David Rolph

Associate Professor

Room 418
New Law Building F10
Eastern Avenue
The University of Sydney
NSW 2006 Australia / T +61 2 9351 0253
F +61 2 9351 0200
E
sydney.edu.au / ABN 15 211 513 464
CRICOS 00026A

3 November 2018

Privacy and FOI Policy Branch

Department of the Prime Minister and Cabinet

1 National Circuit

BARTON ACT 2600

Dear Sir / Madam,

Submission on the Commonwealth Statutory Cause of Action for Serious Invasion of Privacy Issues Paper

Please find attached my submissionabout the Commonwealth Statutory Cause of Action for Serious Invasion of Privacy Issues Paper.I have addressed some, but not all, of the questions raised in the issues paper.

Please do not hesitate to contact me if you require clarification of any of the material contained in my submission.

Yours faithfully,

Associate Professor David Rolph

Room 418
New Law Building F10
Eastern Avenue
The University of Sydney
NSW 2006 Australia / T +61 2 9351 0253
F +61 2 9351 0200
E
sydney.edu.au / ABN 15 211 513 464
CRICOS 00026A

Do recent developments in technology mean that additional ways of protecting individuals’ privacy should be considered in Australia?

Recent developments in technology may provide the impetus for considering additional ways of protecting individuals’ privacy. They may make the problems posed by the inadequate protection of privacy under Australian law more acute. However, even without these recent developments in technology, there is sufficient reason to addressing the issue of privacy protection under Australian law.

Is there a need for a cause of action for serious invasion of privacy in Australia?

In principle, there is a need for a cause of action for invasion of privacy in Australia. However, there are real problems – both practical and in principle – that need to be considered when developing and implementing a cause of action for invasion of privacy in Australia. These problems inform the manner in which such a cause of action might be introduced, as well as the form and substance of any such cause of action. As such, caution is advisable.

The principled and practical arguments for and against a cause of action for invasion of privacy are well-known and well-rehearsed. I wish to make three points relevant to the issue of whether there is a need for such a cause of action in Australia.

First, the issue of whether Australian law should recognise, in some form, a direct and comprehensive right to privacy arises from a particular historical context. Historically, the common law took a bifurcated approach to the protection of dignitary interests. It protected reputation – essentially the plaintiff’s public self[1] – highly but did not protect privacy. I would argue that this inverts the proper value that should be ascribed to these dignitary interests.[2] There is a clear public interest in discussing a person’s public self. Thus, it is axiomatic that defamation law seeks to balance protection of reputation and freedom of expression.[3] The public interest in invading a person’s privacy is less self-evident. As a matter of principle, privacy should be more highly valued than reputation. A cause of action for invasion of privacy will help correct the common law’s anomalous and haphazard treatment of dignitary interests.

However, it is vital that the development of a cause of action for invasion of privacy consider carefully the existing legal protections of dignitary interests and the historical development that led to them. A cause of action for invasion of privacy should not be considered in isolation. Because of the interconnection of privacy and reputation as dignitary interests centred on the plaintiff’s persona, the impact of such a cause of action on defamation law is imperative. I am concerned that insufficient regard has been given in the reform process to this potential impact. The reform proposals draw heavily upon defamation law without considering in detail the impact of a cause of action for invasion of privacy on the operation of defamation law. In my view, further detailed consideration of this complex issue is required. The issue of whether Australian law protects privacy too little and reputation too much, as suggested by Sir Stephen Sedley in his 2006 Blackstone Lecture, ‘Sex, libels and video-surveillance’ in the context of English law, is one which should be addressed holistically in the context of this reform process. It would be an undesirable outcome of this reform process if plaintiffs were given an additional right to sue for invasion of privacy without consideration being given to a recalibration of interests in the tort of defamation.

Secondly, I am not persuaded by arguments that Australian law already provides adequate, albeit indirect, protection of privacy and that all that may be required is that identifiable gaps be filled. Such arguments contain their own problems. In my view, privacy is an interest worthy of direct legal protection. The causes of action indirectly protecting privacy are not always adequate at achieving this incidental aim. This is understandable, given that these causes of action, such as trespass to land and breach of confidence, are intended directly to protect other interests. Relying upon existing causes of action to protect privacy might result in a deserving plaintiff having no legal recourse, because they do not provide comprehensive coverage. Alternatively, it might result in a plaintiff being granted relief on a basis wholly unrelated to the actual interest that has been infringed. Kaye v Robertson is a clear example of this problem: Gorden Kaye’s real interest in the proceeding was not The Sunday Sport’s false and malicious interference with his valuable right to grant an exclusive interview but rather the egregious intrusion upon his privacy as he recuperated in hospital.[4] Finally, relying upon existing causes of action to protect privacy might result in their distortion. The development of the equitable cause of action for breach of confidence in the United Kingdom into a ‘tort of misuse of private information’ is an example of this.[5] This development has not provided comprehensive protection of personal privacy[6] and has altered the nature and structure of the existing cause of action for breach of confidence.

