50.26 The Privacy Act contains detailed provisions regarding the granting of injunctions. Section 98 provides that following an application from the Commissioner or another person, the Federal Court or Federal Magistrates Court can grant an injunction restraining a person from engaging in conduct that would constitute a contravention of the Privacy Act and, if the court thinks it desirable to do so, requiring a person to do any act or thing.[41] An injunction may be granted if it appears to the court that it is likely the person will engage in the relevant conduct if the injunction is not granted, whether or not the person has previously engaged in conduct of that kind, and whether or not there is an imminent danger of substantial damage to any person if the person engages in the relevant conduct.[42] Where the Commissioner applies for an injunction under s 98, the court will not require the Commissioner or any other person to give an undertaking as to damages.[43]

50.27 Two features of the injunctions power are significant. First, it does not concern only enforcement of determinations.[44] It is a freestanding provision that deals with any contravention of the Privacy Act. Secondly, the ‘standing’ requirement is relatively easy to satisfy—the application may be made by the Commissioner ‘or any other person’.[45]

50.28 There appear to be few cases in which an injunction has been granted to restrain contravention of the Privacy Act, though the remedy is potentially of general application and utility.[46] The OPC has stated that the Commissioner would seek an injunction only ‘when other more informal means have failed to yield a satisfactory outcome’.[47]

Submissions and consultations

50.29 In DP 72, the ALRC noted comments by stakeholders on the injunctions power in the Privacy Act. While a number of stakeholders supported the power as it currently is expressed, including the standing requirements, the OPC expressed concern about the breadth of the standing provision. In particular, the OPC suggested that ‘it could allow a party with no interest in the privacy of the individuals in question to seek an injunction that may, as a consequence, impact on how an agency or organisation interacts with that individual’.[48] The OPC recommended that s 98 be amended to include a more rigorous test for standing.

50.30 In contrast, another stakeholder described the ability of non-government organisations to seek injunctions because of the provision for open standing—as a ‘theoretically valuable means by which contesting interpretations of principles could be resolved’.[49] In addition, the Australian Privacy Foundation submitted that the injunction power is valuable and that the Commissioner should make greater use of the power, ‘both during complaint investigations and as a pro-active tool where interferences with privacy are brought to attention in other ways’.[50] The Queensland Council for Civil Liberties saw no reason to alter the position in relation to obtaining injunctions.[51]

50.31 In response to DP 72, the Cyberspace Law and Policy Centre submitted that:

The Commissioner’s ability to seek an injunction is potentially a particularly valuable aspect of the Privacy Act … because it carries with it the requirement that the Commissioner must also seek an interpretation of the Act by the Federal Court, rather than applying what the Commissioner’s Office imagines is the law. Given that there are no useful decisions on the Privacy Act after 20 years—except one where one commercial party used the injunction provision against another—the opportunity for the Commissioner to seek judicial guidance on difficult aspects of the Act would be a rare and valuable opportunity, but it is one the Commissioner has never taken up.[52]

50.32 The Centre argued that greater use of the injunction power could be made if the OPC was given more resources to allow it to pursue injunctions and the Privacy Act was amended to allow non-government organisations or complainants to request the Commissioner to use the injunction power.[53]

ALRC’s view

50.33 The ALRC does not recommend any reform to the injunctions provision. The power is comparable to provisions for statutory injunctions under the Trade Practices Act 1974 (Cth) (TPA) and the Corporations Act 2001 (Cth).[54] While the provisions have not been utilised often, the power itself is appropriate. The ALRC also recognises the value in providing for open standing in this area, because it allows consumer and privacy organisations to initiate proceedings under the section.[55] As noted by Dr Norman Witzleb:

This may prove of particular use where large organisations introduce services which have the potential of presenting privacy threats on a massive scale—such as, for example, the recently introduced ‘g-mail’ service by Google, which prompted substantial criticism from privacy and consumer groups worldwide.[56]

50.34 Greater use could be made of the injunctions power in the future, where, for example, new technologies raise such serious concerns that it is thought necessary to stop the conduct. The injunctions power may also come into play more if the ALRC’s recommendation that the Privacy Act be amended to empower the Commissioner to direct an agency to prepare a privacy impact assessment is implemented.[57] If a project raised serious privacy concerns and the Commissioner believed it would, if implemented, interfere with the privacy of individuals, the Commissioner could seek an injunction from the Federal Court or Federal Magistrates Court to stop the project.[58]

[41]Privacy Act 1988 (Cth) s 98(1)–(2).

[42] Ibid s 98(5)(b). See also s 98(6).

[43] Ibid s 98(7).

[44] See N Witzleb, ‘Federal Court Strengthens Privacy Enforcement: Seven Network (Operations) Limited v Media Entertainment and Arts Alliance [2004] FCA 637’ (2005) 33 Australian Business Law Review 45, 45.

[45] This is similar to the position in the Trade Practices Act 1974 (Cth) s 80. See also Seven Network (Operations) Ltd v Media Entertainment and Arts Alliance (2004) 148 FCR 145, [40], [55].

[46] See Seven Network (Operations) Ltd v Media Entertainment and Arts Alliance (2004) 148 FCR 145.

[47] Office of the Federal Privacy Commissioner, The Privacy Commissioner’s Approach to Promoting Compliance with the Privacy Act 1988, Information Sheet 13 (2001), 3.

[48] Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.

[49] G Greenleaf, N Waters and L Bygrave—Cyberspace Law and Policy Centre UNSW, Submission PR 183, 9 February 2007. The ability to seek an injunction was said to be ‘inherently valuable’.

[50] Australian Privacy Foundation, Submission PR 167, 2 February 2007.

[51] Queensland Council for Civil Liberties, Submission PR 150, 29 January 2007.

[52] Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007.

[53] Ibid.

[54] See Trade Practices Act 1974 (Cth) s 80; Corporations Act 2001 (Cth) s 1324.

[55] See also Australian Law Reform Commission, Beyond the Door-keeper: Standing to Sue for Public Remedies, ALRC 78 (1996).

[56] N Witzleb, ‘Federal Court Strengthens Privacy Enforcement: Seven Network (Operations) Limited v Media Entertainment and Arts Alliance [2004] FCA 637’ (2005) 33 Australian Business Law Review 45, 49.

[57] See Rec 47–4.

[58] See Privacy Act 1988 (Cth) s 98.