15.07.2014
Recommendation 11–4 The Act should provide for a defence of consent.
11.52 A defence of consent will provide protection and certainty to defendants where a plaintiff has provided consent to a particular act or conduct which would otherwise amount to a serious invasion of privacy.[59] Consent may be express or implied. To be valid as a defence to an intentional tort, it is not necessary that consent be ‘fully informed’, but it must be actual consent by a person capable of giving consent and must be freely given.[60]
11.53 In many instances, an individual will have manifested clear consent to conduct that may otherwise amount to a serious invasion of privacy. Like the defence of voluntary assumption of risk to a negligence claim, it reflects ‘good sense and justice [that] one who has … assented to an act being done towards him cannot, when he suffers from it, complain of it as a wrong’.[61]
11.54 Consent is a defence to many intentional torts, including battery, trespass to land and defamation.[62] It is a defence to the new action of misuse of personal information in the United Kingdom (UK).[63] In actions for breach of confidence, consent to the release of an obligation of confidence may be either absolute or limited to certain recipients.[64]
11.55 The Victorian Law Reform Commission (VLRC) recommended that consent be a defence.[65] The NSWLRC, rather than including consent with other defences, recommended that express or implied consent would negate the cause of action:
The function of clause [74(4) of the Draft Bill] is to deny plaintiffs an action that they may otherwise have mounted. It does so by making the issue of consent an essential element of the statutory cause of action, with the result that if there is consent, there is no invasion of privacy. While this puts the onus on the plaintiff to prove a negative (namely the absence of the plaintiff’s consent), forcing the plaintiff to make his or her case on consent at the outset allows the court to test whether the action has merit before it proceeds further.[66]
11.56 The formulation of consent as a defence is consistent with the approach in four Canadian provinces which have enacted a statutory cause of action and included consent as either a defence[67] or an exception.[68]
11.57 In the Discussion Paper, the ALRC proposed that a plaintiff’s consent be included as a factor for a court’s consideration of whether the plaintiff had a reasonable expectation of privacy.[69]
11.58 Although the ALRC agrees that the plaintiff’s consent to the conduct is relevant to whether or not they had a reasonable expectation of privacy in the circumstances, the ALRC now considers that it is preferable for a plaintiff’s actual consent to specific conduct to be treated as a complete defence.[70] This will provide greater certainty to defendants who may rely on having obtained a person’s consent prior to engaging in the specified conduct.
11.59 Many industries and professional groups operate on the basis and necessity of participant consent, either as part of contracts or for voluntary services or licences, including banking and financial services; medical and allied health practitioners; and social media providers, including social networking and dating organisations. The National E-Health Transition Authority (NeHTA) explained that consent is central to the viability of online medical records.[71] Without a complete defence of consent, such bodies would be exposed to uncertain liability.
11.60 The issue of whether consent has been given can be complex. For instance, consent in some circumstances may be withdrawn, the scope of consent may be unclear, or consent may have been given to other behaviour of the defendant or to third parties for similar conduct, such as publishing similar or related information. The fact that a person has previously consented to other conduct of the defendant (not within the scope of the consent given), or of third parties, may be considered as part of the general circumstances that are relevant when determining whether the plaintiff had a reasonable expectation of privacy. However, the ALRC considers that if a defendant can prove, and the onus will be on the defendant to do so, that the plaintiff actually consented to the conduct that is the subject of the complaint, this should be a complete defence.
Express and implied consent
11.61 Whether a plaintiff provided actual consent will be a matter of fact, which will depend on the construction of words and conduct. There are a number of conditions to be satisfied for the defence:
Consent must be given by the person whose privacy has been invaded, or by an individual who has legal capacity to consent on their behalf.[72]
Consent may be given expressly or inferred from conduct[73] and the absence of written consent a defendant can rely on oral evidence,[74] or conduct[75]or the circumstances.[76]
Consent must be freely given: consent obtained by duress will not be deemed to be free consent.
