In our Featured Insight, Data Wars - Part I: Tortious invasions of privacy, we explored the role that a statutory tort of privacy would play in Australian privacy law. At the time, the Attorney-General’s Department had recommended the introduction of both an actionable right to privacy, and a direct right of action for breaches of the Australian Privacy Principles.
Now, with a substantially pared back Privacy and Other Legislation Amendment Bill 2024 (the Bill) before Parliament, only the statutory tort remains. As remarked upon in our Insight following introduction of the Bill, we now expect this tort will receive more serious consideration from plaintiffs (and litigation funders) seeking access to courts and compensation.
The Bill establishes a cause of action in tort for serious invasions of privacy by inserting a new Schedule to the Privacy Act 1988 (Cth) (the Privacy Act). As anticipated, the model of the statutory tort set out in this Bill is “informed by”, and almost totally adopts, recommendations from the ALRC’s 2014 report Serious Invasions of Privacy in the Digital Era (ALRC Report 123), but is to be interpreted and understood separately from statutory concepts in the Privacy Act and its Australian Privacy Principles (APPs).
In this Insight, we explore some of the key features of the Bill, as informed by ALRC Report 123.
An “invasion” of privacy
An individual will have a cause of action for serious privacy invasions where there has been either:
- an intrusion upon the individual’s seclusion, or
- misuse of their information.
|
INTRUSION UPON SECLUSION?
|
MISUSE OF INFORMATION?
|
Example
uses 2
|
|
Intruding upon the seclusion of an individual includes (but is not limited to) physical intrusions as well as watching, listening to or recording an individual’s private activities or affairs. Seclusion in the digital economy is likely to become a contested issue. The concept includes situations where no further action is taken beyond the physical intrusion. For example, an intrusion upon seclusion could occur where a person spies on the plaintiff in their home. It is not required that any information be shared about the plaintiff for them to be able to establish an intrusion upon their seclusion. |
Misusing information is intended to encompass a wide range of activities, including (but not limited to) invasions of privacy by collecting, using and disclosing information. Maliciously releasing an individual’s information online without their consent (doxxing) may amount to a misuse of information. Storing, interfering with or modifying information could also be ways in which information may be misused. |
|
A reasonable expectation of privacy
Once an invasion of privacy is established, the statutory cause of action is actionable only where a person in the position of the plaintiff would have had a reasonable expectation of privacy in all the circumstances.
When examining all the circumstances, the Bill sets out a non-exhaustive list of matters that may be relevant to whether a reasonable expectation of privacy exists.
This test is intended to be flexible, to reflect the fact that community expectations of privacy may change over time.
As we explored in Data Wars, consumers have developed differentiated and somewhat nuanced views of privacy. As a form of objective test, the threshold in the Bill is whether “a person in the position of the plaintiff” would have a reasonable expectation of privacy in all the circumstances.
"We've grown accustomed to platforms using our data to tailor experiences, and our smartphones are practically extensions of ourselves. Smart home devices, while convenient, might raise some eyebrows regarding data collection, depending on the level of transparency provided. Similarly, some consumers may be concerned at the prospect of other appliances, not typically associated with communications technology, such as connected cars or refrigerators, collecting their data without clear notice being provided. The subjective dimension to privacy creates a complex landscape for businesses to navigate, with transparency issues and aligning on consumer expectations becoming ever more important."
The subjective expectations of plaintiffs may not be relevant, but what the community and courts find reasonable will evolve through litigation.
Is it serious?
In our Insight, Data Wars - Part I: Tortious invasions of privacy, we explored how serious an invasion needs to be. The Bill provides that, without limiting the matters that the court may consider in determining whether the invasion of privacy was serious, the court may consider the following:
- the degree of any offence, distress or harm to dignity that the invasion of privacy was likely to cause to a person of ordinary sensibilities in the position of the plaintiff
- whether the defendant knew or ought to have known that the invasion of privacy was likely to offend, distress or harm the dignity of the plaintiff
- if the invasion of privacy was intentional—whether the defendant was motivated by malice.
"Torts are complex causes of action that evolve and shift over time. As such, this threshold requirement of a “serious” invasion of privacy is likely to change with evolving community expectations — which often do not reflect the operational, technical or commercial realities of handling data."
