Recommendation 6–2 The Act should provide that, in determining whether a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances, the court may consider, among other things:

(a) the nature of the private information, including whether it relates to intimate or family matters, health or medical matters, or financial matters;

(b) the means used to obtain the private information or to intrude upon seclusion, including the use of any device or technology;

(c) the place where the intrusion occurred, such as in the plaintiff’s home;

(d) the purpose of the misuse, disclosure or intrusion;

(e) how the private information was held or communicated, such as in private correspondence or a personal diary;

(f) whether and to what extent the private information was already in the public domain;

(g) the relevant attributes of the plaintiff, including the plaintiff’s age, occupation and cultural background; and

(h) the conduct of the plaintiff, including whether the plaintiff invited publicity or manifested a desire for privacy.

6.26 The ALRC recommends that this non-exhaustive list of considerations should be set out in the Act. It is designed to assist rather than confine the court, when the court assesses whether the plaintiff had a reasonable expectation of privacy. Not all matters can be listed, but the ALRC has listed some of the more common or important matters.

6.27 The NSWLRC recommended the inclusion of a comparable list of matters that would help a court determine whether a person’s privacy has been invaded.[23]

6.28 A number of stakeholders submitted that the Act should include a list of factors for a court to consider,[24] and many generally supported the factors recommended in the Discussion Paper.[25] Others suggested that the reasonable expectation of privacy test would remain uncertain even if such a list of factors were included.[26] However, the ALRC considers that the lack of a comprehensive definition of privacy should not be a reason for denying remedies to people whose privacy is clearly invaded in certain ways.

6.29 In Murray v Big Pictures, which concerned photographs taken of a child in the street for commercial publication, the High Court of England and Wales set out a non-exhaustive list of matters a court should consider when determining whether the plaintiff had a reasonable expectation of privacy:

They include the attributes of the claimant, the nature of the activity in which the claimant was engaged, the place at which it was happening, the nature and purpose of the intrusion, the absence of consent and whether it was known or could be inferred, the effect on the claimant and the circumstances in which and the purpose for which the information came into the hands of the publisher.[27]

6.30 Other matters will be relevant in other cases, particularly in cases concerning intrusion upon seclusion. Professor Raymond Wacks has suggested that, in an action for intrusion upon seclusion, a court should take into account the following factors when determining whether the claimant had a reasonable expectation of privacy:

(a) the place where the intrusion occurred (for example, whether the claimant is at home, in office premises or in a public place, and whether or not the place is open to public view from a place accessible to the public, or whether or not the conversation is audible to passers-by);

(b) the object and occasion of the intrusion (for example, whether it interferes with the intimate or private life of the claimant); and

(c) the means of intrusion employed and the nature of any device used (for example, whether the intrusion is effected by means of a high-technology sense-enhancing device, or by mere observation or natural hearing).[28]

Different for misuse and intrusions

6.31 Before discussing the different factors, it should be noted that the factors that will be relevant to the reasonable expectation of privacy test may differ, depending on whether an invasion of privacy was by misuse of private information, or by intrusion upon seclusion. As Associate Professor Paul Wragg submitted, a court’s approach to determining whether a person in the position of the plaintiff would have a reasonable expectation of privacy is likely to be ‘markedly different in intrusion claims than informational claims’.[29] Within these broad categories of invasion, there are sub-categories, and the factors may also differ in relevance between those categories too.

6.32 In fact, which factors are relevant may differ in every case. As noted above, the test very much depends on the particular circumstances of the case. Different lists of factors could no doubt be created, for different types of invasion of privacy. But the ALRC considers that one list that is not exhaustive or prescriptive will be sufficient. Courts may consider the matters on the list that are relevant to the particular case, ignore those that are not, and consider any other matter that is relevant that is not on the list.

