Privacy Commissioner and OAIC expected to do more on the smell of the same oily rag?

The Office of Australian Information Commissioner was asked again to do more with no additional resources, something it should be used to by now after six years of practice. That's since since the Abbott government had an unsuccessful crack at abolishing the Commission and successive governments in the years since kept the lid closed or just slightly ajar (with some additional privacy resources in last year's budget to go with earlier expansions of its role) on the moneybox. 

But wait-despite no one on the government side deviating from the script during debate the Attorney General told Shadow Attorney General Dreyfus separately his department is checking with the OAIC to ensure they have adequate resources.

(Perhaps too much to hope that the check might also dig into the issue of stretched OAIC Freedom of Information resources that include one commissioner instead of three as legislated, and to deal with something like a 90% increase in FOI review applications over the last four years that now form a long,long queue, and non existent resources for Information Policy functions.)

The OAIC issue arose as the Privacy Amendment (Public Health Contact Information) Bill 2020 sailed through both houses when Parliament sat this week.

The bill, as passed by the House of Representatives on Wednesday, passed the Senate this morning without amendment. 

Labor in the Senate did not support amendments put by the Greens and Centre Alliance citing the urgency of getting the legislation in place as quickly as possible.

Speakers in both houses drew attention to the extra responsibilities the bill places on the Privacy Commissioner and her office the OAIC, particularly this exchange in a committee hearing last week 

Senator Keneally: in light of the new and important oversight responsibilities that the draft bill would confer on the Privacy Commissioner, will the government be providing the Privacy Commissioner with any additional resources?

Ms Chidgey (Attorney General’s Department): There's no intention to provide additional resources. The Privacy Commissioner is able to undertake this work within their existing resources.

Shadow Attorney General Mark Dreyfus unsuccessfully moved a motion in the House that included a call call on the government to "provide additional funding to the (OAIC) and appoint a standalone privacy commissioner “to ensure that the commissioner is able to properly perform the important oversight functions provided for in this bill.” 

He spoke to this part of the motion thus:

"Another issue that I raised with the Attorney-General during discussion about this bill relates to the funding of the Office of the Australian Information Commissioner. In short, I do not think that the evidence of the Attorney-General's Department at last Wednesday's COVID-19 Senate select committee hearing that the commissioner requires no additional resources to fulfil her new oversight responsibilities is credible.In fact, it is incredible. You do not have to take my word for it. Just last October, the Information Commissioner told Senate estimates that her office is already underresourced.The Attorney-General has advised me that his department is engaging with the commissioner to ensure that she has the necessary resources to perform the important oversight functions provided for in this bill, the Privacy Amendment (Public Health Contact Information) Bill 2020. While I welcome that engagement and look forward to receiving an update over coming days or weeks, there is no question in my mind that additional funding is urgently required. The only question is how much.
It is also important to remember that for years the government has refused to appoint a standalone information commissioner, a standalone freedom of information commissioner or a standalone privacy commissioner. Instead, one person currently occupies all three of these important and demanding roles. As I've said repeatedly, this is unacceptable. In light of the new responsibilities that this bill would confer on the Office of the Australian Information Commissioner, now more than ever the government needs to appoint a standalone, dedicated privacy commissioner. The appointment of a full-time and properly resourced privacy commissioner rather than a commissioner forced to split her time between three different and demanding roles would make a further valuable contribution to building public confidence in the COVIDSafe app. It should not take a public health crisis for the government to show that it takes seriously the privacy of Australians.

Additional responsibilities for the Privacy Commissioner arise because as explained in the second reading speech:

• The bill ensures COVIDSafe app data must  be treated as 'personal information' under the Privacy Act, by virtue of section 94Q. This automatically applies a range of existing Privacy Act protections to COVIDSafe app data, including privacy policy, notification, and security obligations. 

• The commissioner will be able to undertake a formal assessment of whether an entity subject to the Privacy Act, or a state or territory health authority handling COVIDSafe app data, is complying with the requirements in this bill. And to deal with complaints.

• The commissioner will also have discretion to refer matters that may constitute a breach of a state or territory privacy law to the responsible state or territory privacy regulator. 

•  The commissioner will provide regular public reports on the performance and exercise of her new powers and functions under part VIIIA.

• The bill applies the existing Notifiable Data Breaches Scheme for which the commissioner is responsible to COVIDSafe app data under section 94S. The bill requires the administrator of the National COVIDSafe Data Store, or a state or territory health authority handling COVIDSafe app data, to notify the commissioner of any data breach involving COVIDSafe app data. The commissioner will then have the power to require the breach to be notified to affected individuals.The notification requirement would be automatic in the event of a data breach, which is much stronger than the protection in the Privacy Act's existing data breach notification requirements. 

Somewhere in there in there is also a COVIDSafe Privacy Advisory Committee, including the various Privacy Commissioners, to provide collective advice to the National Cabinet and the public regarding the operation of COVIDSafe.

The Commissioner welcomed changes to the act-no mention of the resources issue

Should be a snack really.

