Recommendation 11–4 The Act should provide for a defence of consent.

11.52 A defence of consent will provide protection and certainty to defendants where a plaintiff has provided consent to a particular act or conduct which would otherwise amount to a serious invasion of privacy.[59] Consent may be express or implied. To be valid as a defence to an intentional tort, it is not necessary that consent be ‘fully informed’, but it must be actual consent by a person capable of giving consent and must be freely given.[60]

11.53 In many instances, an individual will have manifested clear consent to conduct that may otherwise amount to a serious invasion of privacy. Like the defence of voluntary assumption of risk to a negligence claim, it reflects ‘good sense and justice [that] one who has … assented to an act being done towards him cannot, when he suffers from it, complain of it as a wrong’.[61]

11.54 Consent is a defence to many intentional torts, including battery, trespass to land and defamation.[62] It is a defence to the new action of misuse of personal information in the United Kingdom (UK).[63] In actions for breach of confidence, consent to the release of an obligation of confidence may be either absolute or limited to certain recipients.[64]

11.55 The Victorian Law Reform Commission (VLRC) recommended that consent be a defence.[65] The NSWLRC, rather than including consent with other defences, recommended that express or implied consent would negate the cause of action:

The function of clause [74(4) of the Draft Bill] is to deny plaintiffs an action that they may otherwise have mounted. It does so by making the issue of consent an essential element of the statutory cause of action, with the result that if there is consent, there is no invasion of privacy. While this puts the onus on the plaintiff to prove a negative (namely the absence of the plaintiff’s consent), forcing the plaintiff to make his or her case on consent at the outset allows the court to test whether the action has merit before it proceeds further.[66]

11.56 The formulation of consent as a defence is consistent with the approach in four Canadian provinces which have enacted a statutory cause of action and included consent as either a defence[67] or an exception.[68]

11.57 In the Discussion Paper, the ALRC proposed that a plaintiff’s consent be included as a factor for a court’s consideration of whether the plaintiff had a reasonable expectation of privacy.[69]

11.58 Although the ALRC agrees that the plaintiff’s consent to the conduct is relevant to whether or not they had a reasonable expectation of privacy in the circumstances, the ALRC now considers that it is preferable for a plaintiff’s actual consent to specific conduct to be treated as a complete defence.[70] This will provide greater certainty to defendants who may rely on having obtained a person’s consent prior to engaging in the specified conduct.

11.59 Many industries and professional groups operate on the basis and necessity of participant consent, either as part of contracts or for voluntary services or licences, including banking and financial services; medical and allied health practitioners; and social media providers, including social networking and dating organisations. The National E-Health Transition Authority (NeHTA) explained that consent is central to the viability of online medical records.[71] Without a complete defence of consent, such bodies would be exposed to uncertain liability.

11.60 The issue of whether consent has been given can be complex. For instance, consent in some circumstances may be withdrawn, the scope of consent may be unclear, or consent may have been given to other behaviour of the defendant or to third parties for similar conduct, such as publishing similar or related information. The fact that a person has previously consented to other conduct of the defendant (not within the scope of the consent given), or of third parties, may be considered as part of the general circumstances that are relevant when determining whether the plaintiff had a reasonable expectation of privacy. However, the ALRC considers that if a defendant can prove, and the onus will be on the defendant to do so, that the plaintiff actually consented to the conduct that is the subject of the complaint, this should be a complete defence.

Express and implied consent

11.61 Whether a plaintiff provided actual consent will be a matter of fact, which will depend on the construction of words and conduct. There are a number of conditions to be satisfied for the defence:

  • Consent must be given by the person whose privacy has been invaded, or by an individual who has legal capacity to consent on their behalf.[72]

  • Consent may be given expressly or inferred from conduct[73] and the absence of written consent a defendant can rely on oral evidence,[74] or conduct[75]or the circumstances.[76]

  • Consent must be freely given: consent obtained by duress will not be deemed to be free consent.

  • Consent must be to the particular disclosure or act complained of.[77] Consent will be ineffective when the conduct performed by a defendant is of a materially different nature to the conduct to which the plaintiff consented.[78] The plaintiff’s consent must relate to the extent of actual publication.[79]

11.62 To be effective, consent need not be fully informed, in the sense that the plaintiff was told of all the risks and implications of the conduct before giving consent. It is sufficient if the plaintiff is advised and consents in broad terms to the conduct.[80]

11.63 In relation to the publication of private information, English courts have shown caution in implying consent from the fact that the plaintiff engaged in earlier publicity.[81] Passive non-objection is generally not sufficient to demonstrate implied consent in actions for breach of confidence in the UK.[82]

11.64 Whether there was implied, actual consent to an actual publication is a distinct question from the issue of whether the plaintiff had a reasonable expectation of privacy. The need to distinguish these issues may arise where the plaintiff had previously released or allowed similar information to enter the public domain. Courts in UK tort actions for misuse of private information have stipulated that if an individual courts public attention, ‘they have less ground to object to the intrusion which follows’.[83] However, there is increasing recognition that a more nuanced approach is appropriate than was arguably shown in older cases, and that the appropriate time to look at prior publicity or conduct is when determining whether the plaintiff had a reasonable expectation of privacy at the relevant time.[84]

11.65 The digital era raises particular concerns in respect of consent to the publication of information. Commentators have questioned whether consent in online interactions and communications can be considered free and informed.[85] Online contracts and terms and conditions for online services such as internet banking and social media sites are often long, complex and are prone to frequent revision. Terms and conditions are often ‘bundled’[86] without clear explanation of their meaning and consequences.[87] A situation may arise where a plaintiff consented, by agreeing to broad terms and conditions, to general conduct: the question of whether the specific conduct comes within the consent given will be a matter for the courts to construe.

