Submission to the ALRC Inquiry into "Serious Invasions of Privacy in the Digital Era" (IP43)
Principles guiding reform (Questions 1, 2, 3)
Privacy Law Review
1.	This submission is primarily concerned with misuse of private information. The phrases “invasions of privacy” and “breach of privacy have been used interchangeably.
2.	Privacy law, in my opinion, has not achieved what it was intended to. It has made life difficult for administrators and those with genuine reasons to access and use private information whilst others have simply ignored the law.
3.	That has been allowed primarily because of its limited enforcement provisions and reliance on statutory authorities (Privacy Commissioners) subject to resourcing constraints.
4.	The relevant Federal and State Acts have imposed considerable regulatory burdens on private as well as government organizations not only in establishing privacy policies but also in the ongoing need to reinforce those policies. 
5.	For examples, where a child in a school with a nut allergy or one who has not been immunized, where the parents do not consent to the general release of the information (private personal health information), thus creating a situation where only a few staff have been informed under particular exemptions, the specific child in both instance is at risk and others may be considered at risk in the second case. There is no net benefit to the individuals, or to the public good, in protecting that information from general disclosure. Consequently the law which, as I read it, does so, is bad law. If it allows an action against a person who disclosed that information in good faith, it would be even worse law. In those circumstances it would also be quite wrong to require the discloser to endure a trial and then have to rely on a defence such as the public interest defence, with the onus on them.
6.	I note that such information, being both private health information and information about children, is subject to high level protection under current privacy laws and its disclosure would, I assume,  be caught under any definition as a "serious breach of privacy".
7.	As with all law reform it should be the aim to enhance individual rights, subject to an overriding requirement of benefit to society, whilst not creating a regime that is overly and unnecessarily burdensome to organizations and businesses. The aim should not be simply to create another lucrative source of income for lawyers by leaving ambiguities and contentious issues unanswered. 
Protection for Some Administrators
8.	Individuals, panels, boards and tribunals involved in administrative reviews, have had their job made more difficult by privacy laws. First, witnesses and those providing information can be reluctant to do so freely for fear of falling foul of privacy policies and law. That will only be worse with the possibility of being sued. Whilst some act in the interests of privacy for the individuals concerned, others use current laws, and will even more use the threat of the proposed cause of action, to avoid providing valuable evidence and to protect the guilty. Clear protections should be put in place for those administrative reviews.

Invasion of Privacy (Questions 4, 5, 6)

9.	So far as "private information" is concerned, there should be an extensive definition of what that term includes. Breach of privacy, in the context of private information is the unauthorized disclosure or use of that information without a valid reason.

10.	No benefit flows from separate causes of action for intrusion or misuse of private information. One reason is that, as I see it, in most cases intrusion upon seclusion will be followed by misuse of the private information obtained by the intrusion. Consequently, most damage will flow from the misuse.

11.	I do not favor strict liability but where the information used falls clearly within a proper, clear and as complete as possible definition of "private information" then a reasonable person can be presumed to know it. Who is meant to be reasonable, the information owner or the user defendant?

Privacy and public interest (Questions 7, 8)
The Public Interest Exception
12.	Public Interest must be carefully defined; both inclusively and exclusively. Judicial opinion, particularly considering the public interest override in Freedom of Information law, is that it does not mean that members of the public are interested but rather that government administration would have an interest in conveying the information to the public at large. 
13.	For example, the fact that a truck accident has closed a highway is of immediate public interest but the facts that identify the driver and inform that he had a heart condition and recently filed for bankruptcy following his divorce, whether or not of interest to some members of the public do not reasonably constitute matters of immediate public interest. They should not be published without express consent. At a later time however, after an investigation that might change. 

Fault (Question 9) 

14.	I do not favor negligence in this area and have suggested a defence of genuine mistake or error. Computer operators make mistakes and electronic data security is wide open to misuse and inadvertence.

Damage (Questions 10, 11) 

15.	Proof of damage should not be a specific requirement. That is because the effect on different individuals of the same type of breach may be quite different.  

