AccesstoRetainedDatainCivilProceedings
Submission toGovernmentConsultation
Prepared byAdamFletcherand Melissa Castan
January2017
Introduction
The CastanCentreforHumanRightsLaw thankstheAustralianGovernmentforthe opportunitytocommentons280(1B)andss 281(2)and(3)oftheTelecommunicationsAct
1997(Cth).TheexplanatorymaterialtotheTelecommunications(InterceptionandAccess)
Amendment(Data Retention)Bill2015,whichinsertedthesesections,statesthat their purpose istoensurethatdata whichhasbeen collectedunderthedataretentionregime (andnot for otherpurposes) cannot be disclosedbyserviceprovidersto litigants incivil proceedings,subjectto some exceptions.1Thisisconsistentwith otherdata retention regimes,suchasthose inmanyEuropeancountries.2
Wehavebeeninvitedtocommentontheoperation of thedatareleaseprohibition in the contextof the‘effectiveoperation ofthe civil justicesystem,ortherightsorinterests of parties tocivil proceedings.’Givenourexpertise, wewill focuson thequestion of howthe rightsof litigantsmaybest bebalancedwiththerights of those whosedata hasbeen requested.Inaddition, weendorsethesubmissionandrecommendationsof theAustralian PrivacyFoundation(Submission dated13 January2017).
Insummary,oursubmissionisthatthe prohibition should be maintainedwithoutexception. Personaldata3being retained(andreleased)fornationalsecurityandcriminalinvestigation purposes mayconstitutea proportionallimitationon therighttoprivacyunderinternational humanrightslawifrigorouslyjustified,butitsreleaseforotherpurposeswouldnotbea proportionallimitation.Inaddition,releasefor civillitigation purposesruns countertothe Government’sassurances that thedatawould only beused forinvestigating the‘most seriouscrime.’4TheAttorney-Generalspecificallystated‘[b]reachofcopyrightisacivil wrong.Civilwrongshavegot nothing todowiththisscheme.’5Thiswas thebasison which thepublic consentedto thedataretentionregimeundertheTelecommunications (Interceptionand Access)Act1979(Cth) (‘TIAAct’). Expansion of thenaturebeing
consideredwouldthereforebe anunwarrantedchange.
1Telecommunications(InterceptionandAccess)Amendment(DataRetention)Bill2015,ThirdSupplementary
ExplanatoryMemorandum,para167.
2SeeegSpanishLaw34/2002oninformationsocietyservicesandelectroniccommerce(Ley34/2002de
serviciosdela sociedaddela informacióny decomercioelectrónico)of11July2002,Article12.
3Seebelowforreasonswhymetadatashouldbeconsidered‘personaldata.’
4Seeeg‘Dataretentionlaws“can’tbeandtheywon’tbe”usedagainstpirates:Brandis,’Computerworld,
4November2014:
5See‘Brandiswrongoncopyrightanddataretention:IP expert,’Computerworld,4 November2015:
RightsofLitigants
InternationalCovenantonEconomic, SocialandCulturalRights
The InternationalCovenanton Economic,SocialandCulturalRights(ICESCR),to which Australiaisparty,requires protection of theright of eachindividual‘[t]o benefitfromthe protectionof themoralandmaterialinterestsresultingfrom anyscientific,literaryor artisticproductionof which heistheauthor.’6Thisright findsitsexpression inAustralia’s intellectualpropertyregime.Inthecaseof digitalcontentreproduction,themostrelevant law is the CopyrightAct1968(Cth).
Itis saidthat ‘[i]ntellectualpropertyregimesseektobalancethemoralandeconomicrights ofcreatorsandinventorswiththewiderinterestsandneeds of thesociety.’7Inthecontext of thepresentinquiry,this meansconsideringthebestbalancebetweentherightsof contentcreatorsandthoseof ISPsubscriberswhosedata arebeingretained.Thisbalancing considerationhasalreadyarisen inEurope,wherecontent creatorshaveattemptedtouse dataretentionregimesto accesssubscriberdatato suefor copyrightbreaches.