After 18 years,NSW to get a full time Privacy Commissioner

Attorney General Mark Speakman has announced the proposed appointment of Samantha Gavel as NSW Privacy Commissioner. The Joint Parliamentary Committee on the Ombudsman, the Law Enforcement Conduct Commission and the Crime Commission gets  to confirm the appointment... or otherwise.

And the good news, many years late, is that the government will make the position full time. 

The Commissioner has  been part-time since the first appointment in 1999  and for long periods there was an Acting Commissioner, including 2003-07 and 2009-2011. 

“Ms Gavel is a leader in privacy protection who is currently the National Health Practitioner Ombudsman and Privacy Commissioner, and was previously the Private Health Insurance Ombudsman for six years,” Mr Speakman said in a Media release 

Paris Cowan in IT News in February recounted how privacy regulation everywhere around the country is under resourced.

Budgeted expenditure for the Information and Privacy Commission in 2017-18 is $5.6 million, a 1.3% reduction. 

Looks like expenditure on a full time commissioner will involve a snip elsewhere.

Thanks for managing a tough assignment to departing Privacy Commissioner Dr Elizabeth Coombs. 

Australian Privacy Foundation rates the parties: privacy protection doesn't rate

The Australian Privacy Foundation Election Challenge-party responses to
Ten Vital Privacy Issues cross-checked against their public platforms- presents a dismal outlook for the priority and approach they give to privacy protection.
(They didn't bother asking about position regarding the 2009 Australian Law Reform Commission recommendation that political parties exemption from the Privacy Act should be removed- the response too predictable I imagine.)

(Some omissions in original now corrected)

In descending order of inadequacy, the best:

• The Pirate Party scored 95/100 on the Challenge. The Party has a very comprehensive platform, which is very positive on human rights and privacy issues, particularly in its heartland area of the digitally literate. The Party provided specific, clear and positive responses to the APF's Election Challenge.
• The Greens scored 94/100. The Party remains close to the people who they represent. They have long had, and retain, an enlightened set of policies. Senator Ludlum has led the Parliamentary fight against privacy-invasive technologies. The Party's Platform is reasonably comprehensive, and has specific segments on Human Rights and Constitutional Reform and Democracy. The Party's Response was clear and to the point.

Others

The Sex Party has a limited platform, but it has been consistently pro-privacy, it claims to have "a broad civil libertarian policy suite", and it has some specific policies that are significantly supportive of human rights. This includes a statutory right to privacy and stronger protections agains breaches of privacy, particularly in relation to data retention and CCTV. (20/100)

The Labor Party platform contains only 3 mentions of 'human rights', two relating to immigration and and one to a promised LGBTI Discrimination Commissioner. Of the 100 policy areas, 4 do relate to 'Workers Rights' (sic), and a dozen more to 'Tackling inequality and disadvantage'. However, the 'National Information Policy' and the policy on Comprehensive Credit Reporting include elements that are actively anti-privacy in nature. The Party had claims in relation to several initiatives some years ago, but its current stance is grossly deficient. Labor provided a Response, which in a number of respects was positive. But it did not score very highly at all in relation to the challenges that we posed. A vote for Labor is a vote for privacy-abusive laws. (19/100)
The Xenophon Group has a narrow platform, and its response was limited. The platform provides very little meaningful about human rights or privacy, but a couple of minor statements have been provided about betting agency access to personal data, and warrants for metadata collection (5/100).
The Liberal Party platform contains nothing whatsoever relating to human rights or consumer rights. The Party has been actively hostile to privacy in recent years, and its commitment to 'Combatting Terrorism' appears to be as unbalanced as ever. In addition, the Party failed to provide a response. From 11/100 in 2013, the Party's score has actually gone backwards. A vote for the Liberals is a vote for privacy-abusive laws, and against privacy protections (2/100).
The National Party appears to sub-contract its platform to the Liberal Party, and hence earns the same abysmal rating (2/100)."

Then:

1 Party may be privacy-supportive, but it's difficult to tell:

• The Liberal Democrats (David Leyonhjelm) are strongly 'libertarian', in the US sense, ("favouring individual choice and freedom over government intrusion"), although they're less extreme than the word would imply in US politics. The Party has firm policies on freedom and civil liberties and democracy, but they're not detailed enough to apply a score.

2 further Parties responded to the APF's Challenge, but without sufficient substance to earn a score:

• Consumer Rights and No-Tolls is generally supportive of human and consumer rights, but does not have any specific policies in place in relation to privacy.
• Glenn Lazarus Team provided no meaningful response in relation to human rights or privacy.