Consent must be to the particular disclosure or act complained of.[77] Consent will be ineffective when the conduct performed by a defendant is of a materially different nature to the conduct to which the plaintiff consented.[78] The plaintiff’s consent must relate to the extent of actual publication.[79]
11.62 To be effective, consent need not be fully informed, in the sense that the plaintiff was told of all the risks and implications of the conduct before giving consent. It is sufficient if the plaintiff is advised and consents in broad terms to the conduct.[80]
11.63 In relation to the publication of private information, English courts have shown caution in implying consent from the fact that the plaintiff engaged in earlier publicity.[81] Passive non-objection is generally not sufficient to demonstrate implied consent in actions for breach of confidence in the UK.[82]
11.64 Whether there was implied, actual consent to an actual publication is a distinct question from the issue of whether the plaintiff had a reasonable expectation of privacy. The need to distinguish these issues may arise where the plaintiff had previously released or allowed similar information to enter the public domain. Courts in UK tort actions for misuse of private information have stipulated that if an individual courts public attention, ‘they have less ground to object to the intrusion which follows’.[83] However, there is increasing recognition that a more nuanced approach is appropriate than was arguably shown in older cases, and that the appropriate time to look at prior publicity or conduct is when determining whether the plaintiff had a reasonable expectation of privacy at the relevant time.[84]
11.65 The digital era raises particular concerns in respect of consent to the publication of information. Commentators have questioned whether consent in online interactions and communications can be considered free and informed.[85] Online contracts and terms and conditions for online services such as internet banking and social media sites are often long, complex and are prone to frequent revision. Terms and conditions are often ‘bundled’[86] without clear explanation of their meaning and consequences.[87] A situation may arise where a plaintiff consented, by agreeing to broad terms and conditions, to general conduct: the question of whether the specific conduct comes within the consent given will be a matter for the courts to construe.
11.66 Other stakeholders highlighted the difficulty for people to understand the nature, extent and legal effect of consent in intimate partner situations, both in ongoing relationships and in circumstances where the relationship breaks down.[88]
11.67 The ALRC considers that Australian courts are experienced in determining the scope and validity of a plaintiff’s consent, whether express or implied, to particular conduct in a range of factual circumstances, such as online interactions and intimate partner situations.
Onus of proof
11.68 By classifying consent as a defence, the ALRC intends that a defendant will bear the onus of proving that a plaintiff consented to the defendant’s conduct.
11.69 The question of who bears the onus of proving that a plaintiff consented to physical conduct for the tort of battery is contentious in English and Australian civil law. The plurality of opinions was highlighted in Marion’s case by McHugh J:
In England, the onus is on the plaintiff to prove lack of consent. That view has the support of some academic writers in Australia but it is opposed by other academic writers in Australia. It is opposed by Canadian authority. It is also opposed by Australian authority. Notwithstanding the English view, I think that the onus is on the defendant to prove consent. Consent is a claim of ‘leave and licence’. Such a claim must be pleaded and proved by the defendant in an action for trespass to land. It must be pleaded in a defamation action when the defendant claims that the plaintiff consented to the publication. The Common Law Procedure Act 1852 also required any ‘defence’ of leave and licence to be pleaded and proved. However, those who contend that the plaintiff must negative consent in an action for trespass to the person deny that consent is a matter of leave and licence. They contend that lack of consent is an essential element of the action for trespass to a person. I do not accept that this is so. The essential element of the tort is an intentional or reckless, direct act of the defendant which makes or has the effect of causing contact with the body of the plaintiff. Consent may make the act lawful, but, if there is no evidence on the issue, the tort is made out. The contrary view is inconsistent with a person’s right of bodily integrity. Other persons do not have the right to interfere with an individual’s body unless he or she proves lack of consent to the interference.[89]
11.70 The ALRC considers that the defendant will be best placed to provide evidence and prove that the plaintiff consented to the conduct invading privacy. Consent is generally considered to be a defence to an invasion of privacy in the UK.[90]
11.71 Despite not bearing the legal onus, the plaintiff may bear a provisional or tactical burden in relation to consent.[91] However, this does not create a legal burden to disprove facts.[92] In other words, where consent is a defence, a plaintiff has a non-legal, tactical obligation to show they did not provide consent.
11.72 While the ALRC recommends that a defendant bear the legal onus of proving that a plaintiff consented to the invasion of their privacy, a plaintiff will clearly have a strategic onus of showing that that their consent did not extend to a defendant’s specific conduct, and may need to plead facts in reply.[93]
Revocation and withdrawal of consent
11.73 The legal effect of a revocation or withdrawal of consent may be an important consideration in cases involving disclosure of private information, and particularly so in the digital era where online publications remain active indefinitely.
