Proposal 6–2 The new Act should provide that, in determining whether a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances, the court may consider, among other things:
(a) the nature of the private information, including whether it relates to intimate or family matters, health or medical matters, or financial matters;
(b) the means used to obtain the private information or to intrude upon seclusion, including the use of any device or technology;
(c) the place where the intrusion occurred;
(d) the purpose of the misuse, disclosure or intrusion;
(e) how the private information was held or communicated, such as in private correspondence or a personal diary;
(f) whether and to what extent the private information was already in the public domain;
(g) the relevant attributes of the plaintiff, including the plaintiff’s age and occupation;
(h) whether the plaintiff consented to the conduct of the defendant; and
(i) the extent to which the plaintiff had manifested a desire not to have his or her privacy invaded.
6.17 The ALRC proposes that this non-exhaustive list of considerations should be set out in the Act. It is designed to assist rather than confine the court, when the court assesses whether the plaintiff had a reasonable expectation of privacy. Not all matters can be listed, but the ALRC has listed some of the more common or important matters. Submissions on what matters should be listed are welcome.
6.18 The NSWLRC recommended the inclusion of a comparable list of matters that would help a court determine whether a person’s privacy has been invaded.
6.19 In Murray v Big Pictures, which concerned photographs taken of a child in the street for commercial publication, the UK Court of Appeal set out a non-exhaustive list of matters a court should consider when determining whether the plaintiff had a reasonable expectation of privacy:
They include the attributes of the claimant, the nature of the activity in which the claimant was engaged, the place at which it was happening, the nature and purpose of the intrusion, the absence of consent and whether it was known or could be inferred, the effect on the claimant and the circumstances in which and the purpose for which the information came into the hands of the publisher.
6.20 Other matters will be relevant in other cases, particularly in cases concerning intrusion upon seclusion. Wacks has suggested that, in an action for intrusion upon seclusion, a court should take into account the following factors when determining whether the claimant had a reasonable expectation of privacy:
(a) the place where the intrusion occurred (for example, whether the claimant is at home, in office premises or in a public place, and whether or not the place is open to public view from a place accessible to the public, or whether or not the conversation is audible to passers-by);
(b) the object and occasion of the intrusion (for example, whether it interferes with the intimate or private life of the claimant); and
(c) the means of intrusion employed and the nature of any device used (for example, whether the intrusion is effected by means of a high-technology sense-enhancing device, or by mere observation or natural hearing).
Nature of the information
6.21 The nature of the information will often suggest whether or not it is private. Information concerning the plaintiff’s intimate or family matters, health or medical matters, and financial matters are all likely to be private.
6.22 Gleeson CJ said in Lenah that certain kinds of information about a person may be easy to identify as private, ‘such as information relating to health, personal relationships, or finances’.
6.23 ‘The nature of the subject matter’ was included in a list of matters the NSWLRC recommended should be considered in determining whether there has been an invasion of privacy.
6.24 The definition of sensitive information in the Privacy Act may also be of assistance to the courts. ‘Sensitive information’ is defined to mean:
(a) information or an opinion about an individual’s:
i) racial or ethnic origin; or
ii) political opinions; or
iii) membership of a political association; or
iv) religious beliefs or affiliations; or
v) philosophical beliefs; or
vi) membership of a professional or trade association; or
vii) membership of a trade union; or
viii) sexual preferences or practices; or
ix) criminal record;
that is also personal information; or
(b) health information about an individual; or
(c) genetic information about an individual that is not otherwise health information.
(d) biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or
(e) biometric templates.
6.25 In the UK, it has been said, the nature of the information itself ‘is plainly of considerable if not prime importance. It may even be decisive in the question of whether the claimant enjoys a reasonable expectation of privacy in respect of it’.
6.26 Intimate matters will often be sexual matters, widely considered to be private. ‘There are numerous general statements from English courts to the effect that sexual behaviour is an aspect of private life.’
6.27 However, intimate and family matters can extend beyond sexual matters. Butler submitted that people are ‘entitled to expect privacy for anything non-criminal taking place in the home environment, including any conversations or disagreements occurring therein’. Butler also notes that, ‘[e]ven where the plaintiff has courted publicity, it would normally be expected that his or her family would nevertheless be entitled to their privacy, especially when there are children of a vulnerable age who are involved’.
