Privacy protocols for Indigenous groups

7.29 A privacy protocol is a document that sets out how to respect the particular privacy rights and needs of a group or groups of people in certain situations. In DP 72, the ALRC proposed that the OPC, in conjunction with Indigenous and other ethnic groups, encourage and assist the creation of publicly available protocols that respond to the particular privacy needs of those groups.^[51]

7.30 This section examines whether privacy protocols represent an appropriate mechanism to protect the privacy of Indigenous groups and, if so, how they should be implemented within the overall privacy regime recommended in this Report.

Protocols generally

7.31 Currently, there are protocols that set out the steps the media should take to protect the privacy of Indigenous and other ethnic or cultural groups.^[52] Though generally expressed in mandatory language, these protocols are ‘primarily ethical in nature’. They articulate ‘levels of behaviour which indigenous people and communities expect of outsiders dealing with indigenous material’,^[53] and often suggest ways of protecting the ‘honour and dignity’ of Indigenous people that are portrayed in the media.^[54]

Support for the development of privacy protocols

7.32 A number of stakeholders supported the creation of privacy protocols for Indigenous groups, and argued that they should be adopted widely.^[55] SBS stated that its codes, Independent Indigenous Protocols and 1997 policy document, The Greater Perspective, all encourage ‘respect for Indigenous culture and heritage, recognition of Indigenous cultural and intellectual property rights, maintenance of cultural integrity and respect for cultural beliefs, and respect for Indigenous individuals and communities’.^[56] These documents

include guidelines on consulting with Indigenous groups, and the need to take unique cultural considerations into account when creating content with Indigenous participants. The application of these protocols allow[s] for more positive collaborations with Indigenous communities, rather than the creation of a rigid framework which could serve to silence legitimate voices.^[57]

7.33 Further, a number of stakeholders expressed support for the ALRC’s proposal that the OPC, in conjunction with Indigenous and other ethnic groups, should encourage and assist the creation of publicly available protocols that respond to the particular privacy needs of groups.^[58]

7.34 The OPC supported the proposal, noting that in 1998 it prepared guidance for agencies that handle the personal information of Indigenous people in the Northern Territory.^[59]

7.35 Stakeholders suggested that the benefits of a regime involving privacy protocols developed by the OPC include: flexibility in the type and range of information that is protected;^[60] the opportunity to consult widely with Indigenous groups and representatives about the nature of protected information;^[61] and the potential to achieve uniformity across jurisdictions within Australia.^[62]

Features of a regime involving privacy protocols

7.36 A number of stakeholders suggested that consultation with Indigenous stakeholders is necessary for the development of adequate privacy protocols.^[63] National Legal Aid submitted that there may be a diversity of views within any Indigenous or cultural group.^[64] The Public Interest Advocacy Centre (PIAC) expressed concern that the OPC has developed only one privacy protocol relating to Indigenous rights, and this was created nearly a decade ago. PIAC submitted that there should be a positive obligation on the OPC to consult with Indigenous representatives such as the Aboriginal and Torres Strait Islander Social Justice Commissioner, and relevant Indigenous groups, to review and update the existing protocol.^[65] The Australian Institute of Aboriginal and Torres Strait Islander Studies (AIATSIS) and the Aboriginal and Torres Strait Islander Social Justice Commissioner advised the Inquiry of their willingness to be involved in such a consultation process.^[66]

7.37 It was also suggested in submissions that education will be essential to ensure awareness about rights and obligations arising from the protocols. The Office of the Victorian Privacy Commissioner noted that Indigenous people currently are under-represented as complainants in Victoria and other jurisdictions.^[67] PIAC submitted that issues of secrecy and privacy for Indigenous communities are not well understood.^[68]

7.38 Some stakeholders suggested particular areas in respect of which privacy protocols for Indigenous groups should be introduced. These include child protection,^[69] health, and the credit and telecommunications industries.^[70]

7.39 It was also submitted that the introduction of privacy protocols should augment, rather than diminish, the privacy rights of Indigenous groups. Accordingly, compliance with a privacy protocol should not mean that an Indigenous individual loses the protection of privacy laws, such as that provided by the Privacy Act.^[71]

Concerns about privacy protocols

7.40 A number of stakeholders questioned the efficacy of privacy protocols.^[72] For example, the Law Council of Australia was of the view that a stronger legislative model for the privacy of Indigenous groups was required. It noted ‘that the flexibility afforded by the high level principle approach associated with protocols … may not provide sufficient protection for the privacy rights of Indigenous groups’.^[73] It was also submitted that the introduction of privacy protocols would lead to complexity within the privacy regime.^[74]

