A cause of action for two types of invasion of privacy

5.5 Misuse of private information and intrusion upon seclusion have been said to lie at the heart of any legal protection of privacy. Unwanted access to private information and unwanted access to one’s body or personal space have been called the ‘two core components of the right to privacy’.^[1] Most examples of invasions of privacy given to support the introduction of a new cause of action, and most cases in other jurisdictions relating to invasions of privacy, fall into one of these two categories. To provide clarity, certainty and guidance about the purpose and scope of the new action, the ALRC proposes that the action be explicitly confined to these two types of invasion of privacy.^[2] This means that invasions of privacy that do not fall into one of these two categories will not be actionable under the new tort.^[3]

5.6 Although, as discussed below, many stakeholders said the Act should contain a non-exhaustive list of examples of conduct which may be an invasion of privacy, others noted the benefits of confining the action. Telstra submitted that a non-exhaustive list of examples would allow for the possibility of other types of invasion of privacy to be actionable, and that this would give rise to undesirable uncertainty:

Categories of conduct caught by any cause of action should be listed exhaustively, using unambiguous and objective terms, in order to reduce the uncertainty and impact that the introduction of such a cause of action would cause to businesses and service providers.^[4]

5.7 The two categories of invasion of privacy proposed above draw on the well-known categorisation of privacy torts in the United States, first set out by William Prosser in 1960, and followed in the US Restatement of the Law Second, Torts.^[5] Prosser wrote that the law of privacy

comprises four distinct kinds of invasion of four different interests of the plaintiff, which are tied together by the common name, but otherwise have almost nothing in common except that each represents an interference with the right of the plaintiff, in the phrase coined by Judge Cooley, ‘to be let alone’. Without any attempt to exact definition, these four torts may be described as follows:

1. Intrusion upon the plaintiff’s seclusion or solitude, or into his private affairs.

2. Public disclosure of embarrassing private facts about the plaintiff.

3. Publicity which places the plaintiff in a false light in the public eye.

4. Appropriation, for the defendant’s advantage, of the plaintiff’s name or likeness.^[6]

5.8 The ALRC considers that, in Australia, a new privacy tort should be confined to the first two of these four categories. In ABC v Lenah Game Meats Pty Ltd, Gummow and Hayne JJ said that ‘the disclosure of private facts and unreasonable intrusion upon seclusion, perhaps come closest to reflecting a concern for privacy “as a legal principle drawn from the fundamental value of personal autonomy”’.^[7] These two types of invasion of privacy are discussed further below.

Intrusion upon seclusion or private affairs

5.9 Intrusion upon seclusion is one of the two most commonly recognised categories of invasion of privacy. The ALRC considers it essential that the new tort capture this type of conduct.

5.10 The tort of intrusion upon seclusion, Prosser wrote in 1960, ‘has been useful chiefly to fill in the gaps left by trespass, nuisance, the intentional infliction of mental distress, and whatever remedies there may be for the invasion of constitutional rights’.^[8] These gaps remain in Australian protection of privacy from intrusion today.

5.11 Prosser cited a number of US cases involving intrusion upon seclusion, including cases in which the defendant intruded into someone’s home, hotel room and ‘stateroom on a steamboat’, and upon a woman in childbirth. The principle was ‘soon carried beyond such physical intrusion’ and ‘extended to eavesdropping upon private conversations by means of wire tapping and microphones’ and to ‘peering into the windows of a home’.^[9] Prosser cited a case in which a creditor ‘hounded the debtor for a considerable length of time with telephone calls at his home and his place of employment’ and another case of ‘unauthorized prying into the plaintiff’s bank account’.^[10]

5.12 Section 652B of the US Restatement of the Law Second, Torts concerns intrusion upon seclusion, and states:

One who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.