6.28 Health, medical and financial information is also widely recognised as private.
6.29 The means used to obtain private information or to intrude upon seclusion will sometimes be relevant to whether or not there is a reasonable expectation of privacy. For example, the fact that the defendant hacked into the plaintiff’s personal computer to take personal information, or used a long distance camera lens to peer into the plaintiff’s home, may both suggest the plaintiff’s privacy has been invaded (regardless of what personal information or photograph is taken). Butler submitted that ‘[t]he fact that the information could only be obtained through surreptitious means should normally be an indication that in the circumstances there was a high expectation of privacy’.
6.30 Similarly, it may not be reasonable to expect privacy when standing naked at one’s front door, in full view of the street. It may however be reasonable to expect privacy in one’s bathroom even if a long distance camera lens could, in theory, take a photo through an open window.
Place of intrusion
6.31 The physical place in which a person’s seclusion is intruded upon may have a bearing on whether they had a reasonable expectation of privacy in those circumstances.
6.32 A person will have a greater expectation of privacy in the home than in a public place. More privacy may be expected in a restaurant than when on the street. Privacy may of course be expected in public places in some circumstances, but a person would generally have a lower expectation of privacy when in public.
Purpose of intrusion
6.33 An intrusion into a person’s seclusion for a particular purpose may invade that person’s privacy, while the same intrusion for a different purpose would not. For example, a patient’s reasonable expectation of privacy has not been invaded when a nurse enters the patient’s hospital room to take his or her temperature, but may be invaded by a journalist entering the room to take photos of the patient for publication in a newspaper.
6.34 In Murray v Big Pictures, the UK Court of Appeal included, in a list of matters a court should consider when determining whether the plaintiff had a reasonable expectation of privacy, ‘the nature and purpose of the intrusion’ and ‘the circumstances in which and the purpose for which the information came into the hands of the publisher’. In that case, the court held that pictures had been
taken deliberately, in secret and with a view to their subsequent publication. They were taken for the purpose of publication for profit, no doubt in the knowledge that the parents would have objected to them.
6.35 Tugendhat and Christie’s The Law of Privacy and the Media states, concerning the UK law, that this aspect of the law is ‘relatively undeveloped’ and it may be ‘open to debate how the “purpose of the intrusion” is to be determined (including whether the “purpose” is objective or subjective), and what weight should be accorded to what purposes’.
How information was held or communicated
6.36 This matter relates to the form in which information is held, stored or communicated. Information held in some forms—such as a personal diary—may more clearly suggest that there is a reasonable expectation of privacy with respect to the information than to the same information held in another form.
6.37 The authors of Tugendhat and Christie’s The Law of Privacy and the Media have written that in some cases, ‘the principal focus of the court has been on the repository of the information as one likely to contain confidential or private information’:
Personal diaries, private correspondence, together with similarly private written communications, and conversations on the telephone have all been recognized as likely repositories of such information. More recently it has been held that information stored on a personal computer is prima facie confidential.
6.38 New digital technologies will raise other questions. Many emails are treated like private correspondence, but not all information sent by email will be private in nature.
6.39 That a password or some other form of personal identification is required to gain access to a digital location containing personal information should, in the ALRC’s view, strongly suggests the information is likely to be subject to a reasonable expectation of privacy.
6.40 Similar reasoning may apply to intrusions upon seclusion. A locked solid door suggests that those in the room behind the door expect complete privacy, but a glass door involves different expectations.
6.41 Whether and to what extent the information was in the public domain should be considered when determining if the plaintiff has a reasonable expectation of privacy. In the context of confidential information, the public domain has been said to mean ‘no more than that the information in question is so generally accessible that, in all the circumstances, it cannot be regarded as confidential’. It will be seen from this definition that there may be no clear line between what is in the public domain and what is not.
