Mind Your Own Data: The Future of Privacy Law in Australia

In fact, the recent passing of the Privacy and Other Legislation Amendment Act 2024 (Cth) marks the most significant reform to the Privacy Act 1988 (Cth) since the private sector amendments back in 2001. These new amendments to the Act introduce some major changes, like a new cause of action for serious invasions of privacy, expanded powers for the privacy watchdog, and new transparency requirements for automated decision-making.

But what do these changes mean in practice? For individuals, they signal a greater ability to understand, manage and prosecute how their data is used, potentially curbing the overreach of large technology companies. For businesses, these reforms may be a wake-up call to invest in stronger compliance frameworks and rethink their data and privacy practices.

Privacy Act 1988 (Cth) (Privacy Act)

Defamation Act 2005 (NSW) (Defamation Act)

Online Safety Act 2021 (Cth) (Online Safety Act)

Communications Decency Act, 47 U.S.C. § 230

European Convention of Human Rights

Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act)

Spam Act 2003 (Cth) (Spam Act)

Cybersecurity Act 2024 (Cth) (Cybersecurity Act)

• This case primarily considered the limits of property rights, with privacy law considerations being a secondary issue. The plaintiff was a racetrack owner who charged admission for race attendees. A neighbour, Taylor, allowed a radio station to build a platform on his property overlooking the track, from which race details were broadcast to the public, which led to a drop in track attendance and betting revenue. The Supreme Court denied the plaintiff’s application for an injunction on the grounds of nuisance, breach of copyright, and invasion of privacy. The High Court dismissed the appeal, and in its judgment, did not recognise a legal right to privacy.

Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd (2001) 208 CLR 199

• The dispute in this case arose when the ABC broadcast covert footage of possum slaughter at Lenah Game Meats’ abattoir, filmed through trespass, prompting questions about privacy as a legal basis for action, its application to corporations, and the balance with the constitutional freedom of political communication. The High Court found that privacy concerns must focus on the nature of the information, not how it was acquired or its value to the possessor, and introduced a test for privacy breaches based on whether the disclosure would be “highly offensive to a reasonable person.”

Jane Doe v Australian Broadcasting Corporation [2007] VCC 281

• The Australian Broadcasting Corporation reported on a sexual assault conviction, revealing the names of both the perpetrator and the victim, the location of the offence, and referring to it as “rape within marriage.” These disclosures breached legal restrictions against identifying sexual assault victims. The journalists involved admitted to the breach and issued a formal apology. The victim pursued legal action against the ABC, citing breaches of duty of care, statutory obligations, confidentiality, and privacy. The court found in favour of the plaintiff on all counts. The case renewed debate over whether Australian courts should formally recognise a common law tort of privacy.

Kalaba v Commonwealth [2004] FCA 763

• The plaintiff, Mr. Kalaba, alleged that the Commonwealth breached his privacy by requesting records about his wartime confinement without consent. He sought damages, claiming this and other acts of negligence led to his imprisonment following a protest. Justice Heerey in the Federal Court summarily dismissed the case, ruling that Australian law does not recognise a tort of privacy. He noted precedent against such a tort, Giller v Procopets, criticised the contrary stance in Grosse v Purvis, and concluded that the Commonwealth’s actions, even if erroneous, were at most a gratuitous effort to assist.

• The first major reforms resulting from the digital platforms review process received royal assent on December 10, 2024, implementing proposals from the government’s response to the privacy act review.
• Effective from December 11, the reforms include new powers for the OAIC, updated civil penalties, whitelisting powers for overseas jurisdictions, clarified information security obligations, and a new regime allowing the minister to make declarations about certain data breaches to reduce the harm to affected individuals.
• The process of obtaining injunctions in the media and intellectual property law spaces in Australia involves quick action by claimant lawyers, contacting duty judges, and arguing for interim injunctions to maintain the status quo while awaiting a court decision.
• In Australia, injunctions in defamation cases are rare due to the overarching concern for freedom of speech, unlike in intellectual property law where they are more common. Additionally, claimants face risks such as increased uncertainty in court approaches and potential costs if they decide to pursue litigation.
• The approach to addressing privacy issues is shifting towards a more proactive stance rather than being reactive, aiming to identify potential problems caused by new technologies or emerging risks before any actual harm occurs.
• This proactive approach to privacy allows for the commissioners to address privacy concerns before they escalate into serious incidents, offering an opportunity to prevent harm in the best-case scenario.
• The development of the Children’s Online Privacy Code will involve consultation with the industry. The UK age appropriate online standards are expected to influence the code, focusing on principles like privacy by default settings and not tracking children’s location, aligning with online safety efforts under the Online Safety Act to restrict exposure to inappropriate content and ensure age-appropriate online experiences for children.

