Extension of the Privacy Act to groups?

7.8 In light of the above, the ALRC asked in the Issues Paper, Review of Privacy (IP 31), whether the Act should be amended to accommodate a ‘collective’ or ‘group’ right to privacy. The ALRC noted that there is some precedent for explicit privacy protection at common law for Indigenous groups in Australia.[12] Northern Territory legislation also provides for limited privacy protection.[13]

7.9 In Discussion Paper 72, Review of Australian Law (DP 72), the ALRC did not foreclose the possibility of such an amendment to the Privacy Act, but expressed the view that the Act should not be extended to provide direct protection to Indigenous or other racial, cultural or ethnic groups, or commercial entities.[14]

7.10 With regard to the privacy of Indigenous groups, the ALRC expressed the view that the development of privacy protocols that respond to the particular privacy needs of those groups, rather than an amendment to the Privacy Act, was the more effective and appropriate solution.

Submissions and consultations

Groups generally

7.11 There was limited support for the legislative extension of privacy rights to groups.[15] Associate Professor Lee Bygrave argued that while much of the literature on privacy and its value is almost exclusively concerned with the interests of individuals:

It is fairly easy to establish that the core principles of the Privacy Act are logically capable of being extended to protect data on collective entities. Further, it is fairly easy to establish that collective entities are capable of sharing most, if not all, of the interests of data subjects which the Privacy Act directly or indirectly safeguards …[16]

7.12 Bygrave counselled against treating ‘collective entities … as an undifferentiated mass’ because they do not all ‘play the same economic, political, legal and social roles, nor have the same goals and resources’.[17] He concluded that, on balance, all countries should seriously consider giving collective entities some data protection rights.[18]

7.13 A clear majority of stakeholders, however, opposed any legislative extension of privacy rights to groups.[19] A number of stakeholders observed that privacy is a fundamental human right, which is based on protecting the dignity and autonomy of individuals. As such, it was argued that privacy rights cannot logically be extended to groups.[20] Given that the constitutional foundation of the Privacy Act relies partly on the fact that it implements art 17 of the ICCPR, the Office of the Information Commissioner Northern Territory expressed concern that any extension of the Act to protect groups might undermine its constitutional validity.[21]

Indigenous or other racial, cultural or ethnic groups

7.14 Several stakeholders opposed extending privacy law to provide direct and specific protection to Indigenous or other racial, ethnic or cultural groups.[22] The Office of the Information Commissioner Northern Territory expressed concern that such an extension could be used in the name of a group, but ‘against the interests of individual group members’.[23] The Office of the Privacy Commissioner (OPC) submitted that such an extension would cause a number of practical problems. For example, it would be difficult to determine which ethnic groups should be afforded additional privacy protection.[24]

7.15 The Australian Government Department of Health and Ageing submitted that such an extension of the Act is unnecessary because the privacy principles already recognise cultural sensitivities adequately by

requiring the reasonable expectations of the individual concerned to be taken into account when using or disclosing personal information for secondary purposes. Any ‘cultural sensitivity’ would be one of the matters to be considered in weighing up whether the individual would reasonably expect his or her personal information to be used or disclosed.[25]

7.16 The Australian Government Department of Families, Communities and Indigenous Affairs submitted that any extension of the Act, if it were limited to Indigenous groups, would be inconsistent with the protection afforded to other cultural groups and could cause difficulties for agencies in fulfilling their statutory duties.[26]

7.17 Some stakeholders supported extending privacy law to provide direct protection to Indigenous or other groups.[27] The Centre for Law and Genetics stated that such an expansion would be consistent with the ‘underlying ethical rationale for privacy protection, which is based in notions of human dignity and autonomy’.[28]

ALRC’s view

7.18 Any extension of the right to privacy to a group would cause problems of logic, law and policy. It would require a fundamental and radical change to the scope and operation of the Privacy Act to provide direct protection to the privacy of groups. This does not mean, however, that such a realignment of the Privacy Act cannot or should not occur, if there is a compelling case for such a realignment.