7.41 The Aboriginal Justice Advisory Council (AJAC) submitted that ‘protocols are useful but only to the extent that the provisions are understood, adhered to, and performed’.^[75] AJAC noted that existing Australian laws, including laws relating to intellectual property and cultural heritage, offered only limited protection for the rights of Indigenous groups. It submitted that sui generis (specific) legislation that protected all forms of Indigenous culture was required. Nevertheless, it supported the privacy protocols proposed by the ALRC ‘as an interim measure or as a companion to other legislative/contractual measures’.^[76]

7.42 The Arts Law Centre of Australia also supported the introduction of specific legislation that would protect Indigenous cultural heritage and intellectual property. It did not support the ALRC’s proposal to introduce privacy protocols for groups of individuals, and submitted that

there are numerous existing protocols in the intellectual property and cultural fields in relation to Indigenous communities. It has been our experience that these are insufficient and that Indigenous artists and communities receive little protection and are frequently exploited. None of the existing protocols are enforceable unless they are adopted in individual contracts. Where voluntary protocols are adopted, they are adopted by participants who are focussed on appropriate conduct.^[77]

7.43 The Human Rights and Equal Opportunity Commission (HREOC) suggested that, to address concerns about non-compliance with protocols, the ALRC should consider amending the Privacy Act to give legal effect to rights and obligations arising under such protocols. For example, a privacy protocol could be approved by the OPC as a ‘code’ under Part IIIAA.^[78]

ALRC’s view

7.44 Currently, the most appropriate means of ensuring greater protection of group information that is of particular significance to Indigenous groups is for the OPC to encourage and assist agencies and organisations to create publicly available protocols that respond to the privacy needs of these groups.

7.45 The creation of privacy protocols would allow the principles set out in the Privacy Act to remain at a relatively high level, thereby avoiding an overly prescriptive approach to privacy regulation.^[79] This, in turn, will ensure that the Act retains its flexibility, allowing it to be applied in a broad range of circumstances. The development of privacy protocols will encourage those collecting group information to consult and negotiate with the relevant members of an Indigenous group before handling information that is culturally sensitive.^[80]

7.46 Privacy protocols should be developed in consultation with Indigenous groups and representatives to ensure that they are appropriate and effective. Indigenous groups, and representatives such as AIATSIS and the Aboriginal and Torres Strait Islander Social Justice Commissioner, are uniquely positioned to advise on the particular areas in which such protocols should be developed. These areas might include, for example, child protection,^[81] the media, or regimes for access to the information of deceased individuals.^[82]

7.47 Further, the ALRC agrees that it is essential that Indigenous groups, agencies and organisations are informed about how privacy protocols are developed, and any rights and obligations that may arise from the development of such protocols. Accordingly, the OPC should promote awareness of the privacy issues relating to Indigenous groups.

7.48 In recommending the development of privacy protocols, the ALRC is mindful of the concerns expressed about the efficacy of protocols in protecting the privacy rights of Indigenous groups, and acknowledges that protocols may not present the best comprehensive, long-term solution. In addition, the ALRC acknowledges that reform of existing laws would not provide the holistic protection of Indigenous cultural rights sought by some stakeholders to this Inquiry. For example, while the Privacy Act might protect privacy of some sacred knowledge of Indigenous groups, it could not provide rights for control of access to Indigenous sacred sites, nor would it allow groups to exercise control over recordings of cultural customs and expressions. Similarly, other laws, such as native title and intellectual property, have only limited capacity to protect Indigenous cultural rights.

7.49 In the current Inquiry, the ALRC did not receive sufficient information to recommend that the Australian Government introduce a legislative framework for the protection of a range of cultural rights relating to the traditional laws and customs of Indigenous groups—which might include rights akin to privacy, cultural heritage and intellectual property rights. Further, in the ALRC’s view, such a recommendation would be outside the Terms of Reference for this Inquiry.

7.50 A further inquiry should be undertaken, however, to determine whether the Australian Government should introduce a rights framework for the traditional laws and customs of Indigenous groups. Such an inquiry should involve extensive consultation with Indigenous groups and representatives, and could consider: whether such a framework is desirable; if so, what types of rights should be protected through such a framework; the most appropriate mechanism through which to recognise such rights; the methods for establishing rights and determining disputes among rights-holders; and the relationship between such a framework and other Australian laws.