• Look and adhere to the OAIC’s current guidance regarding consent requirements, especially in relation to cookies and personal information definitions outlined in the e-commerce directive. There is an emphasis on ensuring clear upfront disclosures to clients, as the duration of consent for marketing emails under the Spam Act and Privacy Act is a critical consideration.
• When drafting privacy policies or disclosures, try to exercise common sense and provide easily accessible short form summaries in addition to long, complex privacy policies, to minimise the chance of misleading consumers.
• It’s important to revise your consent forms to strike the right balance of detail while still remaining user friendly and accessible.
• Being curious, reading deeply, thinking critically, and asking questions are important for success in any field, according to the speaker. They believe that being curious and kind can lead to both learning and building relationships, which they consider essential for a successful practice.
• Exploring various areas of law as a law student or graduate can help you identify your passion and excitement for a particular field. It is important to choose an area of law that you are passionate about as your career is a long journey.
• Being curious, reading deeply, thinking critically, and asking questions are important for success in any field, as these skills will always lead to both learning and building relationships.

OIAC, Overview of the Australian Privacy Principles. 

Warren, Samuel D., and Louis D. Brandeis. “The Right to Privacy.” Harvard Law Review, vol. 4, no. 5, 1890, pp. 193–220.

Serious Invasions of Privacy in the Digital Era (ALRC Report 123), tabled on 3 September, 2024. 

Privacy is, without a doubt, one of the defining legal issues of the 21st century. Our personal data is being collected, analysed, shared and, occasionally, unlawfully accessed and disseminated, in ways that we could scarcely imagine even a decade ago. In response, governments worldwide, including our own, are grappling with how to update laws that often lag behind the realities of modern technology.

In fact, the recent passing of the Privacy and Other Legislation Amendment Act 2024 (Cth) marks the most significant reform to the Privacy Act 1988 (Cth) since the private sector amendments back in 2001. These new amendments to the Act introduce some major changes, like a new cause of action for serious invasions of privacy, expanded powers for the privacy watchdog, and new transparency requirements for automated decision-making.

But what do these changes mean in practice? For individuals, they signal a greater ability to understand, manage and prosecute how their data is used, potentially curbing the overreach of large technology companies. For businesses, these reforms may be a wake-up call to invest in stronger compliance frameworks and rethink their data and privacy practices.

To talk us through these reforms and the ongoing transformation of privacy law in Australia, we’re lucky enough to be joined today, not by one, but two amazing privacy law voices from Johnson Winter Slattery – Senior Partner, Sophie Dawson, and Hamish Lennon, Associate.

Sophie and Hamish, thank you both so much for joining me today on Hearsay.

 TIP: So Sophie’s just mentioned that defamation law allows platforms a grace period to take down potentially defamatory material when they’re made aware of it. These actually come from some recent changes to defamation law across Australia, which we spoke about recently on the show with Scott Traeger, partner at Lander and Rogers. That one’s episode 148 and it’s called ‘Rebuilding the Town Square: Innocent Dissemination and the New Defamation Regime.’ Check that one out if you’re interested in learning more about how Australian law regulates the moderation of content by online platforms. However, we should say that Sophie will make an important distinction between defamation and privacy later in the episode.

So in terms of the tort, it’s had a very long run up. I’ve talked to you about the whitelisting and how that is common sense. So the second point is in relation to the tort. The run up to the tort has been very long indeed. I don’t know whether you’re across this but there’s a fantastic article called ‘The Right to Privacy’ by Samuel Warren and Louis Brandeis, which was written in 1890 in the Harvard Law Review.