7.19 Without detracting from the universality of human rights, there is relatively broad acceptance that particular rights can attach to members of a group of people united by, for example, ethnic origin or religion.[29] That is, it is generally recognised that the individuals from certain groups may have needs that are peculiar to those groups.[30] This may result from a group suffering historical discrimination or disadvantage. Alternatively, it may flow from the particular cultural beliefs or requirements of a group.[31]

7.20 Australian law has long recognised that, in order to ensure that all members of the community enjoy substantive equality, it is sometimes necessary to make laws that are targeted towards individuals who share particular characteristics.[32] For example, the Racial Discrimination Act 1975 (Cth) permits the adoption of ‘special measures’, which operate as follows:

Special measures taken for the sole purpose of securing adequate advancement of certain racial or ethnic groups or individuals requiring such protection as may be necessary in order to ensure such groups or individuals equal enjoyment or exercise of human rights and fundamental freedoms shall not be deemed racial discrimination, provided, however, that such measures do not, as a consequence, lead to the maintenance of separate rights for different racial groups and that they shall not be continued after the objectives for which they were taken have been achieved.[33]

7.21 Instead of amending the Privacy Act, there are other, more appropriate, methods of dealing with the privacy rights of groups.[34] The vast majority of stakeholders opposed extending the Act’s protection directly to cover Indigenous or other racial, cultural or ethnic groups. As noted in submissions and consultations, such an extension of the Privacy Act could have undesirable consequences. For example, itcould result in a group asserting privacy rights in a way that conflicts with the interests of individual members of the group. While it may be possible to reconcile conflicts between individual and collective rights in some circumstances,[35] in the ALRC’s view such conflicts would be particularly difficult to resolve in the context of privacy protection.

[12] Australian Law Reform Commission, Review of Privacy, IP 31 (2006), [1.50]–[1.54]. See, eg, Aboriginal Sacred Sites Protection Authority v Maurice; Re the Warumungu Claim (1986) 10 FCR 104, 107. See also the discussion of the relevant case law in Australian Law Reform Commission, New South Wales Law Reform Commission and Victorian Law Reform Commission, Uniform Evidence Law, ALRC 102 (2005), [19.125]–[19.126].

[13]Information Act 2002 (NT), ss 50, 56. See also, National Health and Medical Research Council, Australian Research Council and Australian Vice Chancellors’ Committee, National Statement on Ethical Conduct in Human Research (2007), [1.10]. The National Statement is discussed in detail in Chs 64–66.

[14] The extension of privacy rights to corporations or commercial entities is discussed later in this chapter.

[15] Office of the Victorian Privacy Commissioner, Submission PR 217, 28 February 2007; L Bygrave, Submission PR 92, 15 January 2007.

[16] L Bygrave, Submission PR 92, 15 January 2007 (emphasis in original).

[17] Ibid.

[18] Ibid, citing L Bygrave, Data Protection Law: Approaching its Rationale, Logic and Limits (2002), 297.

[19] Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Queensland Government, Submission PR 490, 19 December 2007; Australian Government Department of Health and Ageing, Submission PR 273, 30 March 2007; Australian Bankers’ Association Inc, Submission PR 259, 19 March 2007; Telstra, Submission PR 185, 9 February 2007; Australian Privacy Foundation, Submission PR 167, 2 February 2007; New South Wales Council for Civil Liberties Inc, Submission PR 156, 31 January 2007; National Australia Bank and MLC Ltd, Submission PR 148, 29 January 2007; AAMI, Submission PR 147, 29 January 2007; Law Society of New South Wales, Submission PR 146, 29 January 2007; AXA, Submission PR 119, 15 January 2007; Institute of Mercantile Agents, Submission PR 101, 15 January 2007; Australian Bureau of Statistics, Submission PR 96, 15 January 2007; Electronic Frontiers Australia Inc, Submission PR 76, 8 January 2007.