Intentional or reckless invasions of privacy
As expected, the Bill significantly confines the scope of the tort by restricting it to intentional or reckless invasions of privacy, and excluding negligent ones. For many in the data ecosystem, this will be of some relief, as it means that the tort is less likely to extend to situations where an entity is the victim of a data breach or cyber intrusion by a third party. Greater danger will arise where an organisation is actively engaged in an activity that could be considered to be privacy intrusive – e.g. some type of monitoring or surveillance activity, or use of personal information for commercial purposes without appropriate transparency or permission.
A defendant’s “intention” to invade privacy may be imputed to it from objective facts (a plaintiff doesn’t need to establish that the defendant subjectively intended to invade privacy), and companies may be vicariously liable for the actions of their employees or agents. Bad actors within organisations will therefore be a risk, particularly where employees intentionally misuse information relating to plaintiffs. However, an intention to invade a person’s privacy must be distinguished from an intention to do an act that has the unintended consequence of invading a person’s privacy.[1] It is not sufficient that the defendant intended to do an act that has the consequence of invading a person’s privacy — the Explanatory Memorandum states that the intention must relate to the invasion of the plaintiff’s privacy by intrusion upon seclusion or misuse of information.
Recklessness is defined by the Bill as having the same meaning as in the Criminal Code Act 1995 (Cth). There, a person is reckless if he or she is aware of a substantial risk that a circumstance exists, or a result will occur, and, having regard to all the circumstances, it is unjustifiable to take that risk.[2] In ALRC Report 123, it was argued that recklessness may be described as reckless indifference to a result. There, the ALRC cited a case involving workplace bullying and harassment, where Spigelman CJ said:
"Clearly something substantially more certain [than reasonable foreseeability] is required for the intentional tort … However, a test of reckless indifference to a result will, in this context, satisfy the requirement of intention.[3]"
This might occur if a company knowingly disregards security warnings and fails to take necessary steps to protect customer data, even though they are aware of the risks. We expect this is something that plaintiffs will seek to test – the key will be for organisations to take privacy risks seriously and not to ignore warning signs.
Defences and Exemptions
The Bill sets out a number of proposed defences, and an express acknowledgment of the applicability of the general law of torts — inviting consideration of concepts such as contributory negligence (more on that below).
ALRC Report 123, [5.85].
Criminal Code (Cth), s 5.4(1), (2).
Nationwide News Pty Ltd v Naidu (2007) 71 NSWLR 417, [76]–[80].
|
Required or authorised by law
Conduct by any individual, body or organisation that was required or authorised by an Australian law or a court/tribunal order will not amount to a serious invasion of privacy. Examples of defensible conduct in the Explanatory Memorandum include where legislation authorises the handling of information about a person, such as in workplace health and safety laws or mandatory reporting schemes. This defence is similar to the exception provided in a number of the APPs, in relation to which the OAIC has provided guidance for the interpretation of the terms “authorised” or “required”. The Explanatory Memorandum gives the example of conduct being impliedly authorised “if it is directly entailed by a law...[but] will not be authorised simply because it is not prohibited, or by virtue of general authority to perform specific functions or activities.” |
Necessity
A defence of necessity would apply where the defendant reasonably believes that the invasion of privacy was necessary to prevent or lessen a serious threat to life, health or safety of a person. The Explanatory Memorandum states that this defence is directed towards circumstances in which conduct was a response to an emergency or serious or imminent danger. The example provided is where health professionals or emergency services must disclose private information to assist in a health or other personal emergency (like domestic violence incidents). For a threat to be "serious", it need not be imminent, however it must post a significant danger to the person, having regard to all the circumstances, including the gravity of the potential outcome and likelihood that it would occur. |
|
|
Consent
Consent (whether express or implied) given by a person with the requisite legal capacity is provided as a defence to a cause of action for serious invasion of privacy. Whether a person has legal capacity, and whether valid consent has been provided, are questions of fact for the court to determine. |
Defence of person or property
A defence applies for invasions of privacy that are incidental to the exercise of a lawful right of defence of persons or property where the conduct is proportionate, necessary and reasonable. |