11.66 Other stakeholders highlighted the difficulty for people to understand the nature, extent and legal effect of consent in intimate partner situations, both in ongoing relationships and in circumstances where the relationship breaks down.[88]

11.67 The ALRC considers that Australian courts are experienced in determining the scope and validity of a plaintiff’s consent, whether express or implied, to particular conduct in a range of factual circumstances, such as online interactions and intimate partner situations.

Onus of proof

11.68 By classifying consent as a defence, the ALRC intends that a defendant will bear the onus of proving that a plaintiff consented to the defendant’s conduct.

11.69 The question of who bears the onus of proving that a plaintiff consented to physical conduct for the tort of battery is contentious in English and Australian civil law. The plurality of opinions was highlighted in Marion’s case by McHugh J:

In England, the onus is on the plaintiff to prove lack of consent. That view has the support of some academic writers in Australia but it is opposed by other academic writers in Australia. It is opposed by Canadian authority. It is also opposed by Australian authority. Notwithstanding the English view, I think that the onus is on the defendant to prove consent. Consent is a claim of ‘leave and licence’. Such a claim must be pleaded and proved by the defendant in an action for trespass to land. It must be pleaded in a defamation action when the defendant claims that the plaintiff consented to the publication. The Common Law Procedure Act 1852 also required any ‘defence’ of leave and licence to be pleaded and proved. However, those who contend that the plaintiff must negative consent in an action for trespass to the person deny that consent is a matter of leave and licence. They contend that lack of consent is an essential element of the action for trespass to a person. I do not accept that this is so. The essential element of the tort is an intentional or reckless, direct act of the defendant which makes or has the effect of causing contact with the body of the plaintiff. Consent may make the act lawful, but, if there is no evidence on the issue, the tort is made out. The contrary view is inconsistent with a person’s right of bodily integrity. Other persons do not have the right to interfere with an individual’s body unless he or she proves lack of consent to the interference.[89]

11.70 The ALRC considers that the defendant will be best placed to provide evidence and prove that the plaintiff consented to the conduct invading privacy. Consent is generally considered to be a defence to an invasion of privacy in the UK.[90]

11.71 Despite not bearing the legal onus, the plaintiff may bear a provisional or tactical burden in relation to consent.[91] However, this does not create a legal burden to disprove facts.[92] In other words, where consent is a defence, a plaintiff has a non-legal, tactical obligation to show they did not provide consent.

11.72 While the ALRC recommends that a defendant bear the legal onus of proving that a plaintiff consented to the invasion of their privacy, a plaintiff will clearly have a strategic onus of showing that that their consent did not extend to a defendant’s specific conduct, and may need to plead facts in reply.[93]

Revocation and withdrawal of consent

11.73 The legal effect of a revocation or withdrawal of consent may be an important consideration in cases involving disclosure of private information, and particularly so in the digital era where online publications remain active indefinitely.

11.74 As a matter of law, it is clear that just as a person may consent expressly or impliedly to another’s conduct, so they may expressly or impliedly revoke that consent, provided reasonable notice is given to the other party.[94]Generally speaking, consent may be withdrawn at any time before the relevant conduct, despite a plaintiff having provided prior express consent.[95] However, it appears that a person cannot withdraw consent and expect the other party to act upon that revocation immediately if it would be unreasonable in the circumstances to expect them to do so.[96]

11.75 To revoke a consent given under contract—for example, for the publication of certain information or to appear on a television program—may of course be a breach of that contract. However, the other party would be entitled to damages, assessed on the usual basis, and should not be disentitled to revoke their consent. It would be difficult for the other party to obtain relief by either the equitable remedy of specific performance of the contract, or an injunction to restrain the (probably implied) promise not to breach it. Most cases would involve the media or other commercial publishers for whom damages would usually be adequate to remedy the harm done by the breach (either expense wasted in reliance on the contract going ahead or loss of the profits expected).[97]

11.76 In the UK, there is limited authority on the circumstances in which consent to the use or disclosure by the media of an individual’s private information may be revoked.[98] Copyright law can provide some guidance here. A licence which is provided gratuitously can be revoked with notice at any time in circumstances where no stipulation for its duration has been made.[99]

11.77 In the privacy context, there are some other scenarios where the effect of revocation of consent will not be straightforward. One would be the online disclosure of personal information by a defendant, with the plaintiff’s consent, during the course of an intimate relationship, which has subsequently ended and where the plaintiff no longer wants the information to be available to others. Another would be where a person has gratuitously consented to the publication of private facts by a journalist and then wishes to revoke the consent.

11.78 Subject to public interest matters, a revocation may certainly be effective to control future disclosures or publications. It would not be effective to counteract a publication, based on the consent that has already happened, such as in a book, magazine, newspaper or documentary film.

11.79 Another area of uncertainty is where prior consent was given to a publication of information, in the nature of a continuing publication. In a sense, all information available online is continually published: publication occurs every time the information is downloaded from a website.[100] So the question arises as to whether a person can effectively revoke actual consent that was given before or at the time of the posting, ask for the posting to be taken down, and if it is not, successfully assert that the continuing publication is a serious invasion of privacy.[101] If the plaintiff’s actual consent is the only fact stopping the publication being an invasion of privacy, then it is arguable that the revocation should be effective. However, there are likely to be other considerations. While this issue will no doubt be argued, in Australia or elsewhere, the issue as it applies to privacy law is somewhat hypothetical and uncertain.[102]

11.80 The ALRC suggests that the best way to approach this issue would be to deal with it as part of the question of whether or not the plaintiff has a reasonable expectation of privacy at the time of the action, taking into account the revocation of prior consent, the reasonableness of the revocation and of the request for the posting to be taken down, the reasonableness or otherwise of the defendant’s refusal or failure to do so, and the public interest in its continuing publication.[103]