InPromusicæv TelefónicatheEuropean CourtofJustice(ECJ) consideredhow article17(2)
of theCharterofFundamentalRights oftheEuropeanUnion,which requirestheprotection ofintellectualproperty,shouldbebalanced againstprivacyrightsin theCharter(articles
7and8).TheCourt foundthatarticle 17 doesnot:
…requiretheMemberStatestolaydown anobligationtocommunicate personal data inordertoensureeffectiveprotectionof copyrightinthecontext of civil proceedings,in a situationin which a non-profit-makingorganisationof producersandpublishersof musicalandaudiovisual recordings hasbrought proceedings seekingan orderthata providerof internetaccessservicesdisclose to theorganisationtheidentitiesandphysical addresses ofcertainsubscribers, soas to enablecivilproceedings tobebroughtfor infringementofcopyright.8
TheECJreasoned that a‘fairbalance’mustbe struckbetweenthecompeting rights,taking intoaccounttheprincipleof proportionality.TheSpanishlaw in questionprovided:
Thedatashall beretained for usein thecontextofacriminal investigationor to safeguardpublicsecurityandnational defence,andshall be madeavailableto the courtsorthe publicprosecutor attheir request.9
6ICESCR[1976]ATS5,article15(1)(c).
7SeeChapman,AHumanRightsPerspectiveonIntellectualProperty,ScientificProgress,andAccesstothe
BenefitsofScience,PresentationtoAmericanAssociationfortheAdvancementofScience,Washington,1998:
8Promusicæv Telefónica,CaseC-275/06,JudgmentoftheCourt(GrandChamber),29 January2008,para70.
9Ley34/2002deserviciosdela sociedaddela informaciónydecomercioelectrónicoof11July2002,Article
12(3).
Theproportionalityofrestrictingprivacyrightsforthosepurposes wasnotquestioned,but theECJimplicitlyfound thatrequiringproductionofretained datatoprotectIPrightswasa disproportionaterestriction onotherfundamentalrights–toprotectionof personaldata andtoaprivatelife.10
InAustralia,theDallasBuyers’Club viiNetcasedemonstratedthatpartiesattemptingto enforcecopyrightclaimsareamongstthose whowould like accesstodataretainedunder theTIAActregime.11TheFederalCourt notedthat,despiteprivacyconcerns,
‘nothing…preventsthisCourt fromorderingtheISPs todisclose theinformation in question.’12HisHonour JusticePerramobserved:
[Therelevant]provisionsdemonstrate thattheprivacyofaccountholdersof ISPs isregarded bytheParliamentashavingsignificant value.Of course, the Parliament hasalsoaccorded significantvaluetotheowners ofcopyrightby enactingtheCopyrightActandbygivingthemtherighttosuefor infringement.13
The courtprotectedprivacy,but not becauseof this legislation.14Weacknowledgethatthe DallasBuyersClubcasewasaboutaccessto regulardata,not dataunderthemandatory regime,butbelieveitisstill relevant.
The UN CommitteeonEconomic, SocialandCultural Rights(CESCR) hasalso noted that IP rights ‘aregenerallyof atemporarynature,and canberevoked,licensedorassigned to someoneelse,’and that they‘primarilyprotect businessand corporateinterests and investments.’15Where thisis thecase,anditisnot a questionof,forexample,an author’s abilitytomaintainan adequate standardofliving,itmay beinferred fromCESCR’s reasoning thatIPrightsshould notoverridefundamentalhumanrights suchastherighttoprivacy.
Inour submission,and despitethelackofsimilarlybindingprivacyrightsinthe Commonwealth jurisdiction,similar reasoningshould beapplied in Australia.Further argumentsinrelationtoproportionalityandotherrightsaresetoutbelow.
