Misuse of private information

5.36 The second type of invasion of privacy that the ALRC recommends should be covered by the new privacy tort is misuse of private information. This should be neither surprising nor contentious. Misuse of private information is a widely recognised type of invasion of privacy, already actionable in the UK, the US, New Zealand, Canada and elsewhere. No stakeholder suggested that if a new privacy tort were enacted in Australia, it should not cover misuse of private information.

5.37 Most cases involving private information are concerned with unauthorised disclosure. Lord Hoffmann has identified ‘the right to control the dissemination of information about one’s private life’ as central to a person’s privacy and autonomy.[40] But there are other ways of misusing private information, including wrongfully obtaining it. The ALRC recommends that the Act include the two most common types of misuse of private information as illustrative examples: collecting or disclosing private information.

5.38 This corresponds to the second of Moreham’s two overarching categories of invasion of privacy, under which Moreham found three sub-categories of invasion. It was a breach of privacy to:

(1) ‘find out things about others that they wish to keep to themselves, by acquiring
bank records, reading diaries, or hacking e-mails, for instance’;

(2) ‘keep that private information either for one’s own future reference or to share it with others’; and

(3) disclose private information to another, for example ‘by uploading it onto the internet, disseminating it in the media or passing it on through gossip’.[41]

5.39 ‘The objection in these cases,’ Moreham writes, ‘is to the fact that someone is finding out about you against your wishes. She is reading your private records, building up a file or dossier about you or, by disseminating private information, allowing others to do the same’.[42]

Misuse in other jurisdictions

5.40 The elements of the US tort, set out in the Restatement of the Law Second, Torts, are that publicity is given to a matter concerning the private life of another, and ‘the matter publicized is of a kind that (a) would be highly offensive to a reasonable person, and (b) is not of legitimate concern to the public’.[43] The commentary to the Restatement notes that publicity ‘means that the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge’.[44]

5.41 The disclosure of private information is now also a settled basis for action in the UK. The new or extended cause of action has developed out of the equitable cause of action for breach of confidence, as formulated in Campbell v MGN Ltd, since the enactment of the Human Rights Act 1998 (UK), which incorporates elements of the European Convention on Human Rights (ECHR).[45] Article 8 of the ECHR provides, in part, that ‘everyone has the right to respect for his private and family life, his home and his correspondence’. Although art 8 is not confined to private information, the focus of the UK action on disclosure of private information may be partly attributed to its roots in the equitable doctrine of breach of confidence, which protects confidential information.

5.42 The New Zealand courts have recognised a new tort of invasion of privacy by giving publicity to private facts.[46] There are two fundamental requirements for a successful claim. The first is the ‘existence of facts in respect of which there is a reasonable expectation of privacy’.[47] The second is ‘publicity given to those private facts that would be considered highly offensive to an objective reasonable person’.[48]

Misuse or disclosure?

5.43 Solove has argued that privacy ‘involves more than avoiding disclosure; it also involves the individual’s ability to ensure that personal information is used for the purposes she desires’.[49]

5.44 Disclosure of personal information is perhaps the most common type of misuse of personal information that will invade a person’s privacy. Wacks writes that the ‘tort of misuse of private information obviously requires evidence of misuse which, in practice, signifies publication of such information’.[50]

5.45 It is important to note that many invasions of privacy that seem to involve misuse, but not publication, of private information, may better be considered intrusions into private affairs. For example, an employee of a company who, without authorisation, accesses private information of a customer (or fellow employee)[51] may have intruded into the private affairs of that customer. Such an intrusion would be covered by the first category of invasion recommended by the ALRC. Nevertheless, the ALRC considers that it is reasonable not to confine this second type of invasion to disclosure as some other type of misuse of private information may invade a person’s privacy.

5.46 Public disclosure of private information will be a common type of misuse, but the Act should not confine misuse to public disclosures. In some circumstances, the disclosure of personal information to one other person may be a serious invasion of privacy.[52]

5.47 The US tort, on the other hand, is confined to public disclosures. The Restatement of the Law Second, Torts, states that publicity means ‘the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge’.[53]

5.48 The fact that a disclosure of personal information was not public may make it more difficult for a plaintiff to satisfy other elements of the action. For example, it may suggest the invasion of privacy was less serious than it might otherwise have been. Also, the plaintiff’s expectation of privacy may not always extend to non-public disclosures of personal information. However, there may be some cases in which it is reasonable to expect one’s personal information not to be disclosed even within a small circle.[54]

Untrue personal information

Recommendation 5–2 The Act should provide that ‘private information’ includes untrue information, but only if the information would be private if it were true.

5.49 A person’s privacy can in some cases be invaded by the disclosure of untrue information, but perhaps this would only amount to an invasion of privacy if the information were true. For example, a court might consider that the fact that a particular person, an ordinary citizen, is suffering from a mental illness is private information which should not be disclosed in the press. If a newspaper disclosed that a particular person had a mental illness, and it turned out that the person did not, then an action for invasion of privacy should not be defeated merely on the basis that the information was incorrect.

5.50 This is one reason why the ALRC recommends that the new Australian tort refer to private ‘information’, rather than ‘facts’. The use of the word ‘fact’ in this statutory tort may imply that the relevant private information must be true for it to be the subject of the cause of action.

5.51 This position is consistent with the Privacy Act 1988 (Cth), in which personal information is defined in s 6 to include information or an opinion ‘whether true or not’.[55] It is also the position in UK law. Former judge of the UK High Court, Sir David Eady, has written that

a claimant is not now expected to go through an article about (say) his or her sex life, or state of health, in order to reveal that some aspects are true and others false. That would defeat the object of the exercise and involve even greater intrusion. Any speculation or factual assertions on private matters, whether true or false, can give rise to a cause of action.[56]

5.52 In McKennitt v Ash, Longmore LJ of the English Court of Appeal stated:

The question in a case of misuse of private information is whether the information is private, not whether it is true or false. The truth or falsity is an irrelevant inquiry in deciding whether the information is entitled to be protected and judges should be chary of becoming side-tracked into that irrelevant inquiry.[57]

5.53 Dr Normann Witzleb submitted that ‘the misuse or disclosure of untrue private information can be just as damaging as the misuse or disclosure of true private information’:

There is no reason to limit the protection to true information. Limiting the tort to true information would require a plaintiff to confirm or admit in court the veracity of information which she would not like to see in the public domain, at all. This would be likely to unfairly prejudice the plaintiff’s interests in protecting her private life from publicity.[58]

5.54 Sometimes the disclosure of untrue private information will amount to defamation, but often it may not. The ALRC does not consider, as one stakeholder suggested, that the law of defamation provides ‘adequate protection to individuals for information that is found to be incorrect’.[59]

5.55 Also, it should be stressed that for the plaintiff to have an action under the privacy tort in this Report, the other elements of the tort would of course have to be satisfied. The untrue information would have to be a matter about which the plaintiff had a reasonable expectation of privacy and the misuse would have to be serious.[60] The ALRC is not recommending a tort for the publication of untrue information or, as discussed below, a tort for placing a person in a ‘false light’.