Nature of the information

6.33 The nature of the information will often suggest whether or not it is private. Information concerning the plaintiff’s intimate or family matters, health or medical matters,[30] and financial matters are all likely to be private. Gleeson CJ said in Australian Broadcasting Corporation v Lenah Game Meats that certain kinds of information about a person may be easy to identify as private, ‘such as information relating to health, personal relationships, or finances’.[31]

6.34 Personal information taken from medical records, reports, or interviews is also generally considered private in English courts.[32]

6.35 ‘The nature of the subject matter’ was included in a list of matters the NSWLRC recommended should be considered in determining whether there has been an invasion of privacy.[33]

6.36 The definition of ‘sensitive information’ in the Privacy Act may also be of some assistance to the courts, but should not be determinative of the question of whether the plaintiff had a reasonable expectation of privacy. ‘Sensitive information’ is defined to mean:

(a) information or an opinion about an individual’s:

i) racial or ethnic origin; or

ii) political opinions; or

iii) membership of a political association; or

iv) religious beliefs or affiliations; or

v) philosophical beliefs; or

vi) membership of a professional or trade association; or

vii) membership of a trade union; or

viii) sexual preferences or practices; or

ix) criminal record;

that is also personal information; or

(b) health information about an individual; or

(c) genetic information about an individual that is not otherwise health information;

(d) biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or

(e) biometric templates.[34]

6.37 This definition serves a particular regulatory purpose. It should be stressed that the types of sensitive information included in the definition will not necessarily give rise to a reasonable expectation of privacy under the tort. Whether something is private under the tort will depend on context and other relevant factors.

6.38 In the UK, it has been said that the nature of the information itself ‘is plainly of considerable if not prime importance. It may even be decisive in the question of whether the claimant enjoys a reasonable expectation of privacy in respect of it’.[35]

6.39 Intimate matters will often be sexual matters, widely considered to be private: ‘There are numerous general statements from English courts to the effect that sexual behaviour is an aspect of private life’.[36]

6.40 However, intimate and family matters can extend beyond sexual matters. Professor Des Butler submitted that people are ‘entitled to expect privacy for anything non-criminal taking place in the home environment, including any conversations or disagreements occurring therein’.[37] Butler also noted that, ‘[e]ven where the plaintiff has courted publicity, it would normally be expected that his or her family would nevertheless be entitled to their privacy, especially when there are children of a vulnerable age who are involved’.[38]

Means used

6.41 The means used to obtain private information or to intrude upon seclusion will sometimes be relevant to whether or not there is a reasonable expectation of privacy. For example, the fact that the defendant used spyware, or hacked into the plaintiff’s personal computer to take personal information, or used a long distance camera lens to peer into the plaintiff’s home, may suggest the plaintiff’s privacy has been invaded (regardless of what personal information or photograph is taken).

6.42 ASTRA submitted that it is ‘difficult to see how a person could form an expectation of privacy based on a use of technology of which they are unaware’.[39] However, the ALRC considers that a person can quite reasonably expect not to be intruded upon, even if they do not turn their minds to the means that might used to intrude upon their privacy. They may even reasonably expect privacy without even considering whether their privacy is remotely likely to be intruded upon at all.

6.43 Butler submitted that ‘[t]he fact that the information could only be obtained through surreptitious means should normally be an indication that in the circumstances there was a high expectation of privacy’.[40]

Place of intrusion

6.44 The physical place in which a person’s seclusion is intruded upon may have a bearing on whether they had a reasonable expectation of privacy in those circumstances. Most clearly, a person will have a greater expectation of privacy in the home than in a public place.

6.45 Although a person should generally have a lower expectation of privacy when in public, the ALRC considers that privacy may reasonably be expected in public places—in some circumstances.[41]

6.46 This has been recognised in a number of invasion of privacy cases outside Australia.[42] In one US case in 1964, a woman was photographed at a country fair leaving a ‘fun house’ at the moment at which some air jets blew her dress up. The photo was published on the front cover of a newspaper. The fact that she was in public, did not mean that she had no right to privacy. Harwood J of the Supreme Court of Alabama said:

a purely mechanical application of legal principles should not be permitted to create an illogical conclusion. To hold that one who is involuntarily and instantaneously enmeshed in an embarrassing pose forfeits her right of privacy merely because she happened at the moment to be part of a public scene would be illogical, wrong, and unjust.[43]

6.47 In an English case that went to the European Court of Human Rights, CCTV footage of a man in a public street, taken moments after he had tried to commit suicide, were later broadcast on television. The Court found this was an invasion of his privacy.[44] The man ‘was in a public street but he was not there for the purposes of participating in any public event and he was not a public figure. It was late at night, he was deeply perturbed and in a state of some distress’.[45] The footage was ‘viewed to an extent which far exceeded any exposure to a passer-by or to security observation and to a degree surpassing that which the applicant could possibly have foreseen’.[46]

6.48 In Campbell, Naomi Campbell was also in a public place when she was photographed leaving a Narcotics Anonymous meeting. The publication of that photograph in a newspaper was found to be an invasion of her privacy.[47] Although Lord Hoffmann thought there was ‘nothing embarrassing’ about the particular picture, he did say that the

the widespread publication of a photograph of someone which reveals him to be in a situation of humiliation or severe embarrassment, even if taken in a public place, may be an infringement of the privacy of his personal information.[48]

6.49 These cases illustrate some of the circumstances that may suggest that a person may have a reasonable expectation of privacy, despite being in a public place.