Thirdly, I am not persuaded by arguments that a cause of action for invasion of privacy should not be developed because privacy as a legal interest is too difficult to define. This conflates the issues of whether privacy is worth protecting as a legal interest and how one might protect it. An analogy might be drawn here with the tort of negligence. It is difficult to define what negligence is but that has not deterred courts from imposing liability on defendants for a failure to take reasonable care. Over the decades, courts have refined what constitutes negligence. This has proceeded upon the basis that defendants should be held liable for harm caused by their unreasonable conduct. Such harm can be caused in diverse ways. The test for negligence has not remained static since the House of Lords’ landmark judgment in Donoghue v Stevenson.[7] In a similar way, privacy may be difficult to define and may be invaded in myriad ways but this does not mean that it should not be protected. The threshold issue is whether privacy is worth protecting as a legal interest. How then one protects privacy as a legal interest arises for consideration. The fact that the concept of privacy is not static should not be viewed as an insuperable barrier to providing legal protection for it. It is possible to articulate workable, pragmatic tests for what is private. Gleeson CJ’s formulation in Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd, referred to below, is an example.

Should any cause of action for serious invasion of privacy be created by statute or be left to development at common law?

In my view, this is a finely balanced issue about which reasonable minds can differ. I have a mild preference for a statutory cause of action for invasion of privacy, rather than allowing the courts to develop some form of direct, comprehensive privacy protection.

There are several reasons which lead to support a statutory cause of action. First, it is by no means certain that the courts will develop a cause of action for invasion of privacy. It is worth noting that the High Court of Australia’s decision in Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd was decided over a decade ago and there have only been two subsequent decisions of inferior courts finding that a cause of action for invasion of privacy forms part of the common law of Australia.[8] Judicial development of direct privacy protection might be slow, which would be prudent, or it might not occur at all, which might be undesirable. Secondly, Australian courts might follow the lead of United Kingdom courts and adapt the equitable cause of action for breach of confidence as a means of directly protecting personal privacy. This approach has a number of limitations. Breach of confidence is directed at protecting information. Not all forms of invasion of privacy relate to the disclosure of private information. It would undesirable to encourage potential plaintiffs to attempt to ‘shoe-horn’ their claims into breach of confidence or to limit the legal protection of privacy to confidential information, broadly defined. Privacy and confidentiality are not necessarily co-extensive concepts. Breach of confidence, as an equitable cause of action, has a predisposition towards granting injunctive relief, in order to preserve the subject matter of the proceedings. In the Australian context, the availability of appropriate heads of damages for breach of confidence may prove problematic. Thirdly, a statutory cause of action allows for a broad consideration of issues and implications, which the common law method does not permit.

There are limitations to a statutory cause of action. The most significant one is that, if the consideration of the issues and implications of the particular form of language is not sufficiently thorough, there can be unintended consequences. Thus, caution is required about the form of language used and the implications that might flow from it.

The reason I have only a mild preference for a legislated cause of action is that, whether such a cause of action is created by parliament or by the courts, a judge will ultimately have to apply legal principles which will be cast in broadly similar terms. If a legislated cause of action is created, it will necessarily be in broad, open-textured terms, reflecting the breadth of the concept of privacy. A judge in applying the statutory language of the cause of action will presumably be required to decide the same issues as a judge developing a cause of action on a case-by-case basis, such as whether the plaintiff had a reasonable expectation of privacy in the circumstances of the case, or whether the defendant’s conduct was highly offensive to a reasonable person of ordinary sensibilities, or whether there was a countervailing public interest on the defendant’s part justifying his or her conduct. The judicial determination of these issues will be decisive, irrespective of the source of law that presents these questions.

Is ‘highly offensive’ an appropriate standard for a cause of action relating to serious invasions of privacy?

As Gleeson CJ suggests in Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd:

‘[t]he requirement that disclosure or observation of information or conduct would be highly offensive to a reasonable person of ordinary sensibilities is in many circumstances a useful practical test of what is private.’[9]

As it is not possible to know in advance how a statutory cause of action for invasion of privacy will be applied in practice and particularly if there are concerns that minor or trivial claims might be too readily established, it might be prudent to impose a test in the terms suggested by Gleeson CJ, rather than the less rigorous test of whether the plaintiff had a reasonable expectation of privacy.

Is the inclusion of ‘intentional’ or ‘reckless’ as fault elements for any proposed cause of action appropriate, or should it contain different requirements as to fault?

If proof of damage is not required, then the proposed cause of action must be limited to intentional and reckless conduct. If proof of damage is required, then the proposed cause of action might extend to negligent invasions of privacy. What should obviously be avoided in a statutory cause of action for invasion of privacy is the imposition of strict liability, which is the basis of liability under defamation law.

Are the remedies recommended by the A.L.R.C. necessary and sufficient for, and appropriate to, the proposed cause of action?