11.74 As a matter of law, it is clear that just as a person may consent expressly or impliedly to another’s conduct, so they may expressly or impliedly revoke that consent, provided reasonable notice is given to the other party.[94]Generally speaking, consent may be withdrawn at any time before the relevant conduct, despite a plaintiff having provided prior express consent.[95] However, it appears that a person cannot withdraw consent and expect the other party to act upon that revocation immediately if it would be unreasonable in the circumstances to expect them to do so.[96]
11.75 To revoke a consent given under contract—for example, for the publication of certain information or to appear on a television program—may of course be a breach of that contract. However, the other party would be entitled to damages, assessed on the usual basis, and should not be disentitled to revoke their consent. It would be difficult for the other party to obtain relief by either the equitable remedy of specific performance of the contract, or an injunction to restrain the (probably implied) promise not to breach it. Most cases would involve the media or other commercial publishers for whom damages would usually be adequate to remedy the harm done by the breach (either expense wasted in reliance on the contract going ahead or loss of the profits expected).[97]
11.76 In the UK, there is limited authority on the circumstances in which consent to the use or disclosure by the media of an individual’s private information may be revoked.[98] Copyright law can provide some guidance here. A licence which is provided gratuitously can be revoked with notice at any time in circumstances where no stipulation for its duration has been made.[99]
11.77 In the privacy context, there are some other scenarios where the effect of revocation of consent will not be straightforward. One would be the online disclosure of personal information by a defendant, with the plaintiff’s consent, during the course of an intimate relationship, which has subsequently ended and where the plaintiff no longer wants the information to be available to others. Another would be where a person has gratuitously consented to the publication of private facts by a journalist and then wishes to revoke the consent.
11.78 Subject to public interest matters, a revocation may certainly be effective to control future disclosures or publications. It would not be effective to counteract a publication, based on the consent that has already happened, such as in a book, magazine, newspaper or documentary film.
11.79 Another area of uncertainty is where prior consent was given to a publication of information, in the nature of a continuing publication. In a sense, all information available online is continually published: publication occurs every time the information is downloaded from a website.[100] So the question arises as to whether a person can effectively revoke actual consent that was given before or at the time of the posting, ask for the posting to be taken down, and if it is not, successfully assert that the continuing publication is a serious invasion of privacy.[101] If the plaintiff’s actual consent is the only fact stopping the publication being an invasion of privacy, then it is arguable that the revocation should be effective. However, there are likely to be other considerations. While this issue will no doubt be argued, in Australia or elsewhere, the issue as it applies to privacy law is somewhat hypothetical and uncertain.[102]
11.80 The ALRC suggests that the best way to approach this issue would be to deal with it as part of the question of whether or not the plaintiff has a reasonable expectation of privacy at the time of the action, taking into account the revocation of prior consent, the reasonableness of the revocation and of the request for the posting to be taken down, the reasonableness or otherwise of the defendant’s refusal or failure to do so, and the public interest in its continuing publication.[103]
-
[59]
Several stakeholders support a defence of consent: Google, Submission 54; Australian Communications and Media Authority, Submission 52; ABC, Submission 46; Interactive Games and Entertainment Association, Submission 40; Australian Privacy Foundation, Submission 39; D Butler, Submission 10; I Turnbull, Submission 5.
-
[60]
Contractual consent and similar terms will be subject to contract law and consumer protection laws.
-
[61]
Smith v Baker 325 1981 AC.
-
[62]
Barker et al, above n 52, 36. There is some debate in relation to battery as to whether absence of consent is an element of the cause of action that must be established by the plaintiff, or whether consent is a defence, that must be pleaded and proved by the defendant. Barker et al, take the view that it is as a defence.
-
[63]
M Warby et al, Tugendhat and Christie: The Law of Privacy and The Media (OUP Oxford, 2011) [12.09].
-
[64]
Tanya Aplin et al, Gurry on Breach of Confidence (Oxford University Press, 2nd ed, 2012) [14.16].
-
[65]
Victorian Law Reform Commission, Surveillance in Public Places, Report 18 (2010) recs 27(a) and 28(a).
-
[66]
NSW Law Reform Commission, Invasion of Privacy, Report 120 (2009) [5.51].
-
[67]
Privacy Act, CCSM 1996, c P125 (Manitoba) s 5(a); Privacy Act, RSS 1978, c P-24 (Saskatchewan) s 4(a); Privacy Act, RSNL 1990, c P-22 (Newfoundland and Labrador) s 5(a).
-
[68]
Privacy Act, RSBC 1996, c 373 (British Columbia) s 2(a).
-
[69]
Australian Law Reform Commission, Serious Invasions of Privacy in the Digital Era, Discussion Paper 80 (2014) Proposal 6–2(h). This proposal stated that ‘the new Act should provide that, in determining whether a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances, the court may consider whether the plaintiff consented to the conduct of the defendant’.
-
[70]
The ABC submitted that, while it is appropriate to look at the issue of consent in considering actionability, it is also appropriate for consent to be included as a complete defence where it is relevant to the circumstances of a particular case: ABC, Submission 46.
-
[71]
National E-Health Transition Authority, Submission 8.
