03. T Gardner

Full name: Thomas Gardner

Question 1: 
Question 2: 
A cause of action for the invasion of privacy should be particularly interested with the ability of natural persons to control their personal information and not to be disturbed where they have a reasonable expectation to be entitled to seclusion.
Question 3: 
Earlier this year, the NSW ADT determined that CCTV cameras could breach the state’s statutory privacy protections. Parliament and the public generally recognised that the relevant statute had not had the intended effect. The misdrafting of the legislation was due to a misapprehension of how best to protect privacy. Statutory privacy protections should extend only to protect information that has not already been made public. In this case, one’s presence and actions in a public place were already a public affair and should not invoke statutory protection when they are recorded. Similarly, any information that is already public ought to be excepted from the legislation. 
Question 4: 
A tort of misuse of personal information must allow a person to determine how any non-public information about them is used. “Information” includes images, personal details, and correspondence. It should also include very limited protected details of a person’s life and behaviour (such as information about their health or sexual activity). The tort should have remedies to protect the person against acts, but not omissions, that use this information without the consent of the person. “Use” of information should include transmission, publication, collection and storage.
A tort of intrusion upon seclusion should protect people from intrusive acts that preclude them from enjoying seclusion to which they reasonably expect themselves to be entitled to.
Question 5: 
It is improbable that there is significant overlaps between these causes of action. They represent separate protected interests. The notion that they should be combined is predicated on the general and nebulous link of “privacy” between them; if they were combined, they would nonetheless subsist as separate aspects of one tort and this would not solve any overlap. Even if there should be an overlap, this is not a very great problem. Factual scenarios frequently give rise to distinct causes of action and this is not a problem.
Question 6: 
The requirement that a tort of privacy be actionable only if it causes serious offence would be unduly limiting on the efficacy of the tort. The appropriate test is that the plaintiff be able to demonstrate that the breach of privacy has caused harm. More stringent tests would preclude a plaintiff who has been unjustly harmed by an invasion of privacy from accessing justice because the harm was not of an offensive or distressing nature.
Question 7: 
Public interest should be a defence to the tort, with the onus of proof on the defendant.
Question 8: 
There should be no statutory definition of public interest lest the definition reduce the ability of the defence to adapt to unique circumstances.
Question 9: 
It is appropriate that a tort of misuse of personal information be one of strict liability. This is because the improper collection, storage, transmission, or publication of personal information is likely to be intentional or negligent, but fault may be difficult to prove. In particular, the loss of personal information through hacking is likely to involve fault on the part of the person who held the information, but this can be difficult to prove on the balance of probabilities. Even where the person who held personal information was not at fault for its misuse, that person nonetheless assumed responsibility upon storing the information and therefore liability is properly apportioned to that person.
In the absence of strict liability, the fault element should allow the tort to be actioned for negligent misuse of personal information. This negligence need not be gross. The tort must respond to the way in which modern digital information systems unintentionally but negligently misuse personal information.
The tort of intrusion upon seclusion should require an intentional act.
The relevant intent, with regard to both torts, should be the intent to do an act which invades the privacy of the plaintiff rather than the intent to actually invade the privacy of the plaintiff.
In addition, the tort should carry a defence of innocent dissemination. 
Question 10: 
If there is no requirement that an invasion of privacy is offensive or distressing, then the torts should not be actionable per se. However, in relation to a tort of the misuse of personal information, if there is a requirement that the misuse is offensive or distressing, then the tort should be actionable per se. Any apprehension that this would result in a proliferation of claims only reflects the proliferation of privacy breaches in Australia and therefore evidences the need for an effective legal response. In any case, such a proliferation of claims can be mitigated by including a requirement that the act was offensive or distressing (or by incorporating a de minimis exception).