The remaining 13 Parties offered virtually nothing of relevance to the analysis:

• Christian Democratic Party (Fred Nile) appears not to have a platform.
• Family First appears not to have a platform.
• The platform of the Democratic Labor Party contains nothing about human rights or privacy, and is largely hostile to them.
• Justice Party (Derryn Hinch) appears not even to have a functioning web-site, let alone any meaningful policies.
• The platform of Katter's Australian Party refers to the advancement of "individual’s [sic] rights and freedoms", but appears to be silent on the specifics of human rights and privacy.
• Jacqui Lambie Network appears not to have a platform.
• Manufacturing and Farming Party (John Madigan) provides nothing meaningful about human rights or privacy.
• One Nation's Platform appears to contain nothing about human or consumer rights, and it mandates a National Identity Card as a condition of use of "tax payer funded services" – "This is not an invasion of privacy, it is a matter of national security".
• Outdoor Recreation Party (ORP) is vaguely libertarian, but provides nothing meaningful about human rights or privacy.
• Palmer United appears not to have a platform.
• The platform of RiseUp Australia contains only a limited amount about human rights.
• Shooters, Fishers (and Farmers?) Party provides nothing meaningful about human rights or privacy.
• Socialist Alliance provides nothing meaningful about human rights or privacy

A state by state approach to legislating protection of privacy rights?

opensource.com

The South Australian Law Reform Institute Final Report on A Statutory Tort for Invasion of Privacy includes 34 recommendations fleshing out the detail of its principal recommendation that the South Australian Parliament should enact a limited cause of action for serious invasions of personal privacy.

The report reminds

• in 1973, the former South Australian Law Reform Committee recommended that a general right of privacy be created; 

• bills to establish that right were introduced into the parliament in 1974 and again in 1991 but were both defeated;

• the Australian Law Reform Commission in 2008, the NSW Law Reform Commission in 2009, and the Victorian Law Reform Commission in 2010 recommended the introduction of a statutory cause of action for invasion of privacy;

• the Australian Law Reform Commission returned to the subject again in 2014 when the report "Serious Invasions of Privacy in the Digital Age" recommended that if a cause of action for serious invasions of privacy is to be enacted, it should be enacted by the Commonwealth and should specifically deal with invasions of privacy by intrusion upon seclusion and by misuse of private information.

Not mentioned because it was tabled after the SA report was finalised the Standing Committee on Law and Justice of the NSW Parliament in a report two weeks ago recommended that the NSW Government introduce a statutory cause of action for serious invasions of privacy.

(The SA report is the subject of discussion on Radio National's The Law Report.)

Despite some differences in detail the main thrust of all the reports is that a statutory cause of action or tort should be enacted and just about everyone agrees that national consistency is desirable.

However law reform experts in SA and members of the NSW parliamentary committee at least have run out of patience with the federal government and recommend moving ahead regardless.

Federal Labor baulked at acting on the 2008 ALRC recommendation which came under heavy fire from some in the media led by Chris Merritt of The Australian, and passed the parcel back to the ALRC commissioning the privacy in the digital age report.

The only wisdom from Commonwealth Attorney General Brandis on the subject since assuming office is "the Government has made it clear on numerous occasions that it does not support a tort of privacy"- as reported by Chris Merritt.  

To let the state borders determine the extent to which citizens enjoy practical protection of their privacy rights in this privacy intrusive day and age is a crazy way to run the federation. Different railway gauges anyone?

"We're the government and we're here to protect your privacy"

Not... 

as two experts outline years of failure to pay attention to privacy protection.

Dr Roger Clarke in a detailed working paper examines the last 15 years' incursions into human rights based on 'the terrorist threat' and highlights the limited attention paid to privacy impact assessment:

Democracy in Australia is gravely threatened by a flood of measures harmful to human rights that have been introduced since 2001, and a large proportion of which are unjustified and not subject to effective controls. The passage of these measures through the Parliament has been achieved on the basis of their proponents' assertions and without appropriate scrutiny. Parliament had available to it various forms of impact assessment techniques, but failed to require that such methods be applied. The study reported here found that one particular form of evaluation, Privacy Impact Assessment (PIA), should have been performed, but was seldom applied, and where it was applied the process and report were in almost all cases seriously deficient. Survival of democracy is dependent on the Parliament standing up to the national security extremism that has taken hold of the Attorney-General's Department. Ministers and Parliamentary Committees must demand prior evaluation of proposals that restrict civil freedoms, must ensure transparency in relation to the proposals and their justification, and must require effective controls over, and mitigation features within, those measures that survive the evaluation process.

Reminder: the Office of Australian Information Commissioner that includes the Privacy Commissioner has operated under threat of extinction for 15 months. Currently one commissioner is responsible for the functions of three commissioners envisaged by parliament in establishing the office. A Privacy Commissioner will be in place for 12 months from 19 October.

.......................
Anna Johnston of Salinger Privacy responds to a NSW parliamentary committee call for submissions on a statutory cause of action for serious invasions of privacy by providing chapter and verse of failure to address other well known weaknesses in privacy law and enforcement. 

Johnston lists the black holes where privacy laws don't apply and loopholes unique to NSW "so wide you could drive a truck full of privacy-invaders through them, and still have room for a parade of dancing elephants on either side." For example State Owned Corporations are not subject to privacy legislation, a NSW agency can pass any personal information to a person or body outside the state and not breach the Privacy and Personal Information Protection Act, and an agency is not responsible for privacy invasive conduct of an employee malicious or otherwise if the person wasn't really acting as an employee at the time.

Reminder: as Johnston notes, "NSW has only a part-time Privacy Commissioner, who does not have enough staff or an independent budget, let alone any powers to levy fines or compel privacy-invaders to do anything."

