegates, is appropriate and the ALRC does not make any recommendations for reform in this area.

46.68 The ALRC does not recommend any changes to the current formulation in s 67 of the Privacy Act, which provides protection from civil action to a person who, in good faith, makes a complaint under this Act. A complaint can only be made under s 36 of the Act, whether it is an IPP complaint, an NPP complaint, or a representative complaint.[90] A person or body who lodges a representative complaint under s 36 would enjoy protection from civil action where the act was done in good faith, because the protection in s 67 does not distinguish between the type of complaint made or the person who made the complaint; it applies to the act of making the complaint.

46.69 The ALRC notes, however, that there does not appear to be any guidance on the OPC website concerning the protection offered to complainants who make complaints in good faith. It would be useful for the OPC to make this protection clear in the document setting out its complaint-handling policies and procedures, which is the subject of Recommendation 49­­–8. This is particularly important given that, as recognised by the OPC, the protection is fundamental to ensuring that complainants feel safe in making complaints. It would be helpful to indicate clearly in the document setting out the OPC’s complaint-handling policies and procedures that s 67 applies to individuals and bodies bringing representative complaints in the same way that it applies to individual complainants.

46.70 The Privacy Act does not need to be amended to confirm that the protection from civil action extends to bodies that otherwise draw privacy compliance issues to the attention of the Commissioner and the public.[91] In relation to issues brought to the attention of the Commissioner, s 67(b) already makes it clear that the protection from civil action extends to making a statement or giving a document or information to the Commissioner, whether or not required by s 44 of the Privacy Act.[92] This too, however, could be clarified further in the recommended complaint-handling policy and procedures document.

46.71 In relation to the suggestion that issues brought to the attention of the public also should attract immunity, it is the ALRC’s view that such protection is not justified. The ALRC is not aware of examples of such protection being offered for disclosures to the public in any other privacy legislation. The OPC is the appropriate body with which to raise compliance issues. If a body wants to disclose issues to the public directly, then it should bear the risk.

[81]Privacy Act 1988 (Cth) s 64(1).

[82] Ibid s 64.

[83] For examples in other Australian privacy legislation, see Privacy and Personal Information Protection Act 1998 (NSW) s 66; Information Act 2002 (NT) s 151. For examples in overseas jurisdictions, see Privacy Act RS 1985, c P-21 (Canada) s 67; Personal Information Protection and Electronic Documents Act 2000 SC 2000, c 5 (Canada) s 22; Crown Entities Act 2004 (NZ) s 121.

[84]Ombudsman Act 1976 (Cth) s 33.

[85]Privacy Act 1988 (Cth) s 67.

[86]Privacy and Personal Information Protection Act 1998 (NSW) s 66A; Information Privacy Act 2000 (Vic) s 66; Information Act 2002 (NT) s 152.

[87]Privacy Act 1988 (Cth) s 44(5).

[88] Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.

[89] Australian Privacy Foundation, Submission PR 167, 2 February 2007.

[90] See the respective definitions of each in Privacy Act 1988 (Cth) s 6(1).

[91] Australian Privacy Foundation, Submission PR 167, 2 February 2007.

[92] Note also that the Explanatory Memorandum to the Privacy Bill explained that s 67 ‘precludes a person from being sued for lodging a complaint with the Commissioner or providing him/her with information where those acts are done in good faith’: Explanatory Memorandum, Privacy Bill 1988 (Cth), 59.