16.	To make the action dependent on liquidated damage, quantifiable damage or the presence of damage suggests that the law treats privacy first as a commodity such as intellectual property or a chose in action, which it is not, and secondly that the law values the privacy of some individuals more than others, which is not appropriate. 

17.	Remedies might include nominal damages and published apologies, for examples.

18.	Clearly the most common initial reaction of a person to a serious invasion of their privacy is one akin to violation, intrusion into their space or affairs, a breach of secrecy or confidence and a loss of control over their own lives and even loss of independence. The severity will depend on the circumstances and the individual. Whilst some may stimulate existing recognized mental conditions such as anxiety or paranoia, or even trigger them, most will not. It follows that any level of mental distress must be considered damage for this action.

Defences and exemptions (Questions 14, 15)
19.	There are two key defences to breach of privacy. The first is consent and the second is disclosure in the public interest which was dealt with under Questions 7, 8. 
Consent
20.	This could be easily dealt with. The onus of proving consent should be on the defendant. Requirements for establishing consent, particularly the need for it to be fully informed, are well established and litigated in areas such as medical treatment and research. 
21.	"Informed" in the present context would mean that just what information is to be released and how and by whom it will be used would need to be conveyed to the person whose information it is. A requirement that it be express, preferably in writing, is needed in any new legislation to remove the inherent uncertainty associated with implied consent. Standard consent forms could be annexed to the regulations under any proposed new or amended Privacy Act. 
Abuses of the Requirement for Consent
22.	Abuses of the concept of consent are prevalent under the current regime. Those abuses need to be avoided under the more serious consequences of the proposed legislative changes.
23.	That can be done for the most part by requiring express consent and providing proforma consent forms in the regulations. Those forms should require :(1) full identification of the information to be used or provided; (2) identification and details of the recipient or end user; (3) how the information will be used; (4) any conditions placed on its use; and (5) possible future uses covered by the consent. 

24.	Attaching the consent form to the released information then should require subsequent recipients of the private information to seek consent for other, undisclosed uses. Such standard form consent forms are quickly and readily obtainable by email or SMS, for examples. There are no excuses for not seeking express consent.

25.	Express consent is necessary because of the abuses that appear to flow from the ambiguities and deliberate, sneakily obtained implied consent. 

26.	For examples, a telemarketer asks, "can I speak to the mortgage holder"? Any response such as, "that's me", "my dad is at work", "she is out at the moment", convey significant private information but do not, and should not, allow the caller to record that information for future marketing use. There is no implied consent to its use.

27.	A request by a marketer, "can I see your power bill to see if you are getting all available discounts", is deceptive because it is really an attempt to find out private financial information about individuals in the household generally for the purpose of marketing another power supplier. Even where the bill is provided there is no implied consent to the use of the information by the marketer not least because of the deception involved. There is certainly no consent to the ongoing, future use of that information.