Impact of cutbacks at OAIC: Open and Shut interested in your story

With the functions of the three commissioners that make up the Office of Australian Information Commissioner now in the hands of a single acting commissioner, Timothy Pilgrim's 'in folder' will be heavily loaded with important matters. 

None more so than files concerning non delegable functions that the commissioner only can exercise such as freedom of information review decisions, and determinations on privacy complaints not resolved by conciliation.

The latest published FOI review decision is on a matter lodged with the OAIC in April 2014. The latest published privacy determination is on an application lodged in August 2013.

How many applications remain in the queue and how long they have been there is not known. 

The latest Quarterly Statistics about Freedom of Information and Privacy complaints and reviews published by the Office are for the period April - June 2014, before the cutbacks on funding announced as the government launched its initiative to abolish the office through legislation that is still to pass.

More FOI review applications are likely to be waved off in the direction of the Administrative Appeals Tribunal where the commissioner "is satisfied that the interests of the administration of this Act make it desirable." Quite a few with legitimate grievances but not eligible for a concession will balk at taking the matter further given the AAT application fee is $861.In the absence of a determination, privacy complainants appear to have nowhere else to go.

If you have had an FOI or privacy matter before the OAIC and the resource constraints and contraction of commissioners from three to two in December and to one since 19 July seem to have added to your woes, Open and Shut is interested in hearing your story.  

May not be able to do more than listen but email me: peter.timmins100@gmail.com

Privacy tort could enhance press freedom protection here, according to UK media law expert

Wikimedia Commons

Given the long concerted campaign by many media outlets led by The Australian (most recently here) to head off a privacy tort or cause of action, you're unlikely to see much of this in those pages.

From "Enhancing Press Freedom through Greater Privacy Law: A UK Perspective on an Australian Privacy Tort" by Associate Professor Paul Wragg, University of Leeds and Visiting Fellow at the University of Sydney, (Sydney Law Review Volume 36 No 4 December 2014):

"In light of previous inquiries identifying areas of concern in Australia’s privacy law provisions, the Australian Law Reform Commission (‘ALRC’) recently devised a new tort that, if implemented, would better protect individuals from serious invasions of privacy. Although the tort was designed principally with new technologies in mind, there has been vociferous concern that such a tort might unduly inhibit press freedom. This response is familiar to United Kingdom (‘UK’) commentators who have seen the press, in particular, react similarly to common law developments in privacy law. Yet that experience has not been entirely unfavourable to the UK press; indeed, the jurisprudence discloses a generous treatment of the term ‘public interest’, which has kept interference with press activity to a minimum. In light of the reference to press freedom within the ALRC’s proposed tort, and given the absence of an express constitutional provision protecting Australian press speech, this article argues that the UK experience shows how, counter-intuitively, the ALRC’s proposed tort could actually enhance, rather than diminish, press freedom protection in Australia. Consequently, it will be argued that the collectively dismissive response by the press to the ALRC’s inquiry represents a significant missed opportunity. As the ALRC warns, the common law may develop organically to better protect privacy interests. As will be argued, this prospect presents the obvious risk that press interests are not as fully protected as they would be under the ALRC’s proposals.

Dr Wragg dismisses as surprising, ill judged, difficult to fathom, out of touch with popular sentiment and detached from the reality of what is proposed, claims such as those made by News Corp Australia that "the threat to freedom of speech and communication posed by a cause of action, regardless of how it is structured, will undermine our ability to report in the public interest, to the detriment of the Australian public and Australia’s democracy."

However as privacy is one of those freedoms Attorney General Brandis doesn't talk much about, on this aspect is reported to have said "the Government has made it clear on numerous occasions that it does not support a tort of privacy" and the media generally rushes to close the book on the subject, the issue seems destined to remain in the lost cause vault.

Common law development is likely to be slow, contested but as Dr Wragg points out not necessarily to the media's liking.

"Do you support the abolition of the Office of the Information Commissioner?"

iTnews is conducting a poll.

I wouldn't even try to influence your vote, just go ahead and do it.

Here and scroll down to Polls on the right hand side.

I think it conforms with democratic values - one vote one value.

They're also polling trust in privacy protection.

The Australian dusts off the "Must resist any move to give a right to sue over privacy" file.

In response to the headline to Chris Merritt's report in The Australian "Time to stop droning on about privacy, as a tort is unnecessary", it's wishful thinking but...

it's way, way past time for Chris Merritt to stop droning on that the very idea of a tort for serious unwarranted invasion of privacy would be the end of the world as we know it.

Of course as the Attorney General apparently has said "the Government has made it clear on numerous occasions that it does not support a tort of privacy" this issue is in the lost cause box in any event. Until something in the mix changes regardless of evidence of increasing threats to what we thought might be private, the high level of public concern about privacy and the view of most experts not employed or retained by News Corp that the gap in the law should be filled by a carefully crafted statutory provision. 