6.50 There may be different expectations of privacy with respect to the taking of a photo and to its later publication. It may be unreasonable to expect not to be photographed, particularly when in public,[49] but quite reasonable to expect the photograph not to be published, particularly if the photo captures a clearly private or humiliating moment. The importance of this distinction was stressed by photographers.[50]

6.51 Expectations of privacy may also vary between different types of public place. For example, a person may expect more privacy in a restaurant than when on the street.

6.52 Whether people can expect privacy at work is another interesting question. Although people should generally expect less privacy at work than at home, it is reasonable to expect some privacy at work. One case before the Supreme Court of California concerned whether a woman employed as a ‘telepsychic’ had invaded the privacy of one of her fellow employees—using, not her psychic powers, but a video camera hidden in her hat. The court found that the fact that other co-workers may have witnessed the interactions and conversations did not mean the plaintiff could not have a reasonable expectation of privacy:

In an office or other workplace to which the general public does not have unfettered access, employees may enjoy a limited, but legitimate, expectation that their conversations and other interactions will not be secretly videotaped by undercover television reporters, even though those conversations may not have been completely private from the participants’ co-workers.[51]

Purpose of intrusion

6.53 An intrusion into a person’s seclusion for a particular purpose may invade that person’s privacy, while the same intrusion for a different purpose would not. For example, a patient’s reasonable expectation of privacy has not been invaded when a nurse enters the patient’s hospital room to take their temperature, but may be invaded by a journalist entering the room to take photos of the patient for publication in a newspaper.[52]

6.54 In Murray v Big Pictures, the High Court of England and Wales included, in a list of matters a court should consider when determining whether the plaintiff had a reasonable expectation of privacy, ‘the nature and purpose of the intrusion’ and ‘the circumstances in which and the purpose for which the information came into the hands of the publisher’.[53] In that case, the court held that pictures had been

taken deliberately, in secret and with a view to their subsequent publication. They were taken for the purpose of publication for profit, no doubt in the knowledge that the parents would have objected to them.[54]

6.55 Tugendhat and Christie’s The Law of Privacy and the Media states, concerning the UK law, that this aspect of the law is ‘relatively undeveloped’ and it may be ‘open to debate how the “purpose of the intrusion” is to be determined (including whether the “purpose” is objective or subjective), and what weight should be accorded to what purposes’.[55]

6.56 The motivation of the defendant may also be relevant to an assessment of the seriousness of an invasion of privacy.[56]

How information was held or communicated

6.57 This matter relates to the form in which information is held, stored or communicated. Information held in some forms—such as a personal diary—may more clearly suggest that there is a reasonable expectation of privacy with respect to the information than to the same information held in another form.

6.58 The authors of Tugendhat and Christie’s The Law of Privacy and the Media have written that in some cases, ‘the principal focus of the court has been on the repository of the information as one likely to contain confidential or private information’:

Personal diaries, private correspondence, together with similarly private written communications, and conversations on the telephone have all been recognized as likely repositories of such information. More recently it has been held that information stored on a personal computer is prima facie confidential.[57]

6.59 New digital technologies will raise other questions. Email correspondence is treated like private correspondence, but not all information sent by email will be private in nature.

6.60 That a password or some other form of personal identification is required to gain access to a digital location containing personal information should, in the ALRC’s view, strongly suggests that the information is likely to be subject to a reasonable expectation of privacy.

6.61 Similar reasoning may apply to intrusions upon seclusion. A locked solid door suggest that those in the room behind the door expect complete privacy, but a glass door involves different expectations.

Information in the public domain

6.62 Whether and to what extent the information was in the public domain should be considered when determining if the plaintiff has a reasonable expectation of privacy.