|
|
Journalists
An exemption applies for invasions of privacy by a journalist, their employer and certain persons assisting them, where the invasion involves the collection, preparation or publication of journalistic material. This exemption is intended to protect the public interest in press freedom and the promotion of accountability and transparency in institutions. The Explanatory Memorandum emphasises that this exemption operates in addition to the requirement that the court balance the public interest in an individual’s privacy against other public interests relevant to a cause of action. |
Enforcement bodies
In alignment with APP 6.2(e) of the Privacy Act, this exemption provides that the conduct of an enforcement body – that would otherwise constitute an invasion of privacy - will not give rise to a cause of action to the extent that the enforcement body reasonably believes that this conduct is reasonably necessary. |
|
|
Intelligence agencies
This exemption encompasses invasions of privacy by an intelligence agency, as well as disclosures of information to and by intelligence agencies. |
People under 18
This exemption applies for defendants who were under the age of 18 when the invasion of privacy occurred, on the basis that civil liability under the tort should not apply to children. |
|
Notably, unlike under the other parts of the Privacy Act, there is no general exemption for small businesses or for dealings with employee records. This means that claims may be brought under the tort even in situations where there would be no breach of the Privacy Act because of one of these exemptions. This is an important consideration for organisations that may have been relying on these exemptions to justify unsafe privacy practices.
Public interest in free expression
The Bill provides for 3 defences that are intended to align with the related defences under defamation law, all of which are intended to support the inherent public interest in free expression. For these defences to apply, the invasion of privacy must have occurred through the publication of information, as that term is defined under defamation law.
The 3 defences are as follows:
- Absolute privilege: This defence protects communications made in certain limited occasions, where the common law has recognised that complete immunity from suit is warranted to ensure the effective performance of important public functions. The examples of “certain communications” provided in the Explanatory Memorandum are where an individual reveals personal information in the course of public forums, such as in Parliament and in legal proceedings in a court or tribunal.
- Publication of public documents: The Explanatory Memorandum states that this defence “recognises that the publication of public documents promotes an open and transparent government and legal system.”
- Fair report of proceedings of concern: This defence is designed to protect the public interests of open government, transparency, and open justice, and the Explanatory Memorandum highlights its importance for court reporters and educational institutions. Whether a report is fair will be a question of fact, to be determined objectively by comparing the report to the events that it described.
A safe harbour for intermediaries was not included, consistent with the recommendations in ALRC Report 123. We expect this to be contentious, as the boundary between a mere facilitation and “use” will be controversial. Just as defamation law has struggled to demarcate between innocent dissemination and primary publication by an intermediary, so too will defining the limits of when online intermediaries have engaged in a third party’s tortious invasion of privacy. Being aware that your service is being used by a third party to invade the privacy of another, and not taking steps to address that invasion, may be found to be reckless.
Contributory Negligence
As a tort, the principle of contributory negligence, which apportions liability based on the plaintiff's own negligence, may apply to statutory torts of privacy.
While it is generally accepted that it is not a defence to intentional torts, how should this principle apply in the context of reckless invasions of privacy? Will weak passwords, sharing of personal information online, or leaving devices unattended become relevant to a plaintiff’s claim?
We expect complicated litigation as courts grapple with balancing the plaintiff's right to privacy with their own potential contribution to the harm.
Limitation periods
Consistent with the recommendation in ALRC Report 123, a plaintiff must commence an action before the earlier of the day that is one year after the day on which the plaintiff became aware of the invasion of privacy and the day that is three years after the invasion of privacy occurred.
However, if the plaintiff was under 18 years of age when the invasion of privacy occurred, the action may be commenced before the plaintiff’s 21st birthday.
This period may be extended to a day not later than 6 years after the day on which the invasion of privacy occurred, if the court is satisfied on application of the plaintiff that it was not reasonable in the circumstances for the plaintiff to have commenced an action.