News Corp publications of course always have an unerring eye when it comes to balancing privacy and the public right to know and be informed even when it comes to intimate details about Senator Peris. (Segue to a wonderful reflective piece on the general subject by Jack Waterford in The Canberra Times although whoever wrote the headline should have read the article more closely.)  Their activities in the conduct of journalism aren't covered by the Privacy Act but privacy complaints about others were up 183% in the year to June.

This time Merritt is on about a parliamentary committee report that recommended the following among many other steps to deal with gaps in the law in the light of the widespread and growing use of drones.  

You wouldn't know it from Merritt's article that use of drones by journalists wasn't central to the committee's consideration of the problem. Or that there is a stack of reports other than this one that recommend a statutory cause of action:

The Committee recommends that the Australian Government consider introducing legislation by July 2015 which provides protection against privacy-invasive technologies (including remotely piloted aircraft), with particular emphasis on protecting against intrusions on a person's seclusion or private affairs.
The Committee recommends that in considering the type and extent of protection to be afforded, the Government consider giving effect to the Australian Law Reform Commission's proposal for the creation of a tort of serious invasion of privacy, or include alternate measures to achieve similar outcomes, with respect to invasive technologies including remotely piloted aircraft.

It's in Attorney General Brandis' in tray. Don't hold your breath.

Annual report season: wading through

More on content soon.

But the absurdity of Federal Government plans to disband the Office of Australian Information Commissioner is striking, given that the OAIC handled record numbers of complaints and review applications while managing to increase the closure rate of matters, and can point to important achievements in pursuing FOI and privacy themes and responsible information management in the digital age. With leadership on many fronts including culture change to break down excessive secrecy out the door, if parliament passes the bill it's advance Australia backwards.

The Reports published to date cover different ground:
Some comprehensively cover the operation of information access and privacy protection legislation including the commissioner functions and agency compliance:
Office of Australian Information Commissioner
Office of Information Commissioner (Queensland)(pdf)

The Information and Privacy Commission (NSW) report covers the functions of both commissioners but not agency compliance - statute requires a separate report on the operation of the GIPA act generally.

In Victoria there are reports from the Freedom of Information Commissioner (Victoria) and the Office of Privacy Commissioner (Victoria) (pdf). (From 17 September 2014 the OPC was replaced by the Office of the Commissioner for Privacy and Data Protection (Privacy and Data Protection Victoria)).

The Office of the Information Commissioner (Western Australia) reports on FOI related matters. There is no WA privacy legislation that covers state and local government agencies.

The Ombudsman Tasmania (the state has no information or privacy commissioner as such but the Ombudsman has information access and privacy protection oversight and merits review functions) and the Ombudsman SA who has an information access merits review function are yet to report,. So too State Records SA, responsible for the annual FOI report and Privacy Committee report; and the Office of  Information Commissioner Northern Territory.

Is alleged misconduct by a public official deserving of privacy protection?

I'd suggest the intuitive response from most of us is no, and some might firm this up with a 'never', or 'rarely'. 

But of course it all depends on a whole range of circumstances: who is involved and the nature of the alleged conduct; in those jurisdictions that have an anti corruption body whether the misconduct is of a kind requiring notification, otherwise the stage reached in any investigation; the impact disclosure may have on further investigation, etc, etc. If an investigation has concluded, is there a difference if it found misconduct occurred or didn't occur? Was the investigation thorough and appropriate, did it reveal systemic issues, etc, etc....

(This current UK case is slightly off subject but rather special: a disgraced Royal Navy captain is suing the Ministry of Defence because he says his human rights were breached when a military press officer leaked the story of how his verbal abuse of junior officers led him to be relieved of the command of the warship HMS Somerset. The press officer was also charged with misconduct in public office for selling stories to the press!) 

Federal public servants

So put to one side what might be said about the issue and elected officials - our federal parliamentarians don't have a code of conduct by the way..

The Australian Public Service Commission is seeking comment on a discussion paper about the extent to which information about the outcome of a misconduct complaint should be disclosed to the complainant and to others. Public servants are bound by the APS Code of Conduct, set out in section 13 of the Public Service Act 1999 (the PS Act), which codifies required standards of behaviour.

(You'll need to be quick with a submission - the paper seeks  comment by 7 October 2014 to the Ethics Advisory Service: ethics@apsc.gov.auor by post to: Ms Karin Fisher Australian Public Service Commission 16 Furzer Street Phillip, ACT 2606.)

Agencies tend towards non disclosure

Apparently a 2008 APSC guideline that outlines in broad terms the issues relevant to disclosure of information to the complainant and disclosure more generally isn't doing the job. The discussion paper notes

"recent cases, as well as enquiries to the Commission's Ethics Advisory Service, have highlighted a tendency across the APS to err on the side of non-disclosure—a tendency apparently underpinned by agencies' concern that providing more than the minimum of information could constitute a breach of the Privacy Act 1988. Agencies' hesitancy to provide information about the outcomes of misconduct complaints has left them vulnerable to criticism by the public and by the Courts, which risks undermining public confidence in the administration of the APS."

Questions posed in the paper:

• What information should be provided to people, including members of the public, who allege breaches of the APS Code of Conduct about the outcome of their complaints?
• Should information about proven misconduct be disclosed to people other than complainants, such as the wider agency workforce?
• If information should be disclosed to people other than the complainant, under what circumstances?
• What do agencies need to consider in making decisions about these matters?