-
[72]
Warby et al, above n 63, [12.10]; Aplin et al, above n 64, [14.07].
-
[73]
Giller v Procopets (2008) 24 VR 1.
-
[74]
Aplin et al, above n 64, [12.06].
-
[75]
Implied consent will be found where there has been positive action by a plaintiff which involves disclosure of their private information to another party: Prout v British Gas plc and Another [1992] FSR 478, (Ford J). The court in this case held that an application for a patent may be regarded as an implied release of the information into the public domain. This case was referred to in Aplin et al, above n 64, [14.15].
-
[76]
Halliday v Neville (1984) 155 CLR 1, [6] (Gibbs CJ, Mason, Wilson and Deane JJ).
-
[77]
Balkin and Davis, above n 3, [6.5].
-
[78]
Ibid.
-
[79]
Campbell v MGN Ltd [2004] 2 AC 457, [73]–[75] (Lord Hoffman). Lord Hoffman was referring to Peck v United Kingdom [2003] ECHR 44 (28 January 2003). See also, Warby et al, above n 63, [12.15].
-
[80]
Rogers v Whitaker (1992) 175 CLR 479, [490] (Brennan, Dawson, Toohey and McHugh JJ). Failure to fully inform a person of the risks involved does not vitiate consent but may constitute breach of any legal duty of care.
-
[81]
Warby et al, above n 63, [12.09].
-
[82]
Ibid [12.12].
-
[83]
A similar principle has been applied in breach of confidence cases: the court might hold that the information no longer has the quality of confidence if the plaintiff had previously spoken publicly about related matters: Theakston v MGN Ltd [2002] EMLR 398; Lennon v News Group Newspapers Ltd [1978] FSR 573; Woodward v Hutchins [1977] 1 WLR 760.
-
[84]
Warby et al, above n 63, 540. See, also, Ch 6.
-
[85]
See, eg, Daniel J Solove, ‘Privacy Self-Management and the Consent Dilemma’ (2013) 126 Harvard Law Review 1880.
-
[86]
Law Institute of Victoria, Submission 22.
-
[87]
Australian Privacy Foundation, Submission 39.
-
[88]
Women’s Legal Centre (ACT & Region) Inc, Submission 19. This submission highlights the increasing incidence of ‘revenge pornography’ where an individual discloses a compromising, sexually explicit photograph of a former partner which was obtained consensually during their relationship. See, also, Giller v Procopets (2008) 24 VR 1.
-
[89]
Secretary, Department of Health and Community Services v JWB and SMB (Marion’s case) (1992) 175 CLR 218, [5] (McHugh J). (Citations omitted).
-
[90]
Warby et al, above n 63. This is despite the position in battery cases: Freeman v Home Office (No 2) [1984] QB 524. The English Court of Appeal held that in actions for battery, the burden of providing absence of consent is on the plaintiff as the tort redresses the ‘unconsented to intrusion of anotherS’ bodily integrity’.
-
[91]
This is a ‘tactical obligation to lead counter-evidence placed upon a party against whom evidence has been adduced’: J D Heydon, LexisNexis, Cross on Evidence, Vol 1 (at Service 164) [7005].
-
[92]
Ibid [7015].
-
[93]
‘A plaintiff ought not, in the statement of claim, anticipate the defence and plead so as to meet the anticipated defence. The defence might not take the course reflected in the statement of claim, and useless material might be introduced into the pleadings … The statement of claim is limited to stating whatever material facts and points of law are necessary to show that the plaintiff has a right to relief’: Bernard Cairns, Australian Civil Procedure (Thomson Reuters (Professional) Australia, 8th ed, 2009) [7.100].
-
[94]
Cowell v Rosehill Racecourse Co Ltd [1937] ALR 273.
-
[95]
Balkin and Davis, above n 3, [6.13].
-
[96]
This seems the better explanation, in modern times, for cases like Herd v Weardale Steel Coal and Coke Co Ltd [1915] AC 67. See also, Barker et al, above n 52, 79.
-
[97]
See further JW Carter, Contract Law in Australia (Lexis Nexis Butterworths, 6th ed, 2013) ch 40.
-
[98]
Warby et al, above n 63, [12.19].
-
[99]
Ibid.
-
[100]
Dow Jones & Co Inc v Gutnick (2002) 210 CLR 575.
-
[101]
It should be noted that this scenario does not involve information posted by others without the subject’s consent, which is another scenario raising the contentious and topical issue of whether there is some legal ‘right to be forgotten’, discussed in Ch 16.
-
[102]
Warby et al, above n 63, 537–538.
-
[103]
See Ch 6