[20] Australian Bankers’ Association Inc, Submission PR 259, 19 March 2007; Office of the Privacy Commissioner, Submission PR 215, 28 February 2007; Telstra, Submission PR 185, 9 February 2007; Australian Competition and Consumer Commission, Submission PR 178, 31 January 2007; Australian Privacy Foundation, Submission PR 167, 2 February 2007; Confidential, Submission PR 165, 1 February 2007; New South Wales Council for Civil Liberties Inc, Submission PR 156, 31 January 2007; Queensland Council for Civil Liberties, Submission PR 150, 29 January 2007; National Australia Bank and MLC Ltd, Submission PR 148, 29 January 2007; Law Society of New South Wales, Submission PR 146, 29 January 2007; Electronic Frontiers Australia Inc, Submission PR 76, 8 January 2007.

[21] Office of the Information Commissioner (Northern Territory), Submission PR 103, 15 January 2007.

[22] Public Interest Advocacy Centre, Submission PR 548, 26 December 2007; Human Rights and Equal Opportunity Commission, Submission PR 500, 20 December 2007; Office of the Privacy Commissioner, Submission PR 499, 20 December 2007; Queensland Government, Submission PR 490, 19 December 2007; Arts Law Centre of Australia, Submission PR 450, 7 December 2007; National Health and Medical Research Council, Submission PR 397, 7 December 2007; Australian Bureau of Statistics, Submission PR 383, 6 December 2007; Office of the Privacy Commissioner, Submission PR 215, 28 February 2007; Australian Privacy Foundation, Submission PR 167, 2 February 2007; Australian Government Department of Families‚ Community Services and Indigenous Affairs, Submission PR 162, 31 January 2007; New South Wales Council for Civil Liberties Inc, Submission PR 156, 31 January 2007; Confidential, Submission PR 143, 24 January 2007; Investment and Financial Services Association, Submission PR 122, 15 January 2007; AXA, Submission PR 119, 15 January 2007; Office of the Information Commissioner (Northern Territory), Submission PR 103, 15 January 2007; Australian Bureau of Statistics, Submission PR 96, 15 January 2007.

[23] Office of the Information Commissioner (Northern Territory), Submission PR 103, 15 January 2007.

[24] Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.

[25] Australian Government Department of Health and Ageing, Submission PR 273, 30 March 2007.

[26] Australian Government Department of Families‚ Community Services and Indigenous Affairs, Submission PR 162, 31 January 2007. See also Office of the Privacy Commissioner, Submission PR 215, 28 February 2007.

[27] Queensland Government, Submission PR 242, 15 March 2007; Centre for Law and Genetics, Submission PR 127, 16 January 2007; Legal Aid Commission of New South Wales, Submission PR 107, 15 January 2007.

[28] Centre for Law and Genetics, Submission PR 127, 16 January 2007.

[29] This is exemplified in instruments such as Africa’s principal human rights treaty, the African Charter on Human and Peoples’ Rights, 27 June 1981, OAU Doc CAB/LEG/67/3 rev 5, (entered into force generally on 21 October 1986). The Preamble to the Charter recognises that ‘fundamental human rights stem from the attributes of human beings which justifies their national and international protection and on the other hand that the reality and respect of peoples’ rights should necessarily guarantee human rights’.

[30] See, eg, International Covenant on Civil and Political Rights, 16 December 1966, [1980] ATS 23, (entered into force generally on 23 March 1976), art 27.

[31] See, eg, D Feldman, Civil Liberties and Human Rights in England and Wales (2nd ed, 2002), 13–14.

[32] See, eg, R Piotrowicz and S Kaye, Human Rights: International and Australian Law (2000), [12.23].

[33] See Racial Discrimination Act 1975 (Cth) s 8(1), incorporating International Convention on the Elimination of all Forms of Racial Discrimination, 7 March 1966, [1975] ATS 40, (entered into force generally on 4 January 1969), art 1(4).

[34] In the following section, the ALRC recommends that the OPC should encourage and assist agencies and organisations to develop and publish protocols, in consultation with Indigenous groups and representatives, to address the particular privacy needs of Indigenous groups: Recommendation 7–1.

[35] See, eg, L McDonald, ‘Can Collective and Individual Rights Coexist?’’ (1998) 22 Melbourne University Law Review 310, 323–336. See also United Nations Human Rights Committee, Kitok v Sweden: Communication No 197/1985, UN Doc A/43/40 (1988).