 Privacy, FOI, PIDS?

The privacy framework that applies to APS agencies and employees "recognises that employees' personal information can sometimes be disclosed, and may need to be disclosed where doing so would serve the broader public interest." Provisions of the Freedom of Information Act 1982  and the Public Interest Disclosure Act 2013 may be relevant in particular instances.

Recent cases

The paper summarises recent cases that indicate "a greater degree of disclosure is acceptable to the community than the Commission's existing guidance suggests:

In Banerji v Bowles [2013] FCCA 1052 (dealing principally with public comment and the right to freedom of expression rather than the right to privacy) it was noted by the Court that the applicant had previously made a complaint against another employee in the agency, whose conduct was investigated as a result, and had been given a letter advising her that ‘appropriate action’ had been taken by the agency in relation to her complaint but that the Privacy Act prevented disclosure of any relevant details. In commenting on this matter, Neville J said:

the letter is (a) less than informative (or otherwise illuminating), and (b) classic ‘Yes Minister’ speak.

The judge questioned how a complainant might obtain any relevant information or raise any questions about a matter that involved serious misconduct if they were told that no relevant information could be provided, and noted that ‘such an information vacuum might understandably give rise to a certain angst or tension in the workplace, which is not necessarily of the complainant's making.’
Similarly, in ‘J’ and Department of Health and Ageing [2013] AICmr 21 (8 March 2013), which concerned a complainant's request for information about the outcome of an investigation, the Australian Information Commissioner stated:

[T]o the extent that … a disclosure demonstrates that an investigation has been properly undertaken, that disclosure will improve general confidence in an agency's capacity to conduct future investigations.

Importantly, the Information Commissioner also noted that the result of the complainant's freedom of information request might have been different if the agency had provided more information and more detail—‘not necessarily in written form’—in the first instance about the outcome of the investigation.
This case also referenced Carver and Fair Work Ombudsman [2011] AICmr 5, in which it was noted that wide disclosure of evidence provided to misconduct investigations

could reasonably be expected to affect the willingness of people to provide evidence for future Code of Conduct investigations which, in turn, would have a substantial adverse effect on the management … of the agency's personnel.

Meat on the bone for cause of action for unwarranted serious breach of privacy

Commissioner Professor Barbara McDonald

The Australian Law Reform Commission Report Serious Invasions of Privacy in the Digital Age, tabled in Parliament today, is in response to the reference by then Labor Attorney General Dreyfus who in June last year asked that the ALRC look at innovative ways to address the problem and provide a detailed legal design of a statutory civil cause of action.  

Recommendations(pdf) 4-12 set out the design elements of a tort for a serious invasion of privacy,"if a statutory cause of action is to be enacted":

• the invasion of privacy must be either by intrusion into seclusion or by misuse of private information (Chapter 5);

• it must be proved that a person in the position of the plaintiff would have had a reasonable expectation of privacy in all of the circumstances (Chapter 6);

• the invasion must have been committed intentionally or recklessly—mere negligence is not sufficient (Chapter 7);

• the invasion must be serious (Chapter 8,) the invasion need not cause actual damage, and damages for emotional distress may be awarded (Chapter 8); and

• the court must be satisfied that the public interest in privacy outweighs any countervailing public interests (Chapter 9).

The last point, the commission notes, is "the crucial ‘balancing exercise’, in which courts weigh privacy against other important public interests, such as freedom of speech, freedom of the media, public health and safety, and national security. The ALRC recommends that such competing interests be considered when determining whether the plaintiff has a cause of action. It should be an element of the tort, rather than a defence. A plaintiff should not be able to claim that a wrong has been committed—that their privacy has been seriously invaded—where there are strong public interest grounds justifying the invasion of privacy."

The commission wasn't asked to go further than report on the elements of a cause of action but you don't need special powers in reading this extract to work out what they would say if they were: that our our legal system should provide recourse, best by statute, in the event of invasions of privacy either by intrusion upon seclusion or by misuse of private information that are serious, committed intentionally or recklessly, and that cannot be justified in the public interest. 

With various wrinkles the Victorian and NSW law reform commissions, the ALRC in 2008, most of the submissions to the previous government's issues paper on the subject, and the recent parliamentary committee report on drones reached the same conclusion.

But given the comment said to have been made by Attorney General Brandis some time back (hard to track down) that "the Government has made it clear on numerous occasions that it does not support a tort of privacy" don't expect the Abbott government to rush to act, soon or maybe anytime. 
(Update: Paul Farrell in The Guardian clears this up:
"A spokesman for the attorney general, George Brandis, said: “The government has made it clear on numerous occasions that it does not support a tort of privacy.”)

That probably won't stop The Australian wheeling out the shock and awe about the impact such a tort could have on free speech, leaving unexplored and even unreported (as was often the case after 2008) that the recommended elements recognise that privacy must  be balanced with other rights, such as the right to freedom of expression and the freedom of the media to investigate and report on matters of public importance.