A significant issue concerning remedies for invasion of privacy which needs further consideration is the availability of an interlocutory injunction to restrain an apprehended invasion of privacy. The High Court of Australia recently confirmed, in Australian Broadcasting Corporation v O’Neill, that an interlocutory injunction to restrain the publication of defamatory matter is governed by general equitable principles but that the application of these principles is informed by considerations peculiar to defamation claims.[10] Prominent amongst these considerations are the common law’s historical aversion to prior restraint and the importance of freedom of expression.[11] The effect of these considerations is that, whilst it is possible in principle for a plaintiff to obtain an interlocutory injunction in a defamation claim, it is extremely rare in practice.[12]

The introduction of a cause of action for invasion of privacy has the potential to disturb the balance struck in defamation law between the protection of a plaintiff’s dignitary interest and the public interest in freedom of expression. If a plaintiff is able to obtain an interlocutory injunction to restrain an apprehended invasion of privacy, this might provide an incentive to the plaintiff to frame a claim that would ordinarily be pleaded in defamation as a claim for invasion of privacy, in order to avoid the restrictive approach to injunctive relief in defamation. Insufficient attention has been given to this important issue.[13] In my view, it would be undesirable for plaintiffs to be able to restrain the publication of an arguably defamatory matter as an invasion of privacy. This would subvert the balance of interests defamation law has struck for centuries. Careful consideration should be given to whether any cause of action for invasion of privacy should be consistent with defamation. This would require a predisposition against injunctive relief (although this would not be absolute, just as it is not absolute in defamation law), with the proper remedy being damages.

Reputation and privacy cannot be treated as wholly separate interests, given that they are merely different aspects of the plaintiff’s persona. Thus, a consistent approach to the availability of injunctive relief is desirable. I am not persuaded by arguments that defamation can be vindicated by an award of damages, whereas privacy, once invaded, can never be restored by compensation. This is an assertion about how defamation law ought to operate in practice. Whether defamation law is in fact as efficacious as this view suggests is open to serious question. Approaching this issue from another perspective, if a plaintiff, knowing in advance that his or her privacy was going to be invaded, were given the option of obtaining an injunction prior to publication or receiving an award of damages at some later date, the plaintiff would presumably elect for the former. Equally, if a plaintiff, knowing in advance that he or she was going to be defamed, were given the same options, he or she would presumably want an injunction but the common law, as a matter of principle, has consistently made giving effect to such a preference very difficult. It is difficult to discern why a plaintiff’s preference for a remedy would be given controlling effect in relation to an invasion of privacy but not in relation to defamation.

Should the legislation prescribe a maximum award of damages for non-economic loss, and if so, what should that limit be?

If a statutory cause of action for invasion of privacy were to be introduced, it would be prudent to impose a cap on damages for non-economic loss. This cap should be set at a level between those imposed for personal injury and defamation claims.

The V.L.R.C. suggests that a cap on damages for invasion of privacy is unnecessary. It points out that awards of damages in the United Kingdom have been modest. This area of law is only a comparatively recent development in the United Kingdom. It is not at all certain that awards of damages will remain at their current, relatively low level. By generating litigation and by heightening awareness of media intrusion upon privacy, the recent News of the World phone hacking scandal may provide a direct or indirect impetus for an increase in awards of damages in such claims. (There have, of course, been out-of-court settlements in excess of the more modest sums awarded in cases litigated to final judgment.) With a developing area of law, such as invasion of privacy, where there are concerns that excessive awards of damages might be awarded by courts, it would be prudent to impose a cap on damages at the outset.

If a cap on damages for non-economic loss for invasion of privacy were not imposed, it would provide plaintiffs with an incentive to frame defamation claims as privacy claims in order to avoid the cap on defamation damages. Again, the consistent treatment of dignitary interests and the need to avoid distortions in the law of defamation support the imposition of a cap on damages in privacy claims.

The level at which caps on damages are set for different causes of action reflect the relative importance the legislature ascribes to the underlying interests being protected by those causes of action. By setting the cap on damages for non-economic loss in personal injury claims at a significantly higher level than those on damages for non-economic loss in defamation claims, the legislature has signalled that personal injury claims are more serious than defamation claims, as well as attempting to resolve, in a pragmatic way, the long-standing and vexed relationship between damages for these causes of action.[14] The N.S.W.L.R.C. proposes a statutory cap on damages for non-economic loss for invasion of privacy of $150,000, below that imposed for defamation. In my view, this inverts the relative value that should be ascribed to reputation and privacy as legal interests. A statutory cap on damages in privacy claims should be set a level between those imposed in personal injury and defamation claims. This might be achieved by setting the statutory cap at an intermediate point between existing maximum awards for non-economic loss for personal injury and defamation claims or by giving some consideration as to whether the statutory cap for defamation claims should be reduced.

If a maximum award of damages for non-economic loss for invasion of privacy were to be imposed, provision should be made for its indexation, as the N.S.W.L.R.C. recommends, similar to the mechanism included in the civil liability and the defamation legislation.[15] In addition, a court should be given a discretion to award aggravated damages in excess of the cap in appropriate circumstances, as is the case for defamation claims.[16]