5.13 The accompanying commentary in the Restatement reads:

a. The form of invasion of privacy covered by this Section does not depend upon any publicity given to the person whose interest is invaded or to his affairs. It consists solely of an intentional interference with his interest in solitude or seclusion, either as to his person or as to his private affairs or concerns, of a kind that would be highly offensive to a reasonable man.

b. The invasion may be by physical intrusion into a place in which the plaintiff has secluded himself, as when the defendant forces his way into the plaintiff’s room in a hotel or insists over the plaintiff’s objection in entering his home. It may also be by the use of the defendant’s senses, with or without mechanical aids, to oversee or overhear the plaintiff’s private affairs, as by looking into his upstairs windows with binoculars or tapping his telephone wires. It may be by some other form of investigation or examination into his private concerns, as by opening his private and personal mail, searching his safe or his wallet, examining his private bank account, or compelling him by a forged court order to permit an inspection of his personal documents. The intrusion itself makes the defendant subject to liability, even though there is no publication or other use of any kind of the photograph or information outlined.^[11]

5.14 The US tort of intrusion has been said to focus on ‘the means of obtaining private information rather than on the publication of the information so gained. The core of the tort is the offensive prying into the private domain of another’.^[12]

5.15 In the United Kingdom, there is no comparable tort for invasions of privacy by intrusion upon seclusion, falling short of trespass and nuisance.^[13] The House of Lords in Wainwright v Home Office^[14] ‘expressly declined to recognize a general right to privacy which would extend to physical privacy interferences not involving the dissemination of information’.^[15]

5.16 This apparent gap in the UK law may not be so concerning as it is in Australia, because the UK has a Protection from Harassment Act 1997 (UK), which provides some legislative protection against invasions of privacy by intrusion into seclusion. In Chapter 14, the ALRC proposes the introduction of a statutory cause of action for harassment, in the event that the proposed privacy tort is not introduced.

5.17 Although there is no tort for intrusion upon seclusion in the UK, courts have recognised the potential for intrusions to invade privacy and cause harm. The majority of the House of Lords in Campbell v MGN Ltd emphasised that the covert way in which private information about the model Naomi Campbell, later published, was obtained in that case, heightened the invasion of Campbell’s privacy. Lord Hoffman said: ‘the publication of a photograph taken by intrusion into a private place (for example, by a long distance lens) may in itself be such an infringement [of the privacy of the personal information], even if there is nothing embarrassing about the picture itself’.^[16] Similarly, in Murray v Express Newspapers, Sir Anthony Clarke MR said that, ‘“the nature and purpose of the intrusion” is one of the factors which will determine whether the claimant had a reasonable expectation of privacy’.^[17]

5.18 Further, in a number of recent cases, the English and European courts have begun to emphasise the intrusive aspects of the conduct under consideration, not only in the way the private information was collected,^[18] but also in the effect the publication will have on the claimant’s and related parties’ lives after publication.^[19] Intrusive behaviour by the UK media led to the Leveson Inquiry into the Culture, Practice and Ethics of the Press.^[20]

5.19 Discussing the ‘curious’ resistance of the English courts to recognise a cause of action for intrusion, Raymond Wacks writes that nevertheless

there are a number of obiter dicta that imply that the clandestine recordings of private matters does ‘engage’ Article 8, that the mere taking of a photograph of a child or an adult in a public place might fall within the category of ‘misuse’. These pronouncements are either (uncharacteristic) judicial lapses or subtle, possibly even subconscious, acknowledgements of the present anomaly!^[21]

5.20 It remains to be seen whether a separate cause of action for intrusion upon seclusion will be recognised at common law in the UK.^[22] The authors of Gurry on Breach of Confidence note that the case for recognising a separate tort of privacy, as opposed to an extended equitable action for disclosure of private information, will be stronger if the courts seek to protect against intrusions into private life as well.^[23]