The report includes a suite of other recommended measures:

• Commonwealth legislation to replace existing state and territory laws regulating the use of surveillance devices, to include a ‘responsible journalism’ defence to protect journalists and media groups who make appropriate use of a surveillance device for journalism in the public interest; 

• extension of the existing powers of the Privacy Commissioner to investigate breaches of the Privacy Act 1988 (Cth) to allow investigations of complaints about serious invasions of privacy more generally, that is that do not involve breach of that law;

• and if a tort for a serious invasion of privacy is not enacted by the Commonwealth, that the law for an action for breach of confidence be strengthened enabling courts to award compensation for emotional distress, and that state and territory governments  enact uniform legislation providing for a statutory tort of harassment.

Victoria rejigs privacy law

An important step forward on legislating for protective security standards but national harmonisation of privacy principles is drifting even further over the horizon.

Victorian Attorney General Robert Clark introduced the long awaited Privacy and Data Protection Bill in Parliament last week.

The Bill merges the existing roles of Privacy Commissioner and the Commissioner for Law Enforcement Data Security to create a single Commissioner for Privacy and Data Protection with responsibility for the oversight of the privacy and data protection regime in Victoria. The Privacy and Data Protection Bill 2014 also addresses a number of the data security issues identified by the Victorian Auditor-General in his 2009 Report on Maintaining the Integrity and Confidentiality of Personal Information, including measures to ensure that government handles personal information securely and consistently.
The Bill provides for the development of a new protective data security framework for the Victorian Government. The Commissioner for Privacy and Data Protection will be responsible for issuing protective security standards as part of the framework.
The Commissioner will also develop guidelines to assist Government agencies to develop plans and help ensure changes to current processes are implemented smoothly.
The framework will include protective data security standards, protective data security plans prepared by public sector bodies to implement the standards, and specific law enforcement data security standards.
The Bill provides for departments and agencies to seek a determination about whether a particular use of personal information that it holds is authorised or required by law.
The Bill will also allow public sector organisations to seek approval for arrangements allowing them to handle or share personal information in ways that vary the application of certain information privacy principles, if that use of the information is clearly in the public interest.
“These reforms enhance privacy protections for individuals while giving public sector agencies greater clarity about the appropriate use of personal information,” Mr Clark said.

The Bill also re-enacts key provisions of the Information Privacy Act, including the Information Privacy Principles. Those principles are based on what were the IPPs in the Commonwealth Privacy Act, substantially changed along with other provisions such as the definition of personal information with effect from 12 March 2014.

Six years ago the Australian Law Reform Commission recommended that the principles it put forward for new Federal legislation "also be applied to state and territory government agencies through an intergovernmental cooperative scheme—so that the same principles and protections apply across Australia no matter what kind of agency or organisation is handling the information." 

In 2009 then minister Ludwig in announcing the Phase 1 Federal government response to the ALRC report undertook to

"work with the states and territories to harmonise privacy law across the nation. The first stage response will create a platform from which the Government can pursue national harmonisation through discussion with the states and territories. Ultimately, the aim will be a consistent set of privacy standards for the Commonwealth, state and territory public sectors, as well as the private sector. The Federal Government will be looking to the states and territories to repeal privacy laws including health privacy laws that apply to the private sector. Additional national consistency issues will be considered in the second stage response."

Harmonise? National consistency? Not in 2014 or anytime soon if Victoria is any indication.

Bruce Arnold has done the spadework on the provisions of the bill.

While the cat was away......

Glad of any input on the mice at play. Certain to be plenty that I missed.

As noted here, no positive vibe concerning Australian membership and participation in the Open Government Partnership.

The Federal Government Commission of Audit report ventured into the open government space recommending among many 'courageous' initiatives, the non controversial improvement in timely access to data and better arrangements for reuse. Read Craig Thomler's take. The administrative changes noted by Renai LeMay don't seem conducive to this.

The Commission also proposed the merger of various tribunals into the Australian Administrative Appeals Tribunal, the consolidation of  a number of federal ombudsmen into an over-arching ombudsman, and in what is the latest in a long running campaign by the Department  to run it into the ground, that the Australian Law Reform Commission be absorbed into the Department of the Attorney General.


Senator Joe Ludwig in The Guardian wrote "Here's why a strong FOI act matters: it keeps the bastards honest." (An easy shot from the opposition front bench of course, but he's right. Here is a comment on Labor's FOI legacy.) Nothing from the government on the recommendations arising from the Hawke FOI review so, who knows, they may still speak to some outside government before picking up the bits the public servants like.

No major developments regarding the mild tugging (so far) to get the government to table documents in response to senate orders concerning Operation Sovereign Borders although  things on production generally are not as bleak and uniformly negative as they were after the first few months of this parliament. This Senate Legal and Constitutional Affairs Committee report in which the non government majority recommend further examination of the NSW model for resolving issues concerning production of documents came in for limited debate on 6 March. The matter seems certain to be taken further. 

