Australian privacy law reform: a statutory tort for serious invasions of privacy soon?

The prospect of a statutory tort of serious invasion of privacy has been on the horizon for several years. Although specific legislation implementing this tort is yet to be released, the Australian Government has supported its introduction. In this article, we consider the potential form of a statutory tort of serious invasion of privacy, and its possible implications. Businesses should take immediate steps to assess whether any business practices are likely to be affected by the introduction of this new law.

The evolution of a statutory tort of serious invasion of privacy

Australian common law has not developed a tort of privacy, although the High Court of Australia has left this possibility open (in Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd [2001] 208 CLR 199 and Smethurst v Commissioner of Police [2020] HCA 14). Against this background, there have been various law reform processes considering whether a tort of privacy should be introduced.

Critically, in 2014 a particular model for a statutory tort was recommended by the Australian Law Reform Commission (ALRC) in its report, Serious Invasions of Privacy in the Digital Era.

The Attorney General's Department recently conducted a review of the Privacy Act 1988 (Cth) and related privacy issues and published its findings on 16 February 2023. Those findings included a recommendation that "individuals have more agency to seek redress for interferences with their privacy through the courts", including by the introduction of a statutory tort of serious invasion of privacy, based on the ALRC Model.

In the Government Response: Privacy Act Review published on 28 September 2023, it agreed in principle to introduce the statutory tort for serious invasions of privacy. As recently as May 2024, Attorney-General Mark Dreyfus KC MP indicated that privacy reforms would be brought forward to August 2024.

The Government Response acknowledged that current privacy legislation provides limited protections for individual privacy, and at present there is no recourse for individuals where privacy is invaded in circumstances which fall outside the scope of the Privacy Act. While other areas of law may assist, there are gaps. The equitable action for breach of confidence may be used to protect breaches of privacy in certain circumstances, but requires the relevant information to be imparted in confidence. Defamation law does not provide protection where information used is true but nevertheless private, or where information is untrue but the use is not defamatory.

ALRC model of a tort of serious invasion of privacy

The ALRC Model, as restated in the Privacy Act Review, outlined the following proposed "essential features" of a possible tort of serious invasion of privacy.

The ALRC Model is a relatively technical cause of action. It will require a court to assess multiple complex questions of fact and law before liability is established. Liability will largely turn on the specific facts and circumstances of each relevant dispute involving the tort, as the ALRC Model accommodates many competing considerations in the determination of liability. This multitude of considerations are of considerable nuance; by way of illustration, as to whether the plaintiff has a reasonable expectation of privacy in the particular circumstances of an intrusion upon seclusion, the ALRC Report states:

"A locked solid door suggests that those in the room behind the door expect complete privacy, but a glass door involves different expectation."

In other words, it is very difficult to anticipate whether all situations where there has apparently been a breach of privacy will actually give rise to a viable cause of action. Not all data breaches, for example, will be actionable, if the ALRC Model is ultimately adopted (see "Implications for businesses" below).

The 2014 model provides a variety of remedies including damages (including for emotional distress), account of profits, injunctions, correction and apology orders and declarations. It also provides for a number of defences:

• lawful authority;
• where the conduct was incidental to defence of persons or property;
• consent;
• necessity;
• absolute privilege;
• the publication of public documents; and
• fair reporting of public proceedings.

What businesses should be thinking to prepare for a statutory tort for serious invasion of privacy

Plainly, a right of action over serious invasions of privacy, has the potential to impact Australia's economy across many sectors. It is useful to consider the potential implications of the tort, by way of example; perhaps the most obvious are the media sector and in businesses dealing with information and data.

Data businesses

In the context of businesses dealing with personal information and data, this cause of action may supplant the disparate causes of action that are currently pursued in class actions concerning recent data breaches. However, it is very difficult to predict whether a particular data breach is likely to give rise to a viable cause of action in the ALRC Model, because of the manner in which the ALRC Model proposes to deal with fault, that is the invasion must have been committed intentionally or recklessly – mere negligence is not sufficient. In many instances where there has been a data breach, there will be no intention to disclose the relevant data, or indeed, no recklessness. Therefore, a plaintiff may not be able to pursue a claim for a serious invasion of privacy pursuant to a tort in the form of the ALRC Model; while the impugned conduct of the entity holding the data of the victim of the breach may rise to the level of negligence, this would not be enough. This is expressly acknowledged in the ALRC Report, and it is noted that there may be other rights of action available in respect of a data breach (for example, negligence, breach of contract, or liability under the Australian Consumer Law) and that there will often be penalties applicable pursuant to the Act. However, the ALRC Report also notes:

"In many situations involving serious data breaches, for example, the risk may be well-known in the industry so that it may be obvious or provable that the defendant was aware of the risk, providing the basis for a finding of recklessness, or even intent on an imputed basis."

Media

The media sector is also likely to be particularly affected. In submissions made to the Privacy Act Review, several news media businesses highlighted concerns that the statutory tort would discourage journalists from investigating and reporting on personal stories, concerns heightened by the fact that freedom of speech is not a protected right in Australia.

The ALRC considered the impact of the tort on the media industry and public interest reporting and explicitly recommended that the balancing exercise referred to above be included as an essential element of the tort as opposed to a defence, highlighting the importance of this feature. It listed freedom of speech, freedom of the media, public health, and safety and national security as relevant public interest considerations to be taken into account when conducting this exercise. Likewise, the Government's response to the Privacy Act Review stated that "further consultation should be undertaken with media organisations in relation to additional safeguards for public interest journalism when implementing the reform."

The essential features of the ALRC Model have multiple touchpoints with the activities of news media, meaning that media businesses will need to carefully consider their practices in the context of any reform that implements the ALRC model. For example, the ALRC report suggests that, "not all free speech is of equal value to the public". In practice it may very difficult to discriminate between what is in the public interest and what is not, even where the subject matter lies safely within the sphere of legitimate public interest. For example, the ALRC Report said that the information about "…a government minister's health will be private, but the minister's interest in privacy may in some cases be outweighed by the public interest in being informed about the health of a person responsible for importance public functions." Outside those areas of public interest that are towards the "top of the list" of speech deserving protection, the ALRC Report suggested that a media business may struggle to persuade a court that they are matters of genuine public concern:

"[M]odern day media organisations have a very wide spectrum of activities and interests. On the same website on which may be found news and analysis of important political and social matters, may often be found photos of celebrities at the beach. Publishing such photos may be justified on some grounds, but hardly in the name of democracy. Courts when balancing a person's privacy interests with the public interest should naturally give relatively little weight to a newspaper's interest in publishing entertaining gossip, but considerable weight to the importance of newspapers publishing material on matters of genuine public concern."

The Government's Response indicates that, when introduced, the statutory tort will be in the form proposed by the ALRC in 2014. The Attorney-General confirmed in early May that draft legislation would be tabled in August 2024.

Contact our team of privacy rights specialists for more information about this emerging area of Australian law.