5.21 A New Zealand court has recognised a tort of intrusion upon seclusion, in a case about a man who installed a recording device in a bathroom and recorded his female flatmate showering. In this case, C v Holland, Whata J said that the ‘critical issue I must determine is whether an invasion of privacy of this type, without publicity or the prospect of publicity, is an actionable tort in New Zealand’.^[24] The court concluded that it was:

the similarity to the Hosking tort [discussed below] is sufficiently proximate to enable an intrusion tort to be seen as a logical extension or adjunct to it. This Court can apply, develop and modify the tort to meet the exigencies of the time.^[25]

5.22 In defining the ingredients of the tort, Whata J drew guidance from the decision of the Ontario Court of Appeal in Jones v Tsige,^[26]which had recognised a tort of intrusion into seclusion. Whata J stated:

I consider that the most appropriate course is to maintain as much consistency as possible with the North American tort given the guidance afforded from existing authority. I also consider that the content of the tort must be consistent with domestic privacy law and principles. On that basis, in order to establish a claim based on the tort of intrusion upon seclusion a plaintiff must show:

(a) An intentional and unauthorised intrusion;

(b) Into seclusion (namely intimate personal activity, space or affairs);

(c) Involving infringement of a reasonable expectation of privacy;

(d) That is highly offensive to a reasonable person.^[27]

5.23 Including intrusion as one of the categories of an actionable invasion of privacy in the new statutory action would remedy one of the key deficiencies in the Australian protection of privacy law identified in Chapter 3. It would enable people to take steps to prevent unjustifiable conduct or obtain some redress where they have been the target of deliberate and unjustifiable intrusions but where, often for historical or technical reasons, the circumstances do not fall within the protection of existing tort and other laws.

Misuse or disclosure of private information

5.24 The second type of invasion of privacy that the ALRC proposes should be covered by the new privacy tort is misuse or disclosure of private information about the plaintiff. It will be neither surprising nor contentious that a cause of action for invasion of privacy will in part concern the disclosure of private information. Lord Hoffmann has identified ‘the right to control the dissemination of information about one’s private life’ as central to a person’s privacy and autonomy.^[28]

5.25 This is a widely recognised type of invasion of privacy, already actionable in the UK, the US, New Zealand, Canada and elsewhere. Most cases involving private information are concerned with unauthorised disclosure.

5.26 The elements of the US tort, set out in the Restatement of the Law Second, Torts, are that publicity is given to a matter concerning the private life of another, and ‘the matter publicized is of a kind that (a) would be highly offensive to a reasonable person, and (b) is not of legitimate concern to the public’.^[29] Publicity, the commentary to the Restatement says, ‘means that the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge’.^[30]

5.27 The disclosure of private information is now also a settled basis for action in the UK. The new or extended cause of action has developed out of the equitable cause of action for breach of confidence, as formulated in Campbell v MGN Ltd, since the enactment of the Human Rights Act 1998 (UK), which incorporates elements of the European Convention on Human Rights (ECHR).^[31] Article 8 of the ECHR provides, in part, that ‘everyone has the right to respect for his private and family life, his home and his correspondence’. Although Article 8 is not confined to private information, the focus of the UK action on disclosure of private information may be partly attributed to its roots in the equitable doctrine of breach of confidence, which protects confidential information.

5.28 The New Zealand courts have recognised a new tort of invasion of privacy by giving publicity to private facts. Gault P and Blanchard J stated in Hosking v Runting:

The elements of the tort as it relates to publicising private information set down by Nicholson J in P v D provide a starting point, and are a logical development of the attributes identified in the United States jurisprudence and adverted to in judgments in the British cases. In this jurisdiction it can be said that there are two fundamental requirements for a successful claim for interference with privacy:

1. The existence of facts in respect of which there is a reasonable expectation of privacy; and

2. Publicity given to those private facts that would be considered highly offensive to an objective reasonable person.^[32]

Whether true or not

5.29 The ALRC proposes that the new Australian tort refer to private ‘information’, rather than ‘facts’. The use of the word ‘fact’ in this statutory tort may imply that the relevant private information must be true, for it to be the subject of the cause of action. The ALRC considers that a person’s privacy can be invaded by the disclosure of untrue information, if it would be an invasion of privacy if the information were true.