28.	No one can properly consent to something they do not understand or which is collateral to a specific request.

Abuse of the Privacy Exemptions in Freedom of Information Legislation 
29.	The ALRC should address the misuse of claims by government organizations that information legitimately requested under Freedom of Information (FOI) Acts is exempted from disclosure because it contains private personal information. 
30.	That excuse, for example, was used under both the Federal and Victorian FOI Acts, to avoid release of grant applications when a review of scientific fraud in Australian universities was being undertaken in, it was argued, the public interest.
31.	Another example was its use to prevent identifying properties (businesses) provided ex Garcia payments from a Victorian government department for weed control. 
32.	In my view, any new or amending privacy legislation must clarify the distinction between personal and business information. The personal details of a university employee who has applied for a government grant through that university should not properly be regarded as private personal information. Equally, the details of a farming business, the subject of a government grant, should not be exempted as private personal information just because the farmer lives on the property. 
The Media and Freedom of Speech Exemptions and Exceptions 
33.	It is the exceptions, particularly the news reporting and freedom of speech (so characterized) exceptions that, in my opinion, have significantly reduced the credibility and value of current privacy laws. How can it be justified to argue that privacy is a fundamental right of an individual except if a journalist wants to include it in a news story; even when it adds nothing to the story and is included just to give the story more public appeal? For the most part media organizations are commercial entities which means their motives are commercial rather than altruistic or for the better public good.
34.	The questions of just what the public has a right to know and what are the limits for freedom of the press as against the rights of the individual has to be addressed in this inquiry; that is the issue of competing public interests. There are limits on freedom of the press such as where a breach of confidence exists, a publication suppression court order is in place, the material is defamatory or the media outlet simply has a bias against it.
35.	Given those limits exist and the abuses of the exceptions under current privacy laws, I submit that any new privacy law should delete or severely modify the exceptions. 
36.	The issue for the ALRC is not only to define "serious breach of privacy" but also to establish criteria for determining when disclosure of private information is necessary for a news story, assessing when a news story is newsworthy and its publication is actually in the public interest. The advent of the digital media, the 24 hour news cycle and increasing prevalence of opinion pieces that are not simply reporting the news, make this a key issue for this inquiry.
37.	To allow a blanket exception to that extent and of that nature to an industry which has proven itself largely unregulated and incapable of interpreting such exceptions, policies, confidentiality, suppression orders, defamations and biases, is concerning to the legally trained and seriously limits the value of existing privacy laws. 
38.	If there is any doubt about the lack of honestly or integrity of the present day media and its flagrant, even contemptuous, disregard for the law and rights of individuals the ALRC is referred to the findings of the very recent Leverson Inquiry in the United Kingdom and the Finkelstein Inquiry among others. 
39.	Intrusion by the media has been interference in family life and unauthorized surveillance, for examples, which are both stated specific areas of concern for this inquiry.
40.	I refer to the discussion of the concept of public interest elsewhere in this submission (Questions 7, 8).
41.	It is impossible to justify some breaches of privacy by the media. For example, the collar bomb case in Sydney. The story was clearly worth reporting but for the media to camp outside the residence of the victim, a teenage girl, and harass her and her family for some days and weeks after the event was entirely unacceptable. That occurred despite repeated requests that the media respect their privacy.
42.	Equally the custody case involving four girls in Queensland where the media harassed them and the father in Australia, at the airport and in Italy, despite court orders. It is unacceptable and, in my view, goes beyond the concept of freedom of the press. Although that was a custody matter and media attention may have been sought by one side, failure of the media to fully respect the privacy of the girls should properly be condemned.
43.	I have raised previously in the same vein the issue of media packs outside courts harassing victim's and accused's families who are not parties to the issue before the court. 
44.	A specific, express request for privacy must be provided for in the proposed legislation, as both a refusal of consent and, where ignored, a flagrant disregard of the legitimate rights of the person, and the law. A failure to heed such a request should be held against a defendant.
45.	To that end the onus should be on the defendant to justify in each specific case, why it was necessary to breach the privacy of those photographed or identified and why the private information published was necessary in the genuine public interest. 
46.	I note with interest that journalists are able to publish information about a person that they say was obtained from a third person, the source, whose identity must, apparently, be kept secret. Clearly that source has breached the privacy of the first person.
47.	Any new legislation would be seriously flawed if a source, most likely a government or organization employee or official, who gets well paid for the dishonestly obtained or disclosed information, can breach privacy with impunity. The point is that the journalist involved knows the identity of the source. Do journalists' sources become a new exemption? Are they part of the media exemption? How do courts deal with preliminary discovery applications to identified sources as possible defendants? I wish the ALRC luck with that one.
48.	In my view journalists must be required to get consent to the release of private information. That does not prevent them reporting the story without that information.
49.	Although media regulation is a difficult area it is also contentious and topical. It should not be the role of the ALRC or any other law reform body, to shirk the difficult issues and recommend bad laws that ultimately only create disputes needing resolution by the courts. The best statutes do not need interpreting.
A Defence of Genuine Mistake or Error
50.	Upon proof, a genuine mistake should be a defence to breach of privacy. The onus should be on the defendant.
51.	By way of example, the Office of the Gene Technology Regulator (OGTR) released the email addresses of individuals and organizations on its database to all those on the database via the CC list in its emails. It should have shown "undisclosed recipient". The information identified persons opposed to gene technology to large companies engaged in the technology. Because there have been conflicts in the debate it could be argued that it was a serious breach with possible consequences to those affected. The Privacy Commissioner, wrongly in my view in that case, accepted that it was inadvertence rather than deliberate.
52.	Inadvertence and mistake can occur in any office and hence I favor a defence of genuine mistake upon clear evidence; onus on the defendant.