TIP:  So Sophie’s just mentioned Samuel Warren and Louis Brandeis’ seminal article published in the Harvard Law Review in 1890 called ‘The Right to Privacy.’ This was a ground breaking essay and is widely credited as the first formal advocacy for a legal right to privacy in the US. Brandeis, who was primarily credited with the authorship of the article, expanded on Warren’s concerns over the invasive coverage of personal lives in the press, famously defining privacy as the right to be let alone. The article traces the evolution of common law protections, noting how legal concepts expanded from physical and tangible protections to intangible rights like emotions and intellectual property. Now, Warren and Brandeis argued that rapid advances in technology, such as instant photos and mass circulation newspapers, made it necessary to adapt our legal principles to safeguard personal privacy. They proposed privacy as a distinct legal principle, asserting its foundations in property law and contractual obligations, whilst emphasising that existing laws on defamation and intellectual property were insufficient.

There’s been discussion in Australia for a long time about whether or not a tort of privacy exists and our case law is mixed. The case of Victoria Park Racing v Taylor (1937) was thought to stand in the way of a tort, and then of course, the High Court in Lenah Game Meats (2001) said that no, Victoria Park Racing doesn’t stand in the way of a tort, but they did not tell us whether or not there is one.

TIP:  Now we’ve just mentioned the Lenah Game Meats case. The full citation for that one is Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd (2001) 208 CLR 199, and that case marked a pivotal moment in Australia’s privacy law history, particularly when it comes to corporations and the potential recognition of a tort of privacy. The case also revisited another case, Victoria Park Racing and Recreation Grounds Co Ltd v Taylor (1937) 58 CLR 479. That one is often cited as denying the existence of a common law right to privacy. However, the court in Lenah Game Meats clarified that Victoria Park was not about privacy, but rather the allocation of rights to control information dissemination. Now, additionally, in Lenah Game Meats, the Court left open the possibility of developing a tort of unjustified invasion of privacy, and they emphasised that this kind of a development could only apply to natural persons and not corporations. This suggestion went beyond using equitable principles like unconscionability or property rights extensions to broadly establish privacy protections and uphold the human dignity approach to viewing privacy. The dispute in Lenah Game Meats arose when the ABC broadcast footage of possum slaughter at Lenah Game Meats abattoir, which was filmed covertly through trespass. The judgment highlighted three key issues. The first, whether privacy could form a legal basis for action. Second, whether such protections extended to corporations and how these fit in with the implied constitutional right to political communication, and lastly, the majority concluded that privacy concerns must be rooted in the nature of the information itself, not solely in the method of its acquisition or its value to the possessor. The judgment also explored existing characteristics of privacy law in Australia. So, Chief Justice Gleeson noted that not all actions conducted on private property are inherently private, and privacy must involve a degree of offensiveness to a reasonable person of ordinary sensibilities. In a similar vein, Justices Gummow and Hayne said that privacy protections derive from personal autonomy and dignity, values which are irrelevant to corporations. However, Justice Callinan suggested that privacy could align with property rights, allowing corporations some measure of protection under specific circumstances. However, even he acknowledged that this extension was tentative and contingent on recognising privacy as a property-based right.

Now, the High Court’s reasoning seems to reflect a bit of caution in adopting privacy principles from other jurisdictions, such as the US, where privacy is categorised into distinct forms of interference. The Court avoided committing to any specific approach, acknowledging the tension between protecting private information and upholding freedom of political communication. Now, the oft-cited obiter dicta test for determining whether something was a breach of privacy that came from Lenah Game Meats is whether the disclosure of the information would be “highly offensive to a reasonable person.”

Since then, case law has been mixed on whether there’s a tort or not. There’s case law to the effect that yes, there is a cause of action, for example, Doe v ABC. Justice Hampel down in Victoria said, “yes there’s a cause of action, both in equity like the UK and also a common law one.” And then we’ve had other cases like Kalaba v Commonwealth, where the Court said, “no, there’s no cause of action for privacy,” and the High Court has not resolved it. So this has been under consideration for a very long time.