Remedies
A court will have the flexibility to choose the remedy or remedies that are most appropriate in the circumstances.
|
Compensatory damages
The courts will be empowered to award damages for economic and non-economic loss, including damages for any emotional distress suffered by the plaintiff. The general principle in tort law is that the role of compensatory damages is to place a plaintiff, so far as money can do, in the position he or she would have been in had the tort not been committed. Compensatory damages may include special and general damages. Special damages refer to items of loss suffered prior to trial which are capable of precise arithmetical calculation—such as hospital expenses. General damages refer to all injuries which are not capable of precise calculation. Also, courts have often recognised that an award of general compensatory damages may serve the purpose or have the effect of vindicating the plaintiff’s right.[4] For example, as cited by the DP 80 at [11.3], at in Plenty v Dillon (1991) 171 CLR 635, 655, Gaudron and McHugh JJ of the High Court of Australia characterised the award of general damages for an action in trespass to land as fulfilling vindicatory purposes, finding that “the appellant is entitled to have his right of property vindicated by a substantial award of damages.” ALRC Report 123, [12.121] Bist v Cyan Stone Clydesdale Estate 1 Pty Ltd [2024] FCA 1108 at [29]: “It can be accepted that there are circumstances where an injunction will lie to restrain tortious conduct; and that, therefore, there is no reason in principle why a restorative mandatory injunction cannot be granted requiring the effect of tortious conduct to be reversed (assuming that damages are not an adequate remedy)” ALRC Report 123, [12,155]. |
Exemplary damages
Exemplary damages are awarded to mark the court’s disapproval of the conduct of the defendant and to deter its repetition by the defendant or others. Exemplary damages are intended to punish a defendant and deter similar conduct in the future. In assessing whether they are warranted the court would consider whether any other damages or remedy awarded are sufficient. For example, as cited by the DP 80 at [11.3], at in Plenty v Dillon (1991) 171 CLR 635, 655, Gaudron and McHugh JJ of the High Court of Australia characterised the award of general damages for an action in trespass to land as fulfilling vindicatory purposes, finding that “the appellant is entitled to have his right of property vindicated by a substantial award of damages.” ALRC Report 123, [12.121] Bist v Cyan Stone Clydesdale Estate 1 Pty Ltd [2024] FCA 1108 at [29]: “It can be accepted that there are circumstances where an injunction will lie to restrain tortious conduct; and that, therefore, there is no reason in principle why a restorative mandatory injunction cannot be granted requiring the effect of tortious conduct to be reversed (assuming that damages are not an adequate remedy)” ALRC Report 123, [12,155]. |
For example, as cited by the DP 80 at [11.3], at in Plenty v Dillon (1991) 171 CLR 635, 655, Gaudron and McHugh JJ of the High Court of Australia characterised the award of general damages for an action in trespass to land as fulfilling vindicatory purposes, finding that “the appellant is entitled to have his right of property vindicated by a substantial award of damages.” ALRC Report 123, [12.121] Bist v Cyan Stone Clydesdale Estate 1 Pty Ltd [2024] FCA 1108 at [29]: “It can be accepted that there are circumstances where an injunction will lie to restrain tortious conduct; and that, therefore, there is no reason in principle why a restorative mandatory injunction cannot be granted requiring the effect of tortious conduct to be reversed (assuming that damages are not an adequate remedy)” ALRC Report 123, [12,155]. |
|
Injunctions
Most frequently, a final injunction is a permanent court order that compels or prohibits a specific action. In this context, a final injunction could be used to permanently restrain the ongoing or future misuse or intrusion into seclusion. The Bill expressly recognises the potential for interim injunctions. We expect such disputes to be a “high stakes” game—especially as privacy “once lost, maybe lost forever”.[5] For technology companies, disruptions to the roll-out of new products and services will be challenging. In the context of public interest disclosures, as ALRC Report 123 acknowledged, “the appropriate opportunity to reveal the relevant information or to contribute to a public debate may be lost as the information’s novelty, relevance or interest is overtaken by other events.” While most injunctions prohibit future conduct, the Federal Court has also recently confirmed that mandatory injunctions can be ordered with positive steps required to “reverse” tortious conduct.[6] For example, as cited by the DP 80 at [11.3], at in Plenty v Dillon (1991) 171 CLR 635, 655, Gaudron and McHugh JJ of the High Court of Australia characterised the award of general damages for an action in trespass to land as fulfilling vindicatory purposes, finding that “the appellant is entitled to have his right of property vindicated by a substantial award of damages.” ALRC Report 123, [12.121] Bist v Cyan Stone Clydesdale Estate 1 Pty Ltd [2024] FCA 1108 at [29]: “It can be accepted that there are circumstances where an injunction will lie to restrain tortious conduct; and that, therefore, there is no reason in principle why a restorative mandatory injunction cannot be granted requiring the effect of tortious conduct to be reversed (assuming that damages are not an adequate remedy)” ALRC Report 123, [12,155]. |