6.42 Private information differs from confidential information in that the former is often private because of its nature, whereas the latter is often confidential only because of the obligation under which it was imparted. Private information will not automatically cease to be private once it is in the public domain. A person’s medical records, for example, do not cease to be private when someone wrongly publishes them on a website. Not only will the original publication to the internet be an invasion of privacy, but other subsequent uses of the records may also, in some cases, amount to an invasion of privacy. Eady J said in McKennitt v Ash:
there are grounds for supposing that the protection of the law will not be withdrawn unless and until it is clear that a stage has been reached where there is no longer anything left to be protected. For example, it does not necessarily follow that because personal information has been revealed impermissibly to one set of newspapers, or to readers within one jurisdiction, that there can be no further intrusion upon a claimant’s privacy by further revelations. Fresh revelations to different groups of people can still cause distress and damage to an individual’s emotional or mental well-being.
6.43 However, an expectation of privacy will usually decrease, the more widely a piece of information has been published by someone.
Attributes of the plaintiff
6.44 Some attributes of a plaintiff, such as age, may affect whether the person has a reasonable expectation of privacy. A young person may have an expectation of privacy in some circumstances where an older person does not. Butler submitted that where ‘the plaintiff is a child of vulnerable age there would normally be a high expectation that he or she is entitled to a measure of privacy’.
6.45 The occupation of the plaintiff may also be relevant, particularly if the plaintiff is a ‘public figure’. Persons in some occupations necessarily or traditionally invite or receive considerable attention from the public. A professional sportsperson or a politician, for example, cannot reasonably expect the same level of privacy as other members of the public, although they can reasonably expect some privacy.
6.46 ‘The extent to which the individual has a public profile’ was included in a list of matters the NSWLRC recommended should be considered in determining whether there has been an invasion of privacy. People who are reluctantly or involuntarily put in the public spotlight, as for example, the victim of a crime or the family of a victim of crime, are a different category to those who seek the limelight.
6.47 The NSWLRC also included in this list the ‘extent to which the individual is or was in a position of vulnerability’. Being in a position of vulnerability may not always be an attribute of the plaintiff, but the ALRC agrees that vulnerability may not only make an invasion of privacy more offensive and harmful, but it will sometimes suggest information is private, or that a person should not be intruded upon. A patient in a hospital would seem to have a reasonable expectation of privacy, for instance.
6.48 The culture and background of a plaintiff may also be relevant to whether he or she has a reasonable expectation of privacy. Some information may be considered to be more private in some cultures than in others. These expectations may be well-known in the community.
6.49 For example, the cultural expectations of Aboriginal and Torres Strait Islander peoples and other cultural or ethnic groups may also be relevant in some cases to the reasonable expectation of privacy in the circumstances. The Arts Law Centre of Australia stressed the importance of considering the ‘confidential or culturally sensitive nature of cultural knowledge, stories, images of indigenous Australians’.
6.50 A plaintiff cannot generally expect privacy where they have freely consented to the conduct that compromises their privacy. Whether or not a plaintiff consented to particular conduct is a matter of fact. Consent may be express or implied. Consent may also be revoked expressly or impliedly.
6.51 Consent is a defence to many torts, including battery and trespass to land, but for a cause of action for serious invasion of privacy, the ALRC considers that consent should be one of a number of factors relevant to the question of whether the plaintiff had a reasonable expectation of privacy.
6.52 There are degrees of consent. A person may consent to disclosing personal information to a small group of people, but not to a large group. Consent may vary in quality and extent: some have questioned whether clicking ‘I agree’ to a 40,000-word term of a contract is, in fact, consent and there are calls for the whole issue of consent in the context of online services to be reviewed. This is part of a much larger debate which is best discussed in the overall context of consumer protection.
6.53 For the purposes of the new tort, the ALRC considers that the extent and quality of any consent given by the plaintiff will be relevant matters to consider when determining whether the plaintiff had a reasonable expectation of privacy in the circumstances.
Manifested desire for privacy
6.54 The extent to which the plaintiff had manifested a desire not to have his or her privacy invaded should also be a relevant consideration. The author of a document marked ‘private’ obviously thereby manifests some desire for the document to be treated as private. Similarly, a person who asks to sit in a private room of a restaurant may more reasonably expect privacy than a person who does not.
6.55 Conversely, a court might ask whether the plaintiff had ‘courted publicity on the relevant occasion’. A person who has courted publicity cannot expect the same level of privacy as people who have not.
6.56 However, care must be taken here, because it does not follow that such persons forego any right to privacy, just as a person does not, by manifesting a desire for privacy, automatically become entitled to it.