TIP: So, Sophie has also just mentioned a few other cases. The first one, Jane Doe v Australian Broadcasting Corporation [2007] VCC 281. In that case, ABC Radio had broadcast the identity of a victim of sexual assault, which violated a statutory disclosure. Judge Felicity Hampel, in the Victorian County Court, took the bold step of declaring that a tort of invasion of privacy exists in Australian law. Although arguably, this wasn’t strictly necessary. There were already other legal grounds to hold the ABC accountable. The plaintiff in that case was then awarded damages for breach of statutory duty, breach of confidence, and an unusual finding that the ABC owed a duty of care.

The other case that Sophie mentioned was Kalaba v Commonwealth [2004] FCA 763. In that case, Mr. Kalaba alleged that the Commonwealth had breached his privacy by requesting records about his wartime confinement without consent. He sought damages, claiming this and other acts of negligence led to his imprisonment following a protest. However, Justice Heerey in the Federal Court summarily dismissed the case, ruling that Australian law does not recognise a tort of privacy. He noted precedent against such a tort, Giller v Procopets, criticised the contrary stance in Grosse v Purvis, and concluded the Commonwealth’s actions, even if erroneous, were at most a gratuitous effort to assist.

Professor Barbara McDonald published her report for the ALRC in 2014 recommending a tort. So for all those reasons, it’s not surprising. At the same time, the reason that it is a little surprising is that on each of those previous occasions where it’s been considered, and it has been considered at length, governments have ultimately decided not to enact a statutory tort. So this is the first time that it’s actually resulted in law, and there are good reasons why it hasn’t resulted in law in the past because there is a multitude of statutory restrictions on publication which protect private information, such as the identity of sexual assault victims and the identities of children involved in criminal proceedings. It’s an offence to breach them. And there are also surveillance laws and the law of trespass, which protect against intrusion upon seclusion, which is the other aspect of the tort. Professor McDonald argued that the tort would cover any gaps between these laws, but there are many people who have argued that there’s no demonstrated need for a gap filler of that type.

In fact, if you go back to her 2014 report, she says, “oh look, perhaps our media doesn’t publish as intrusive material as their UK counterparts, that maybe there are complaints in the background that are being settled or something.’ The media have said, “oh look, there’s just no demonstrated need for this in the past.” But the outcome that has resulted on this occasion, is that we’ve ended up with a tort. It includes a journalism exemption, which is really important to protect freedom of expression.

TIP: The Australian Law Reform Commission, spearheaded by Professor Barbara McDonald as the Commissioner for the Inquiry, published a report in 2014, titled ‘Serious Invasions of Privacy in the Digital Era.’ The report recommends the creation of a statutory tort for serious invasions of privacy through a new Commonwealth Act. The tort is designed to address intentional or reckless invasions that can’t be justified as being in the public interest. An example of this would be sharing private medical records or explicit images without consent. The ALRC stressed that while privacy is a fundamental right, it must be balanced with freedom of expression and press freedoms. The report outlined the need for statutory action, noting gaps in the protections at the time, reluctance to litigate novel claims under common law and the advantages of legislative clarity and consistency over case law. In making its report, the ALRC also considered international privacy protections and past Australian inquiries, which showed support for a statutory cause of action. Statutory reform, the ALRC argued in its report, provides clarity, faster resolution, and flexibility to address privacy issues arising from changes in technology.

In the UK, the cause of action’s had a big impact on the media, which is regularly being prevented, by way of injunctions, from publishing information about matters such as the identity of suspects in criminal cases, which can be useful to bring forward witnesses. Changes to the exemption made in the Senate process made sure that the distributors of material published by journalists are covered by the exemption. So there’s still going to be some uncertainty about the edges of that exemption, which we can talk about in a little while. So there are surprising and less surprising aspects of this reform.

TIP:  Now, Sophie has just mentioned the Sir Cliff Richard case. Now, Sophie has just mentioned the Sir Cliff Richard case. If you’re interested, the full citation for that one is Sir Cliff Richard OBE v The British Broadcasting Corporation and The Chief Constable of South Yorkshire Police [2018] EWHC 1837 (Ch). In that case, the UK High Court addressed important issues related to privacy, and in particular, how media outlets report on criminal investigations before charges are brought. This case arose from the BBC’s live coverage of a police search at Sir Cliff Richard’s home in connection with historical sexual abuse allegations under Operation Yewtree. Richard was never arrested or charged, but he brought a privacy claim against both the BBC and the police.