InternationalCovenantonCivil andPoliticalRights
Partiesto civillitigation areentitledtosome fair hearingguaranteesunderarticle 14of the
InternationalCovenantonCivil andPoliticalRights (‘ICCPR’).In particular,they areentitled
10Promusicæv Telefónica,CaseC-275/06,JudgmentoftheCourt(GrandChamber),29 January2008,para70.
11SeeDallasBuyersClubLLCviiNet[2015]FCA317.
12Ibid,para84.
13Ibid,para85.
14Ibid,paras84-87.
15CESCR,GeneralComment17(2005),UNDocE/C.12/GC./17,para2.
torespectfortheprincipleof ‘equality ofarms,’sothat they donot facestructuralor proceduraldisadvantagescomparedwiththeiropponents.
Relevantly,atcommonlaw,partiesto litigationareentitledtoseektheproductionof documentsandotherdata relevanttotheircase.The ConsultationPaperreferstothe
‘longstanding powerof thecourtstoorderaccesstorelevant telecommunicationsdatain civil proceedings.’16However,thedatain questionhas historicallybeen retainedbyservice providersfortheirown purposes,includingcustomertrackingandnetworkmaintenance. Theextradata collectedundertheTIAActretentionregime shouldnot beaccessibleon the samebasis,becauseitisonly being collectedbyserviceprovidersforsecuritypurposes. This is datato whichneithercourtsnorlitigants wouldeverhavehadaccesswithoutthe retentionregime,soitdoesnotmakesenseto saythattheirproceedingsorrightsmaybe impaired iftheycannot accessit.
Theexplanatorymaterialforthe Telecommunications(InterceptionandAccess) Amendment(Data Retention)Bill2015states:
As the requirement for accessdependssubstantiallyonthefactsand circumstancesofeach individual civilproceeding, anylimitonthe availabilityof suchinformation wouldhavethe potential toprejudicethe legitimaterightsand interestsofclaimantsor respondentsinsuch proceedings.17
Withrespect,anyexceptioncarvedout undertheRegulationstowhichthisstatement referswouldactuallyalterthestatusquo withrespecttoequalityof arms,which is inappropriate.Aparty’s litigationstrategy shouldnot depend on access todata which has only beenretainedfornationalsecuritypurposes.Inaddition,theexplanatorymaterial itself noteselsewhere thattherelevant telecommunicationsdataisnotcurrently ‘available asan evidentiary sourceforeitherparty,’and that‘precludingparties’access toanew sourceofinformation’doesnotreduceorlimittheir currentaccess.18
Individualsalso havetherighttoseekandreceiveinformationunderarticle19(2)ICCPR, includinginformationheldbypublic authorities.19The UNHumanRights Committeehas stated that‘[t]hedesignationof suchbodiesmayalsoincludeotherentitieswhensuch entitiesare carryingoutpublicfunctions.’20Since the carriageprovidersare,undertheTIA Actretainingdataon behalfof theGovernment,itisprobablethatthedata will comewithin thedefinitionof‘dataheldbypublic authorities’ forthepurposesofarticle19. However,
theprimarypurpose ofextendingthecoverageof article19toinformationheldbypublic
16ConsultationPaper,2.
17Telecommunications(InterceptionandAccess)Amendment(DataRetention)Bill2015,ThirdSupplementary
ExplanatoryMemorandum,para404.
18Ibid,para169.
19SeeHumanRightsCommittee,GeneralComment34 (UNDocCCPR/C/GC/34),12September2011,para18.
authoritiesistogivepeopleaccesstotheirowninformation(‘personal data;his orher files’), rather than information onopposingparties tolitigation.21
Rights underarticle19 ICCPRmaybelimitedaccordingtoparagraph3,which provides:
3. Theexerciseof therightsprovidedfor in paragraph2of this articlecarrieswith it specialdutiesandresponsibilities. Itmaythereforebesubjecttocertain restrictions, but theseshallonlybe suchasareprovidedbylawandarenecessary:
(a) Forrespectof therightsor reputationsof others;
(b) Fortheprotectionofnational securityorof public order(ordrepublic),or of publichealthormorals.