5.30 This is consistent with the Privacy Act 1988 (Cth), in which personal information is defined in section 6 to include information or an opinion ‘whether true or not’.^[33] It is also the position in UK law, and is supported by the ALRC. Former judge of the UK High Court, David Eady has written that

a claimant is not now expected to go through an article about (say) his or her sex life, or state of health, in order to reveal that some aspects are true and others false. That would defeat the object of the exercise and involve even greater intrusion. Any speculation or factual assertions on private matters, whether true or false, can give rise to a cause of action.^[34]

5.31 This should be made clear in the new Act by adding the words ‘whether true or not’ after ‘misuse or disclosure of private information about the plaintiff’, as proposed above.

5.32 For the plaintiff to have an action, the untrue information must of course also be matters about which the plaintiff has a reasonable expectation of privacy and, as proposed below, the misuse or disclosure must be serious. This is not a proposal for an action for the publication of untrue information.

Misuse or disclosure

5.33 Daniel Solove has argued that privacy ‘involves more than avoiding disclosure; it also involves the individual’s ability to ensure that personal information is used for the purposes she desires’.^[35]

5.34 Disclosure of personal information is perhaps the most common type of misuse of personal information that will invade a person’s privacy. Wacks writes that the ‘tort of misuse of private information obviously requires evidence of misuse which, in practice, signifies publication of such information’.^[36]

5.35 It is important to note that many invasions of privacy that seem to involve misuse, but not publication, of private information, may better be considered intrusions into private affairs. For example, an employee of a company who, without authorisation, accesses private information of a customer may have intruded into the private affairs of that customer. Such an intrusion would be covered by the first category of invasion proposed by the ALRC. Nevertheless, the ALRC considers that it is reasonable not to confine this second type of invasion to disclosure as some other type of misuse of private information may invade a person’s privacy.

Public disclosure

5.36 The ALRC proposes that a disclosure of private information need not be public, in the sense of wide publicity, to satisfy this element of the cause of action. The fact that the disclosure of personal information was to only one other person should not, in some circumstances, prevent the conduct being held to be actionable, if the circumstances are adjudged to be serious.

5.37 The US tort, on the other hand, is confined to public disclosures. The Restatement of the Law Second, Torts, states that publicity means ‘the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge’.^[37]

5.38 The New Zealand Court of Appeal seemed also to have in mind public disclosures when discussing the tort, in Hosking v Runting. In that case, Gault P and Blanchard J said: ‘I see no reason why our courts should not develop the action for breach of confidence to protect personal privacy through the public disclosure of private information where it is warranted’.^[38]

5.39 However, the ALRC proposes not to confine the action to public disclosures. The fact that a disclosure of personal information was not public may make it more difficult for a plaintiff to satisfy other elements of the action. For example, it may suggest the invasion of privacy was less serious than it might otherwise have been. Also, the plaintiff’s expectation of privacy may not always extend to non-public disclosures of personal information. However, there may be some instances in which a plaintiff does have a reasonable expectation not to have personal information disclosed even within a small circle, and the disclosure will be adjudged serious.^[39]

False light and appropriation

5.40 The ALRC considers that the third and fourth torts identified by Prosser should not be included in a new Australian tort for serious invasion of privacy. Discussing the four US torts, the Australian High Court has said that, in Australia, one or more of the four types of invasion of privacy would often ‘be actionable at general law under recognised causes of action’:

Injurious falsehood, defamation (particularly in those jurisdictions where, by statute, truth of itself is not a complete defence), confidential information and trade secrets (in particular, as extended to information respecting the personal affairs and private life of the plaintiff, and the activities of eavesdroppers and the like), passing-off (as extended to include false representations of sponsorship or endorsement), the tort of conspiracy, the intentional infliction of harm to the individual based in Wilkinson v Downton and what may be a developing tort of harassment, and the action on the case for nuisance constituted by watching or besetting the plaintiff’s premises, come to mind.^[40]