In that case, Justice Mann ruled that individuals under police investigation have a reasonable expectation of privacy, particularly when they have not been charged with a crime. This expectation is based on the stigma attached to being investigated and the subsequent potential harm to one’s reputation. Even though a search warrant had been executed and the police action was visible, this did not automatically override individual privacy rights.

In assessing whether the public interest justifies the publication of private details, factors to be considered include whether the matter contributes to a public debate, the individual’s status, their prior conduct, and the manner in which the information was obtained.

In considering these factors, the court found that while the investigation itself, as it dealt with sexual abuse allegations, was of public interest, the specific identity of Richard as the subject of the investigation did not necessarily contribute to public debate. The judge noted that Richard’s public figure status did not diminish his privacy expectations during a criminal investigation, and especially before charges were filed. The BBC’s sensationalised reporting and the manner in which the information was obtained, which was via a journalist’s implied threats, also weighed against the media’s defense.

On this public interest aspect of it, it’s important to note that the stuff about freedom of expression isn’t just media rhetoric in Australia. It’s actually law and probably constitutional law. So in the context of reporting what happens in the court, I don’t know whether you’re familiar with it, but Justice Spiegelman years ago wrote a fantastic article called ‘Seen To Be Done’, which was arguing that essentially it’s constitutionally protected, the open justice principle. And the reason for that is essentially that it’s important for the integrity of courts that not only the media exposes any missteps or wrongdoing on the part of judicial officers, but more importantly, that the public know that they’re watching, and so that there’s public confidence in the judicial system. And of course, in the political context, we have the implied constitutional freedom of speech in relation to government and political matters, which is based on the same concept that essentially, journalists’ role in keeping our institutions free of corruption and in supporting public confidence in those institutions is critical for our constitutional system to work. So again, I think those constitutional principles will also come into play in some of the matters that might arise in relation to the tort.

TIP:  Now, Sophie’s just mentioned Justice Spigelman’s keynote address called ‘Seen to be Done: The Principle of Open Justice’. In that address, Spigelman discusses the principle of open justice, especially in relation to media coverage of judicial proceedings. Open justice is the idea that not only should justice be done, but it should be seen to be done, promoting transparency and public confidence in the judicial system.

Justice Spigelman asserted that the media plays a critical role in the principle of open justice. By reporting on court proceedings, the media ensures that justice is conducted transparently, providing a check on judicial power and maintaining public confidence in the system.

However, Justice Spigelman also notes that the media’s power is not without limits. Media outlets may sometimes act irresponsibly, motivated by commercial gain rather than public good, which can undermine the principle of open justice. Because of this, courts must navigate the tension between open justice and the protection of other rights, such as the right to a fair trial and the right to privacy. And although the media’s role in ensuring transparency is vital, it does have to be weighed against those other rights, particularly where there is a risk that the media’s actions can harm individual reputations or compromise the fairness of a trial.

And so these infringement notices for each contravention of the provisions can be up to $19,800 for a body corporate, which is other than a publicly listed corporation and up to $66,000 for a publicly listed company. And so these sorts of infringement notice powers will allow the commissioner to take action without having to engage in more protracted litigation. Similar to what we’ve seen with the Spam Act. I know, Sophie, you mentioned the other day, I think it’s been a lot more active in terms of issuing infringement notices and releasing spam issues because of the infringement notices power.

If you’re an Australian legal practitioner, you can claim one continuing professional development point for listening to this episode. Whether an activity entitles you to claim a CPD unit is self assessed, as you know, but we suggest this episode entitles you to claim a substantive law point. If you would like more information on claiming and tracking your points, head on over to the Hearsay website.

Hearsay the Legal Podcast is brought to you by Lext Australia, a legal technology company that makes the law easier to access and easier to practise, and that includes your CPD.

Now, before you go listeners, we’d like to ask you a favour. If you’re enjoying Hearsay the Legal Podcast, please leave us a Google review. It helps other listeners to find us, and that ultimately keeps us in business.

Thanks for listening, and we’ll see you on the next episode of Hearsay.