Monetary remedies (Question 16) 

Account of Profits and Exemplary Damages

53.	I like the concept of account of profits where the breach of privacy is done for a commercial gain; especially by a large commercial entity. To work best though it needs to be a quick remedy. (See discussion on media exemption following).

54.	Exemplary damages must be available because malicious breach of privacy is common; in broken relationships for examples.

Appropriate Remedy for Breach of Privacy by the Media
55.	The appropriate remedy for a serious breach of privacy by the media, a commercial decision, is a scale of compensation based on an account of profits.
56.	The best way to deal with it is for an independent body to assess any claim of breach which is not disputed or cannot be realistically disputed, with statutory powers to assess and order the compensation either from the media defendant or a fund established for that purpose. It would be timely and effective and should obviously be appealable.
57.	This is not an attack on freedom of the press or freedom of expression but rather a requirement that private information unnecessary to the important news in the story be protected from unwanted and unwarranted disclosure. If suppression orders can be available for the private information of children and vulnerable persons and the relevant story still told then why not a general suppression rule for private information that can be overruled by consent or unambiguous public interest with onus on the defendant. 

Who may bring a cause of action (Question 19)

Family Members of the Deceased

58.	A serious breach of privacy must survive for the estate. It could affect the client base of an ongoing business. It will certainly affect the family members and other beneficiaries under a will.

59.	Personally, I would allow for close relatives of a deceased person whose privacy was breached after death, to bring an action for their own distress or loss flowing from the breach.

Location and forum (Questions 22, 23, 24)

Avoiding Lawyers
60.	It would seem that most or all serious breaches of privacy such as publication of private personal information, are readily established and the only issues for adjudication would be the nature of the information, the available defences and appropriate remedies. Consequently any new legislation should attempt to define entirely what is included as private information and also what is excluded. That is a reasonable expectation when administrators and individuals are expected to produce policies and apply them to their organizations. That should have been a priority when current legislation was enacted. It follows from such definitions that what constitutes a "serious breach of privacy", in regard to information disclosure and use, is thereby defined.

Other legal remedies to prevent and redress serious invasions of privacy (Questions 26, 27, 28) 

Possible Use of Existing Laws

61.	Breach of copyright is not a good model for breach of privacy. Private information is quite different from works the subject of breach of copyright. That is because creators want their works to be published and used. The issues are who gets the recognition and money generated.

62.	Defamation law is also, in my opinion, not a good model for breach of privacy. That is primarily because the private information the subject of the breach does not need to have the potential to bring them into disrepute or damage their reputation.

63.	For example, use of a photograph of a person sun baking in their own backyard should be actionable both for intrusion and for use of the information. The victim will likely feel violated and upset. The photograph may, however, be a masterpiece, be aesthetically superb and show the victim in a better light than does nature.

64.	Harassment laws do have similarities, obviously where intrusion is involved and particularly, as far as the feelings of the victim are concerned, where private information is misused.

65.	In my opinion, however, probably the best way to enact a serious breach of privacy law is to use the existing common law (equitable) action for breach of confidence. The new action is covered by enacting provisions, probably in existing Privacy Acts, that provide first that all private information, as defined, of an individual, obtained, provided to or used by an organization is presumed to be confidential information. Secondly, unauthorized use and misuse of private information is a breach of confidence. Thirdly, misuse of private information is deemed to damage the individual concerned; by causing mental anguish or distress, for examples.

6 November 2013

Ian Turnbull.

 	Dr Ian F Turnbull
Barrister-at-Law