5.41 The disclosure of private facts and unreasonable intrusion upon seclusion concern the key privacy interests, such as personal dignity and autonomy, whereas the other US torts arguably protect others’ interests. Gummow and Hayne JJ stated in ABC v Lenah Game Meats:

Whilst objection possibly may be taken on non-commercial grounds to the appropriation of the plaintiff’s name or likeness, the plaintiff’s complaint is likely to be that the defendant has taken the steps complained of for a commercial gain, thereby depriving the plaintiff of the opportunity of commercial exploitation of that name or likeness for the benefit of the plaintiff. To place the plaintiff in a false light may be objectionable because it lowers the reputation of the plaintiff or causes financial loss or both.^[41]

5.42 Wacks has written that the ‘false light’ category ‘seems to be both redundant (for almost all such cases might equally have been brought for defamation) and only tenuously related to the protection of the plaintiff against aspects of his or her private life being exposed’.^[42] The ALRC has proposed some protection, if the falsity relates to matters as to which the plaintiff has a reasonable expectation of privacy.

5.43 Professor Michael Tilbury has written that, for the most part, the interests protected by the US torts of appropriation of the plaintiff’s name or likeness and false light, ‘can or ought to be restated as, respectively, the commercial interest (or property) that plaintiffs have in their identity and the interest that plaintiffs have in their reputation’.^[43] However, although privacy may have a wider reach, at the ‘heart of privacy law’, Tilbury writes, are the torts of public disclosure of private facts and intrusion on seclusion.^[44]

5.44 As Gummow and Hayne JJ foreshadowed, there could be some objection taken to appropriation of image or name on non-commercial grounds, thus outside the law of passing off and the like, and this risk has been heightened in the digital era. The ALRC considers that the two categories set out in the proposal should be sufficient to protect the privacy of the individual. Any further reform to the law relating to image rights would need to be considered in the context of Australia’s existing intellectual property law.

Examples of invasions of privacy

5.45 Confining the new tort to these two broad and widely recognised categories of invasion of privacy is preferable to two other options that have been considered. The first option is to provide no statutory guidance on the meaning of invasion of privacy, and to leave this to be developed by the courts. A second option would be to include examples of invasion of privacy.

5.46 The ALRC considers that the new Act should provide as much certainty as possible on what may amount to an invasion of privacy. This will make the scope of the action more predictable, particularly as privacy itself is not defined in the new Act. As discussed above, the ALRC proposes that some certainty be provided by having the new Act describe, in general terms, the two categories of invasion of privacy to which the action would be confined.

5.47 However, another way to provide guidance might be to include in the new Act broad examples of invasions of privacy. This approach would make the cause of action more flexible, but at the cost of certainty. This was the approach favoured by the ALRC in its 2008 report, in which it recommended that the relevant Act contain the following non-exhaustive list of types of invasion that fall within the cause of action:

• there has been an interference with an individual’s home or family life;

• an individual has been subjected to unauthorised surveillance;

• an individual’s correspondence or private written, oral or electronic communication has been interfered with, misused or disclosed; or

• sensitive facts relating to an individual’s private life have been disclosed.^[45]

5.48 A number of stakeholders in the current Inquiry said a non-exhaustive list of examples should be included in the new provision,^[46] stressing that this would provide courts, parties and business with some guidance and certainty.^[47] Some of these stakeholders may prefer the greater certainty that confining the action in the way the ALRC proposes will provide. Some stakeholders said the examples should be general and flexible, so that that the action can ‘evolve with social and technological developments’.^[48]