6.63 There may be no clear line between what is in the public domain and what is not. In the context of confidential information, the public domain has been said to mean ‘no more than that the information in question is so generally accessible that, in all the circumstances, it cannot be regarded as confidential’.[58] Private information differs from confidential information in that the former is often private because of its nature, whereas the latter is often confidential only because of the obligation under which it was imparted.

6.64 Information that is private in nature will not automatically cease to be private once it is in the public domain. A person’s medical records, for example, do not cease to be private when someone wrongly publishes them on a website. Not only will the original publication to the internet be an invasion of privacy, but other subsequent uses of the records may also, in some cases, amount to an invasion of privacy. Eady J said in McKennitt v Ash:

there are grounds for supposing that the protection of the law will not be withdrawn unless and until it is clear that a stage has been reached where there is no longer anything left to be protected. For example, it does not necessarily follow that because personal information has been revealed impermissibly to one set of newspapers, or to readers within one jurisdiction, that there can be no further intrusion upon a claimant’s privacy by further revelations. Fresh revelations to different groups of people can still cause distress and damage to an individual’s emotional or mental well-being.[59]

6.65 However, an expectation of privacy will usually decrease, the more widely a piece of information has been published by someone.

Attributes of the plaintiff

6.66 Some attributes of a plaintiff, such as age, may affect whether the person had a reasonable expectation of privacy. A young person may have an expectation of privacy in some circumstances where an older person does not. Butler submitted that where ‘the plaintiff is a child of vulnerable age there would normally be a high expectation that he or she is entitled to a measure of privacy’.[60]

6.67 The occupation of the plaintiff may also be relevant, particularly if the plaintiff is a ‘public figure’. Persons in some occupations necessarily or traditionally invite or receive considerable attention from the public. A professional sportsperson or a politician, for example, cannot reasonably expect the same level of privacy as other members of the public, although they can reasonably expect some privacy.

6.68 ‘The extent to which the individual has a public profile’ was included in a list of matters the NSWLRC recommended should be considered in determining whether there has been an invasion of privacy.[61] People who are reluctantly or involuntarily put in the public spotlight, such as the victim of a crime, may however be distinguished from those who seek the limelight.[62]

6.69 The NSWLRC also included in this list the ‘extent to which the individual is or was in a position of vulnerability’.[63] Being in a position of vulnerability may not always be an attribute of the plaintiff, but the ALRC agrees that vulnerability may not only make an invasion of privacy more offensive and harmful, but will also sometimes suggest information is private, or that a person should not be intruded upon. A patient in a hospital would seem to have a reasonable expectation of privacy, for instance.[64]

6.70 The culture and background of a plaintiff may also be relevant to whether they have a reasonable expectation of privacy. Some information may be considered to be more private in some cultures than in others. These expectations may be well-known in the community. For example, the cultural expectations of Aboriginal and Torres Strait Islander peoples and other cultural or ethnic groups may be relevant to the reasonable expectation of privacy in some circumstances. The Arts Law Centre of Australia stressed the importance of considering the ‘confidential or culturally sensitive nature of cultural knowledge, stories, images of indigenous Australians’.[65]

6.71 The Australian Privacy Foundation said ‘great care’ should be given in taking into account age, occupation and other like factors, because it may suggest some people warrant less protection from invasions of privacy than others.[66] The ALRC agrees that the various factors should be considered carefully, when determining whether the plaintiff had a reasonable expectation of privacy, but it seems clear that some attributes of a plaintiff should give rise to a greater, or lesser, expectation of privacy.

Conduct of the plaintiff

6.72 The conduct of the plaintiff may sometimes affect whether the plaintiff had a reasonable expectation of privacy.

6.73 Some conduct may undermine a person’s expectation of privacy. For example, if a plaintiff invited publicity about a particular matter, it may be less reasonable for them to expect the matter to be kept private. A person who runs naked on a football field can hardly expect not to be photographed.

6.74 A plaintiff cannot generally expect privacy where they have freely consented to the conduct that compromises their privacy.[67] In Chapter 11, the ALRC recommends that consent be a defence to this tort, but the plaintiff’s consent to certain conduct may also arise when determining whether the plaintiff had a reasonable expectation of privacy. Consent given to someone other than the defendant can also be relevant. A plaintiff who has consented to the publication of private information in one newspaper, may not always reasonably expect the information not to be published in another newspaper.