Account of profits
The "account of profit" remedy is a measure designed to deter defendants from invading the privacy of others for its own financial gain. It works by confiscating any profits derived from such invasions. This disincentive is crucial in preventing individuals and corporations from exploiting personal information for commercial advantage—for instance, where an organisation unlawfully collects and sells personal data. An award of an account of profits may be appropriate where the financial benefit derived to a defendant from an invasion of privacy exceeds the loss incurred to a plaintiff. ALRC Report 123 argued this award should be an alternative to damages. For example, as cited by the DP 80 at [11.3], at in Plenty v Dillon (1991) 171 CLR 635, 655, Gaudron and McHugh JJ of the High Court of Australia characterised the award of general damages for an action in trespass to land as fulfilling vindicatory purposes, finding that “the appellant is entitled to have his right of property vindicated by a substantial award of damages.” ALRC Report 123, [12.121] Bist v Cyan Stone Clydesdale Estate 1 Pty Ltd [2024] FCA 1108 at [29]: “It can be accepted that there are circumstances where an injunction will lie to restrain tortious conduct; and that, therefore, there is no reason in principle why a restorative mandatory injunction cannot be granted requiring the effect of tortious conduct to be reversed (assuming that damages are not an adequate remedy)” ALRC Report 123, [12,155]. |
For example, as cited by the DP 80 at [11.3], at in Plenty v Dillon (1991) 171 CLR 635, 655, Gaudron and McHugh JJ of the High Court of Australia characterised the award of general damages for an action in trespass to land as fulfilling vindicatory purposes, finding that “the appellant is entitled to have his right of property vindicated by a substantial award of damages.” ALRC Report 123, [12.121] Bist v Cyan Stone Clydesdale Estate 1 Pty Ltd [2024] FCA 1108 at [29]: “It can be accepted that there are circumstances where an injunction will lie to restrain tortious conduct; and that, therefore, there is no reason in principle why a restorative mandatory injunction cannot be granted requiring the effect of tortious conduct to be reversed (assuming that damages are not an adequate remedy)” ALRC Report 123, [12,155]. |
|
Correction orders
A “correction order” requires a defendant to publish a corrective statement where false private information has been published or otherwise disclosed. This type of order may be useful, even as an alternative to an award for damages, where a plaintiff is primarily concerned with correcting the public record. The provision of this remedy in the Bill is in line with the acknowledgement in ALRC Report 123 that disclosure of private information may amount to a serious invasion of privacy, even where that disclosure is untrue.[7] For example, as cited by the DP 80 at [11.3], at in Plenty v Dillon (1991) 171 CLR 635, 655, Gaudron and McHugh JJ of the High Court of Australia characterised the award of general damages for an action in trespass to land as fulfilling vindicatory purposes, finding that “the appellant is entitled to have his right of property vindicated by a substantial award of damages.” ALRC Report 123, [12.121] Bist v Cyan Stone Clydesdale Estate 1 Pty Ltd [2024] FCA 1108 at [29]: “It can be accepted that there are circumstances where an injunction will lie to restrain tortious conduct; and that, therefore, there is no reason in principle why a restorative mandatory injunction cannot be granted requiring the effect of tortious conduct to be reversed (assuming that damages are not an adequate remedy)” ALRC Report 123, [12,155]. |
Delivery up, destruction or removal of materials
These orders will be useful where a defendant has obtained private information and has displayed an intention to disclose that information to a third party. If this order is made, a defendant would be required to deliver the material to the court for destruction, or otherwise the material will be removed from the internet. Examples of scenarios in which this order might be appropriate include intimate photos and texts of a highly personal nature. Given the way in which digital information is disseminated across platforms and mediums, this remedy may be more complicated than it initially seems. For example, as cited by the DP 80 at [11.3], at in Plenty v Dillon (1991) 171 CLR 635, 655, Gaudron and McHugh JJ of the High Court of Australia characterised the award of general damages for an action in trespass to land as fulfilling vindicatory purposes, finding that “the appellant is entitled to have his right of property vindicated by a substantial award of damages.” ALRC Report 123, [12.121] Bist v Cyan Stone Clydesdale Estate 1 Pty Ltd [2024] FCA 1108 at [29]: “It can be accepted that there are circumstances where an injunction will lie to restrain tortious conduct; and that, therefore, there is no reason in principle why a restorative mandatory injunction cannot be granted requiring the effect of tortious conduct to be reversed (assuming that damages are not an adequate remedy)” ALRC Report 123, [12,155]. |