5.49 Jansz-Richardson said the examples should be ‘relatively general in nature to ensure their ability to translate over time’.^[49] Public Interest Advocacy Centre (PIAC) submitted that examples should be ‘open-ended and inclusive, which would build sufficient flexibility into the proposed cause of action for it to be appropriately adapted to changing social and technological circumstances’.^[50] The Australian Privacy Foundation said ‘the list should be clearly identified as non-exclusive and non-exhaustive, ie courts should be able to deal with serious invasions of privacy that fall outside the list’.^[51]

5.50 Other stakeholders said that the cause of action should not include a list of examples.^[52] Some were concerned the list would narrow the scope of the action, by implying that invasions of privacy not covered by an example would not be actionable.^[53] It was also suggested that the examples in the list might become outdated.^[54] Other stakeholders suggested that examples were unhelpful because privacy was ‘contextual and depends on facts and circumstances’.^[55] The ABC said there needs to be ‘an intense focus on how the various interests at stake are implicated in the particular circumstances of each case’.^[56] SBS submitted that ‘the key for any statutory cause of action is flexibility’:

The more activities or matters that are included to ‘assist’ with the formulation of a breach of privacy action, the more likely it is that these tests will become rigid and inflexible. It is vital that courts consider each case on its facts.^[57]

5.51 Some stakeholders suggested that more specific examples of invasion of privacy might be included in the Act. For example, Electronic Frontiers Australia submitted that there should be examples for data breaches, aggregated collections of data, and ‘posting of photographs, audio-recordings, and video-recordings of personal spaces, activities, and bodies for which consent to post has not been expressly provided by the participant’.^[58]

5.52 However, the ALRC considers that the application of the tort to more specific and particular circumstances is best left to the courts to consider on a case by case basis, but within the confines of the two categories specified. Specific examples may provide additional guidance, but they also carry a greater risk of distracting the court from the consideration of the distinct facts and circumstances of a particular case.

One cause of action, not two

5.53 The ALRC proposes that there be one cause of action covering the two broad types of invasion of privacy. A similar approach, recommended by the Victorian Law Reform Commission (VLRC), would be to enact two separate but ‘overlapping’ causes of action. However, enacting separate causes of action should only be necessary if the elements of each would be substantially different, which the ALRC considers is not the case. Separate actions should therefore not be necessary.

5.54 The VLRC’s reasons for recommending two causes of action largely relate to the widely recognised difficulty of defining privacy:

Legislating to protect these broadly recognised sub-categories of privacy is likely to promote greater clarity about the precise nature of the legal rights and obligations that have been created than by creating a broad civilly enforceable right to privacy.^[59]

5.55 The ALRC has come to a similar conclusion, which is one reason it proposes that the action be confined to two more precisely defined sub-categories of invasion of privacy. The categories proposed by the ALRC are broadly the same as the categories identified by the VLRC.

5.56 Although the ALRC and VLRC approaches are broadly consistent, the ALRC considers it important that there be only one cause of action. The availability of two causes of actions may cause unnecessary overlap and duplication in many cases in which both types of invasion arise. Dr Ian Turnbull submitted that one reason for having only one cause of action is that ‘in most cases intrusion upon seclusion will be followed by misuse of the private information obtained by the intrusion’.^[60]

5.57 The availability of two torts would increase the length and cost of proceedings and risk duplication in monetary damages. There will already be cases where the cause of action may overlap with other causes of action such as trespass or breach of contract or breach of confidence. It would be undesirable to risk inviting further duplication.

5.58 Many stakeholders favoured a single cause of action,^[61] however, often because this was thought to make the action more flexible—that is, open to invasions other than by misuse of personal information or intrusion upon seclusion. Dr Normann Witzleb for example said the action should be formulated broadly, to leave its further development to the courts.^[62] The Australian Privacy Foundation likewise said that introducing two torts may result in some privacy breaches not being covered.^[63] However, the ALRC proposes that the new tort should not be broadly drafted to capture all invasions of privacy, but rather should be confined to the two more precisely defined types of invasion of privacy that are the key mischief that the cause of action is designed to remedy.