Clearly,itwouldthereforebelegitimateunderarticle19(3)(a)tolimit litigants’ accessto
dataforthepurposesofprotectingtheprivacyand/orreputationof thoseto whomthe
datarelates.However,suchalimitation(as s280of theTelecommunicationsActeffectively imposes) will only be justified if itachievesaproportionatebalancebetweenthecompeting rights.
Concernshavebeen raisedby knowledgeablepartiesabouta‘honey-pot’forlitigants in
‘Family Law cases andallmannerofcommercial disputes.’22Onesubmission totheJCIS Inquirynoted that ‘[o]neinvestigationof Polish dataretentionlawsfound that‘moreand moreoftentrafficandlocationdata isrequestedby thepartiesin civildisputessuchas divorceand alimentarydisputes.’’23Thisisnot necessarilyindicative of theAustralian experience,but thereisalsoanecdotalinformationoncivildiscoveryrequestingdata disclosuresfrombeforetheTIAActretentionregimewasestablished.24ThelatestAGD reportontheoperationof theTIAActdoesnotmentioncivilproceedingsordiscovery.25
The submissionof theAustralianPrivacyFoundation(‘APF’)that‘[g]iven thevolumeof data that will be retainedbycarriersandISPs,therewillbeconsiderablepressureforsuch data
tobe accessedandusedforpurposesother thanlawenforcementandnational security’26is
compelling.As theAPFnotes,lawyerswillhave incentivestorequestaccesstopotentially
exculpate their clients’27–infact,theymightactuallybenegligentif theywereto overlook suchpotentialevidence.
21Ibid.
22SeeAdvisoryreportontheTelecommunications(InterceptionandAccess)Amendment(DataRetention)Bill
2014,ParliamentaryJointCommitteeonIntelligenceandSecurity,February2015,para6.98.
23Ibid,para6.101.
24SeeegGrubb,‘Dataretentiona boonforprivateinvestigators,’SydneyMorningHerald,4November2014
25SeeAGD,TIA Act,AnnualReport2014-15.
26SeeAdvisoryreportontheTelecommunications(InterceptionandAccess)Amendment(DataRetention)Bill
2014,ParliamentaryJointCommitteeonIntelligenceandSecurity,February2015,para6.103.
ThefactthattheGovernment,in draftingtherelevantTIAamendment,chose nottorestrict retaineddata accessto investigationsof criminalandnationalsecurityoffences(let alone themostserious categoryof offences) indicatesthatotherreasonsforaccesswere foreseen,andtacitlyacceptedaslegitimate.Inour submission,this isconsistentwith
article19rights.However,forthereasonsgivenbelow,thethreattoprivacypresentedby thereleaseofpersonal dataforthe purposes ofcivilsuitsislikelyto renderita disproportionatelimitationoncitizens’ rightsunderarticle17of theICCPR.
RightsofIndividualsWhoseDatais Retained/Requested
CommonwealthLaw
ThePrivacyAct1988(Cth)appliesto ISPs,requiringthemtocomply withtheAustralian PrivacyPrinciples (APPs)inrelationto retaineddata.28Theyarealsorequiredto notify customersabout thedata collection/retention,andthe purposesforit.29Penaltiesmaybe imposed forprivacybreaches.30
APP6, ontheuseordisclosureof personalinformation,providesthatdatacollectedforone purpose mustnotbedisclosedforanotherpurpose. Theexceptionstothisruleare consent of thepersonwhosedataitis,orwheredisclosureis ‘required orauthorised by orunderan Australianlawora court/tribunalorder.’31
Assuch,thePrivacyActis of noassistancetoapersonwhosemandatorily-retaineddata is beingrequested(by orderofthe court) forusein proceedings,civilorotherwise.