For example, as cited by the DP 80 at [11.3], at in Plenty v Dillon (1991) 171 CLR 635, 655, Gaudron and McHugh JJ of the High Court of Australia characterised the award of general damages for an action in trespass to land as fulfilling vindicatory purposes, finding that “the appellant is entitled to have his right of property vindicated by a substantial award of damages.” ALRC Report 123, [12.121] Bist v Cyan Stone Clydesdale Estate 1 Pty Ltd [2024] FCA 1108 at [29]: “It can be accepted that there are circumstances where an injunction will lie to restrain tortious conduct; and that, therefore, there is no reason in principle why a restorative mandatory injunction cannot be granted requiring the effect of tortious conduct to be reversed (assuming that damages are not an adequate remedy)” ALRC Report 123, [12,155]. |
|
Apology orders
A defendant may be given an order to make an apology to the plaintiff, either in private or public. The purpose of this order is to address the harm done to a person’s dignity as a result of a serious invasion of privacy. Additionally, an apology would act as an acknowledgement of wrongdoing and help to repair the plaintiff’s social standing in the wake of the privacy invasion. For example, as cited by the DP 80 at [11.3], at in Plenty v Dillon (1991) 171 CLR 635, 655, Gaudron and McHugh JJ of the High Court of Australia characterised the award of general damages for an action in trespass to land as fulfilling vindicatory purposes, finding that “the appellant is entitled to have his right of property vindicated by a substantial award of damages.” ALRC Report 123, [12.121] Bist v Cyan Stone Clydesdale Estate 1 Pty Ltd [2024] FCA 1108 at [29]: “It can be accepted that there are circumstances where an injunction will lie to restrain tortious conduct; and that, therefore, there is no reason in principle why a restorative mandatory injunction cannot be granted requiring the effect of tortious conduct to be reversed (assuming that damages are not an adequate remedy)” ALRC Report 123, [12,155]. |
Declarations
Declarations are used to provide a sense of certainty, and to assist in reducing the length and cost of court proceedings. Declarations of a court can, at an earlier stage, establish the nature of each party’s interests, rights or duties in relation to a cause of action. With this information set down, some parties may adjust their approach to the litigation or even decide not to pursue litigation in a court. For example, as cited by the DP 80 at [11.3], at in Plenty v Dillon (1991) 171 CLR 635, 655, Gaudron and McHugh JJ of the High Court of Australia characterised the award of general damages for an action in trespass to land as fulfilling vindicatory purposes, finding that “the appellant is entitled to have his right of property vindicated by a substantial award of damages.” ALRC Report 123, [12.121] Bist v Cyan Stone Clydesdale Estate 1 Pty Ltd [2024] FCA 1108 at [29]: “It can be accepted that there are circumstances where an injunction will lie to restrain tortious conduct; and that, therefore, there is no reason in principle why a restorative mandatory injunction cannot be granted requiring the effect of tortious conduct to be reversed (assuming that damages are not an adequate remedy)” ALRC Report 123, [12,155]. |
For example, as cited by the DP 80 at [11.3], at in Plenty v Dillon (1991) 171 CLR 635, 655, Gaudron and McHugh JJ of the High Court of Australia characterised the award of general damages for an action in trespass to land as fulfilling vindicatory purposes, finding that “the appellant is entitled to have his right of property vindicated by a substantial award of damages.” ALRC Report 123, [12.121] Bist v Cyan Stone Clydesdale Estate 1 Pty Ltd [2024] FCA 1108 at [29]: “It can be accepted that there are circumstances where an injunction will lie to restrain tortious conduct; and that, therefore, there is no reason in principle why a restorative mandatory injunction cannot be granted requiring the effect of tortious conduct to be reversed (assuming that damages are not an adequate remedy)” ALRC Report 123, [12,155]. |
Other points of interest in the Bill
Crown to be bound
While an archaic provision normally glossed over, the inclusion of a “Crown to be bound” provision ensures that the Government will also be liable for invasions of privacy that are not authorised by law, or cannot meet the public interest test. Potential mass tort claims against the Commonwealth may be possible.