6.75 A court might also ask whether the plaintiff had ‘courted publicity on the relevant occasion’.[68] A person who has courted publicity cannot expect the same level of privacy as those who have not. However, care must be taken here, because it does not follow that such persons forgo any right to privacy, just as a person does not, by manifesting a desire for privacy, automatically become entitled to it. People should generally be able to set limits on how far the public may see into their private life. That a person reveals some facts about their private life certainly does not suggest that all aspects of their private life are then open to public attention. But if a person has invited publicity on a particular matter, it may generally be less reasonable for them to later say that the defendant went too far.

6.76 A claim to privacy may also be more difficult to maintain where the plaintiff has been deceptive or hypocritical about the particular matter. Guardian News and Media Limited and Guardian Australia submitted that

a public figure who makes a public stand on a particular issue may then, inconsistently, seek to cloak particular facts relating to that issue in privacy: in such circumstances the Court should be entitled to consider those additional circumstances. Further it is often the case that plaintiffs’ actual conduct can differ from and be inconsistent with their publicly stated views.[69]

6.77 On this last point, it is interesting to compare the comments of Professor James Griffin, in his article The Human Right to Privacy:

a society is the healthier for combating certain forms of hypocrisy; it is certainly better for combating injustice. But a homosexual bishop who believes, even if misguidedly, that priests should not be active homosexuals is not necessarily abusing his power. Not all persons whose appearance differs from their reality are thereby hypocrites. A homophobe, whether homosexual or not, who acts hostilely towards homosexuals solely because they are homosexual is unjust. The injustice deserves exposure. That is the public interest. But if the homophobe is himself also homosexual, to publicize that further fact is protected neither by the outer’s freedom of expression not the public’s right to information. On the contrary, it is an outrageous infringement of the homophobe’s right to privacy. It is not that a person’s sex life is never of public interest but that usually it is not.[70]

6.78 Other conduct of the plaintiff may strengthen a plaintiff’s claim that they had a reasonable expectation of privacy. Notably, it is more reasonable to expect privacy, if one has asked for it. The author of a document marked ‘private’ obviously thereby manifests some desire for the document to be treated as private. Similarly, a person who asks to sit in a private room of a restaurant may more reasonably expect privacy than a person who does not. Accordingly, the ALRC recommends that the Act refer to whether, and if so to what extent, the plaintiff had manifested a desire for privacy, in the list of relevant considerations. It was submitted that whether the plaintiff had been ‘directly informed about how to manifest a desire not to have his or her privacy invaded’ might also be relevant.[71]

6.79 The Australian Privacy Foundation (APF) said there was ‘little utility’ in this factor. A person should not ‘need to express a desire not to be the subject of a tortious wrong’. The APF said that this factor is ‘likely to be used by defendants who may use the lack of a demonstrated, overt desire as being a factor to be taken into account against a plaintiff’.[72] The ALRC agrees that a person should not easily be taken to have forfeited their privacy, simply because they did not manifest a clear desire for privacy. But where such a desire for privacy is made manifest, it does seem more reasonable to expect privacy.

Other matters

6.80 The list of factors is not exhaustive. A court may consider other matters when determining whether a person in the plaintiff’s position would have a reasonable expectation of privacy.

6.81 For example, the nature of the relationship between the parties may also be relevant. There do not appear to be many cases in which a person has brought an action for invasion of privacy against his or her spouse, partner or other family member. It would generally not be reasonable to expect the same level of privacy from partners and family members. But when relationships break down, the expectation of privacy may then increase. In some cases, the expectation of privacy may even be higher with respect to a former intimate partner, than with others. Women’s Legal Services NSW submitted that it is reasonable that victims of family violence should have a higher expectation of privacy.[73]

6.82 Butler submitted a list of matters that should be considered. Many of these matters are included in the list recommended by the ALRC, but others include the intimacy of a sexual relationship; whether the disclosure would cause a risk of serious injury to the plaintiff; and whether the information is ‘contained in a public record which is part of the public consciousness’.[74]

6.83 It is not possible to list or analyse all of the factors that may affect whether a person in a particular case can reasonably expect privacy. This is why it is important that a list of relevant factors be non-exhaustive. A court should consider any other relevant factors. By adopting the widely used test of whether the plaintiff had a reasonable expectation of privacy, Australian courts may also draw on the analysis of courts in other countries.