Cai-Wikipedia Commons

Evidence before the the NSW Independent Commission Against Corruption provided new depressing insights into the practice of the dark arts of influence peddling, and factional struggles within the Liberal Party. The Premier and the Minister for Police resigned, and fallout is continuing. Reform of political donation laws, lobbying rules, and disclosure requirements is in the air even before the Commission reports, although there are plenty of relevant Commission recommendations that go back years gathering dust in government in-trays.

The NSW mess has embroiled former Federal assistant treasurer Senator Arthur Sinodinis. As the Liberal Party at the Federal level has opposed previous attempts to do something more on political donations, interesting to see where things go from here in this and related areas. The Greens will introduce a bill next week to establish a Federal independent anti-corruption body. Flow on effects in other states seem likely.

Jack Waterford's account in The Canberra Times of what turned up in his ASIO file is good fun. You would like to think what he found recorded is just a reminder of the paranoia of earlier times, but who knows? The article is an extract from Dirty Secrets: Our ASIO Files, edited by Meredith Burgmann.

Arrived back in Sydney during Privacy Awareness Week and managed to get to a breakfast debate yesterday on aspects of the ALRC Discussion Paper "Serious Invasions of Privacy in the Digital Age." The proposal for a Commonwealth Act to establish a statutory cause of action for a serious invasion of privacy seems a lost cause before things go any further, given reported comment by Attorney General Brandis, reported in The Australian that "the Government has made it clear on numerous occasions that it does not support a tort of privacy." For those who don't give up easily on hopeless causes in the name of good public policy, submissions close 12 May. 

Australian Information Commissioner Professor McMillan outlined an alternative model based on amendments to the Privacy Act and the current regulatory system but this would involve amongst other major changes, removing current Privacy Act exemptions enjoyed by small business, the media and political parties and there isn't any likliehood of this government being interested in that either. Realistically, the far less satisfactory outcome 'leave it to the courts' is likely methinks.

(Addendum: Stilgherrian was there too, and wrote this account.)

Privacy law changes - losing ground or catching up?

Plenty of material out there from the Privacy Commissioner and others about the changes to the Privacy Act that came into effect on 12 March. 

The headline in Business Spectator - Privacy Act revisions:Little bark no bite - was a little off the mark on the 'bite', as the Privacy Commissioner has substantially extended enforcement powers should the commissioner chose to exercise them, including to require enforceable undertakings and pursue civil penalties of up to $1.7 million for serious or repeated privacy breaches. 

But as Paul Wallbank in that report points out, the changes have been a long time coming, in many respects are designed to fight yesterday's battles and "may do little to address genuine concerns in a world where data can be cross-matched from multiple sources and processed anywhere on the planet."

This announcement on 30 January 2006 started things, well sort of rolling:

I, Philip Ruddock, Attorney-General of Australia, having regard to:

• the rapid advances in information, communication, storage, surveillance and other relevant technologies
• possible changing community perceptions of privacy and the extent to which it should be protected by legislation
• the expansion of State and Territory legislative activity in relevant areas, and
•  emerging areas that may require privacy protection,

refer to the Australian Law Reform Commission for inquiry and report pursuant to subsection 20(1) of the Australian Law Reform Commission Act 1996, matters relating to the extent to which the Privacy Act 1988 and related laws continue to provide an effective framework for the protection of privacy in Australia.

The Australian Law Reform Commission after a mammoth consultation and review effort delivered a comprehensive report in 2008 - three-volumes, 74 chapters and 295 recommendations.

Six years on, eight years after the acknowledgement of 'rapid advances' we have legislation to give effect to what the then government described in its response as the 'first phase'  reforms. 

Many aspects are positive, particularly the attempt to build privacy protection into the DNA through documented policies and procedures that are potentially subject to performance assessment by the Commissioner at any time.

But many of the ALRC recommendations are buried in the mist of time. And what looked like 'rapid advances' to Philip Ruddock in 2006 look like first reports about the Wright brothers when considered in the light of developments since the commission reported in 2008. Drones for one probably weren't preying on his mind. 

Among the recommendations put aside for second and third stage consideration but appear to have sunk beneath the waves include the removal of the exemptions from the act enjoyed by businesses with turnover of less than $3 million (there are some exceptions) and by registered political parties, and changes to the conditions for continuation of the exemption for media organisations in the conduct of journalism. Another that got to first base but no further so far is mandatory data breach notification - legislation didn't make it through Senate in the last parliament and is yet to be heard of since. 

Another biggie was to be Federal government leadership on national harmonisation.

As Professor Barbara McDonald from the Australian Law Reform Commission told a parliamentary committee recently

"At the moment, a lack of uniformity means there’s insufficient protection of people’s privacy because people don’t know what’s against the law and what’s not.”

Don't hold your breath.

The government last year after much ducking and weaving over the recommendation to legislate a cause of action for a serious and unwarranted breach of privacy ( supported by the NSW and Victorian law reform commissions who reached the same conclusion years ago) wrapped this issue in yet another reference to the ALRC to inquire into the protection of privacy in the digital era, to look at "innovative ways in which law may reduce serious invasions of privacy in the digital era" and "the necessity of balancing the value of privacy with other fundamental values including freedom of expression and open justice."

The Commission is to report by June 2014. And the process starts all over again?