InternationalCovenantonCivil andPoliticalRights
Attheoutset ofanydiscussioninrelationtoprivacyeffects,it mustbenotedthatthe new blanketdata retentionregimeislikelyadisproportionateresponsetothe securitythreats facedbyAustralia.Anevenmoresweepingregimein theUShas provenrelatively ineffectivein avertingsuchthreats.32TheEUDataRetentionDirectivewasinvalidatedby theECJin 2014duetotheunjustifiedrestrictionsitplaced oncitizens’privacy andpersonal
dataprotectionrights.33Inaddition,theAustralian Parliament’sownJoint Committeeon
28SeeAGD,DataRetention:FrequentlyAskedQuestionsforIndustry,33.
29Ibid.
30Ibid,34.
31APP6.2(b).
32SeeegNakashima,‘NSAphonerecordcollectiondoeslittletopreventterroristattacks,groupsays,’
TheWashingtonPost,12January2014.
33SeeEUFRA,DataretentionacrosstheEU:
data-protection/data-retention.
HumanRights (‘JCHR’)found in 2015thatthenewregimerepresentedadisproportionate limitationon therighttoprivacy,evenwithlegitimatelawenforcementinterestsinmind.34
Theretentionregimemaythereforebean unjustified limitationonAustralians’ article17
ICCPRrightsin itsentirety.35However,thisbroaderargumentisoutsidethescope of the present consultationprocess,soweturn toaccessbycivillitigants.
Thedata tobe retainedcomesundersix categories:
1. Informationabouttheidentityof thesubscriberof, andaccounts, telecommunicationsdevicesandotherservicesrelatingto,therelevantservice provided;
2. The sourceof acommunication;
3. Thedestinationof acommunication;
4. Thedate,time and durationofa communication;
5. Thetypeof communication;and
6. The locationof theequipmentorlineused inconnection with acommunication.36
Itis likelythatallof thisdata would fall within the definitionofeither‘personalinformation’
or‘correspondence’for thepurposesofarticle17 ICCPR.
For thepurposesof civillitigation,suchdatapertainingto opposingpartiesmaybesought tovindicateacertainlegalclaim. However,dataon people whoarenot partytothe litigationmayalsobe sought,broadeningthethreatto privacy.
The riskof disproportionalitywhentheregimeisused forlaw enforcementpurposes was identifiedby theJCHRaftercarefulconsideration.Inour viewtheriskisfar greaterwhen therelevantdata isusedfor civillitigationpurposes. Giventhat safeguards,suchas
(a) limitations onthescope of datacollected,(b)mandatoryaccessnotificationand
(c) limitingtheperiodforwhichdatamust beretained,havenotbeen bolsteredsincethe
JCHR’s findings,it is verylikely thatpermittingaccess for civil litigation purposes would breachAustralia’s obligation underarticle17of theICCPR toprotectprivacy.
34SeeJCHR,TwentiethReportofthe44thParliament,March2015,45-54.
35SeefurtherMolnarandDaly,‘What‘safeguards’areinAustralia’sdataretentionplans,’TheConversation,
5March2015:
36AGD,DataRetention:GuidelinesforServiceProviders(July2015)
Conclusion
Insummary,wesubmit thatthe prohibitionson theuseordisclosureof
telecommunicationsdata forthepurposeof civilproceedingsins280(1B)andss281(2)and (3) of theTAshould be retained,and wedonot supportthereductionofthoseprohibitions bymeansofregulationsmade under s280(1B)(v)ands 281(2)(v).
Furtherweendorsethesubmissionandrecommendationsof theAustralianPrivacy Foundation (dated13 January2017).Thatis, itisrecommendedthatfurtherreviewof Part13of the TelecommunicationsActbe undertakento ensureit is fitforpurposein the contextof themasscollectionof telecommunicationsmetadata. Itwould also be
appropriatetotightentheprohibitionsonthedisclosure of telecommunicationsdataforthe
purposeofcivilproceedings,beyonds 280(1B)andss 281(2)and(3)of the TelecommunicationsActinordertolimit accessto onlyasubsetofthedata setspecifiedin s187AAof theTelecommunications(InterceptionandAccess)Act1979 (Cth).