Single publication rule
The Bill includes a single publication rule which, together with the rules for commencing actions, clarifies when an action must be commenced. Where information that is substantially the same is published multiple times by the same publisher, or the publisher’s associate, the date of the first publication would be taken to be the date of the invasion of privacy.
The provision is based on the Model Defamation Provisions, with some adjustments to reflect that not every invasion of privacy is a publication. This is particularly important for invasions that may occur through disclosure on internet platforms.
No privacy for the dead
A statutory cause of action does not survive the death of the plaintiff or the defendant. However, the court maintains a discretion in relation to costs. For example, the court may determine that it is in the interest of justice that the defendant’s estate pay all or some of the costs that the plaintiff has incurred in bringing the action – and vice versa if a plaintiff dies.
Separate interpretation
The Explanatory Memorandum to the Bill provides that the statutory tort for serious invasions of privacy is intended to operate “similarly to other torts” in that it would be developed through jurisprudence.
However, the Bill expressly provides that the meaning of the rest of the Privacy Act (including the Australian Privacy Principles) is to be “disregarded” in interpreting the new provisions — it is to be “distinct” from the regulatory regime established in the Privacy Act.
Disregarding the meaning of expressions in the APPs when interpreting the limits of the tort creates uncertainty and potential inconsistencies in the application of privacy law. The APPs and the statutory tort are likely to have overlapping or conflicting operation. Divergent definitions are likely to arise.
For example, the term "serious" is used in various contexts in the Act, such as the threshold for the existing civil penalty provisions. Allowing for separate interpretations means that a breach that might be considered "serious" for purposes of seeking a civil penalty might not meet the threshold for a serious invasion of privacy under the new tort, or vice versa.
Objects clause does not apply
Similarly, the objects clause used to interpret the rest of the Privacy Act will not apply to the statutory tort. An objects clause is a provision — often located at the beginning of a piece of legislation — that outlines the underlying purposes of the legislation and can be used to resolve uncertainty and ambiguity. Objects clauses have been described as a “modern day variant on the use of a preamble to indicate the intended purpose of legislation.”[8]
ALRC Report 108, Australian Privacy Law and Practice, [5.90]
|
PRIVACY ACT OBJECTS
|
STATUTORY TORT OBJECTS
|
Example
uses 2
|
|
To promote the protection of the privacy of individuals To recognise that the protection of the privacy of individuals is balanced with the interests of entities in carrying out their functions or activities To provide the basis for nationally consistent regulation of privacy and the handling of personal information To promote responsible and transparent handling of personal information by entities To facilitate an efficient credit reporting system while ensuring that the privacy of individuals is respected To facilitate the free flow of information across national borders while ensuring that the privacy of individuals is respected To provide a means for individuals to complain about an alleged interference with their privacy To implement Australia's international obligation in relation to privacy. |
To establish a cause of action for serious invasions of privacy To provide for defences, remedies and exemptions in respect of the cause of action To recognise that there is a public interest in protecting privacy To recognise that the public interest in protecting privacy is balanced with other public interests To implement Australia’s international obligations in relation to privacy |
|
The only shared object between the two regimes is to implement Australia's international obligation in relation to privacy. Splitting the interpretation and objects of the Act in this way creates compliance complexity.
Next steps
The Bill has been referred to the Senate Legal and Constitutional Affairs Legislation Committee, with a report due 14 November 2024. The submissions closing date is 11 October 2024.
Stay tuned for our next update concerning enforcement, fines, and civil penalties.