Question 11: 
Due to the fact that the proposed causes of action seek to protect emotional sensibilities, they should also allow the award of damages for emotional distress.
Question 12: 
Although there should be no requirement that a defence to a breach of privacy on the grounds that it was incidental to the exercise of a lawful right was proportionate, the defence should only apply if the incidental breach was be reasonably necessary to exercise that lawful.
Question 13: 
The defence of absolute privilege should apply to the proposed torts. However the defence of qualified privilege should not. By including, as an element of the tort of misuse of personal information, the requirement that the plaintiff demonstrate that the information was not public, the need for the defence of qualified privilege is removed. In particular, this would excuse any publication of public records or records of the proceeds of public bodies. There is no particular need to avoid infringing constitutional rights because these rights would prevail over the tort anyway. Nevertheless, it would be prudent to classify all political information as non-personal information for the purposes of the tort of misuse of personal information.
Question 14: 
The following should also be defences to a tort of misuse of personal information:
(a) the disclosure of information was made for the purpose of rebutting an untruth;
(b) the circumstances justified the conduct as a matter of necessity; and
(c) for online material, that the material has been taken down upon notification.
Due to the fact that it should be an element of the tort that the information was not already public, there would be a sort of defence available anyway if the information was already public.
Question 15: 
Government bodies and all public agencies should be entirely exempt from the tort of misuse of personal information. The tort should be purposed towards allowing a person to control how private companies and individuals use information about them as a matter of right. Government bodies should largely be regulated by interest tests that regulate how information is used in a way that balances public and private interests but without the need to comply with individual conditions.
The defence of innocent dissemination ought to extend so as to mostly protect websites hosting the content of third parties, but such websites should be required to remove material that invades privacy upon request.
There is no other need to confer special exemptions. Most of the potentially exempted stakeholders are sufficiently protected by other defences: journalists are protected by public interest defences, banks by their exercise of statutory duties, emergency services by the defence of necessity, and so forth.
Question 16: 
The proposed causes of action should allow courts to award exemplary damages. A cap on damages is appropriate to avoid any new torts being substantially preferable to other torts actionable on the same facts. Notional licence fees and account of profits are both suitable remedies to be incorporated.
Question 17: 
Although an injunction must be an available remedy, there is no need for any further statutory specification regarding when injunctions are to be issued.
Question 18: 
Aside from monetary remedies and injunctions, there should be statutory provisions for an order for the delivery up, destruction or removal of material. Other remedies are unnecessary. In particular, apologies and declarations are not remedies that, when sought, justify the expense of judicial decision-making.
Question 19: 
It is reasonable that an action for the invasion of privacy persist despite the death of the plaintiff, however the plaintiff’s estate should only be able to recover for pecuniary loss suffered by the plaintiff.
Question 20: 
The Privacy Commissioner should be able to bring an action in respect to the invasion of privacy of individuals only when a single act gives rise to claims for a great many plaintiffs. In addition, when deciding whether to bring such an action, the Privacy Commissioner should have regard for whether the defendant’s acts are a matter of public concern or general welfare beyond the private harm suffered by individuals.
Question 21: 
The same rules regarding limitation periods should apply to a tort of the invasion of privacy as they do to defamation, to avoid either one being used simply due to discrepancies in the limitation period.
Question 22: 
The cause of action should be created in separate Commonwealth legislation.
Question 23: 
Question 24: 
There should be no provision for mandatory alternative dispute resolution as this process unlikely to be effective unless it is voluntarily adopted.
Question 25: 
A determination on a matter from a public body should not preclude a person from bringing a claim for breaches of privacy. To the extent that current bodies have functions that are rendered superfluous by the introduction of privacy torts, those functions should be removed.
Question 26: 
Effective ways to strengthen current laws in this regard include:
            (a) Applying the Privacy Act 1988 (Cth) to all businesses and, to some extent, individuals;
            (b) More substantial options for civil redress under the Privacy Act;
            (c) A tort of harassment, including cyber-harassment; and
            (d) Expanding the tort of private nuisance to allow those without exclusive property rights to use it, including people who are on private land but do not live there.
A tort of harassment could subsume the action on the case for wilful injury insofar as it applies to recognised psychiatric injury rather than physical harm, as well as extending that tort to include emotional distress that does not amount to psychiatric injury. The law surrounding harassment and cyber-harassment ought to be stronger and should not distinguish between instances of harassment on the grounds that some are effected electronically and some are not.
Question 27: 
Question 28: 
A tort of misuse of personal information would impliedly allow individuals to require websites to remove information about them on request, because the storage of information without the consent of the person whom it concerns would constitute a misuse of the information. This constitutes a civil ‘right to be forgotten’. The same principle applies to tracking technology and aerial surveillance of private land.
Prohibiting employer requests for access to social media accounts would be a reasonable and effective addition to current privacy law.
Other comments: